okstra 0.174.0 → 0.176.0

package/runtime/validators/validate-run.py

@@ -73,8 +73,8 @@ from okstra_ctl.incremental_scope import (  # noqa: E402
     coverage_row_blocked_on,
     stages_for_clarification,
 )
+from okstra_ctl import next_phase  # noqa: E402
 from okstra_ctl.workflow import (  # noqa: E402
-    DEFAULT_NEXT_PHASE,
     ERROR_ANALYSIS_ROUTING_DIRECTIONS,
     PHASE_SEQUENCE,
     REQUIREMENTS_DISCOVERY_ROUTING_TARGETS,
@@ -122,15 +122,21 @@ from okstra_ctl.worker_prompt_contract import (  # noqa: E402
     PromptRecord,
     validate_initial_prompt_records,
 )
+from okstra_ctl.domain.role import RoleCatalogError, role_for_duty  # noqa: E402
 from okstra_ctl.agent_invocation import (  # noqa: E402
     AgentInvocationError,
     agent_model_assignment_from_payload,
+    invocation_execution_identity_from_manifest,
     verify_agent_invocation,
 )
+from okstra_ctl.execution_identity import ExecutionManifestError  # noqa: E402
+from okstra_ctl.execution_manifest import (  # noqa: E402
+    validate_execution_manifest_payload,
+)
 from okstra_ctl.lead_events import LeadEventParseError, read_lead_events  # noqa: E402
 from okstra_ctl.worker_audit_ledger import (  # noqa: E402
     READING_CONFIRMATION_HEADING_RE,
-    check_worker_results_audit,
+    worker_results_audit_findings,
 )
 from validate_analysis_report import validate_analysis_report  # noqa: E402
 from okstra_ctl.convergence_engine import (  # noqa: E402
@@ -151,6 +157,30 @@ _AGENT_DISPATCH_DIGEST_KEYS = (
     "instructionDigest",
     "promptDigest",
 )
+_V2_AGENT_DISPATCH_IDENTITY_KEYS = (
+    "participantRef",
+    "roleExecutionRef",
+    "executionLabel",
+    "dutyId",
+    "invocationRef",
+)
+
+
+def _validate_execution_identity_v2(
+    run_manifest: Mapping[str, Any],
+    failures: list[str],
+) -> None:
+    version = run_manifest.get("schemaVersion")
+    identity_version = run_manifest.get("executionIdentityVersion")
+    if version in {1, "1", "1.0"} and identity_version is None:
+        return
+    if version != "2.0" or identity_version != 2:
+        failures.append("execution identity v2: mixed execution identity version")
+        return
+    try:
+        validate_execution_manifest_payload(run_manifest)
+    except ExecutionManifestError as exc:
+        failures.append(f"execution identity v2: {exc}")
 
 
 def _validate_agent_dispatch_contract(
@@ -169,6 +199,28 @@ def _validate_agent_dispatch_contract(
     if not isinstance(assignments, Mapping):
         failures.append("agent invocation metadata is missing: invocationAssignments")
         return
+    manifest_version = run_manifest.get("schemaVersion")
+    execution_identity_version = run_manifest.get("executionIdentityVersion")
+    if manifest_version == "2.0" and execution_identity_version == 2:
+        uses_v2_identity = True
+    elif (
+        manifest_version in {None, 1, "1", "1.0"}
+        and execution_identity_version is None
+    ):
+        uses_v2_identity = False
+    else:
+        failures.append("agent dispatch contract mixes v1 and v2 execution identity")
+        return
+    canonical_invocations = {
+        row.get("invocationRef"): row
+        for row in run_manifest.get("invocations") or []
+        if isinstance(row, Mapping)
+    } if uses_v2_identity else {}
+    canonical_attempts = {
+        (row.get("invocationRef"), row.get("attempt"))
+        for row in run_manifest.get("attempts") or []
+        if isinstance(row, Mapping)
+    } if uses_v2_identity else set()
     worker_dispatches = [
         row for row in (team_state.get("workerDispatches") or [])
         if isinstance(row, Mapping) and row.get("invocationId")
@@ -179,13 +231,15 @@ def _validate_agent_dispatch_contract(
     ]
     dispatches = [*worker_dispatches, *agent_dispatches]
     ids: dict[str, Mapping[str, Any]] = {}
+    seen_dispatch_ids: set[str] = set()
     for row in dispatches:
         dispatch_id = str(row.get("dispatchId") or "").strip()
         missing = [
             key for key in (
-                "dispatchId", "workerId", "audience", "invocationId",
+                "dispatchId", "audience", "invocationId",
                 "assignmentRef", "promptMetadataPath", "modelExecutionValue",
                 "enforcementMode", *_AGENT_DISPATCH_DIGEST_KEYS,
+                *(_V2_AGENT_DISPATCH_IDENTITY_KEYS if uses_v2_identity else ("workerId",)),
             )
             if not str(row.get(key) or "").strip()
         ]
@@ -195,10 +249,43 @@ def _validate_agent_dispatch_contract(
                 + ", ".join(missing)
             )
             continue
-        if dispatch_id in ids:
+        if uses_v2_identity:
+            if "workerId" in row or row.get("executionIdentityVersion") != 2:
+                failures.append(
+                    f"agent dispatch {dispatch_id} mixes v1 and v2 execution identity"
+                )
+                continue
+            attempt = row.get("attempt")
+            if (
+                not isinstance(attempt, int)
+                or isinstance(attempt, bool)
+                or attempt < 1
+            ):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: v2 attempt must be positive"
+                )
+                continue
+            if dispatch_id != f"{row['invocationId']}:attempt-{attempt}":
+                failures.append(
+                    f"agent dispatch {dispatch_id}: dispatchId does not match v2 attempt"
+                )
+                continue
+        elif any(
+            key in row
+            for key in (
+                "executionIdentityVersion",
+                "attempt",
+                *_V2_AGENT_DISPATCH_IDENTITY_KEYS,
+            )
+        ):
+            failures.append(
+                f"agent dispatch {dispatch_id} mixes v1 and v2 execution identity"
+            )
+            continue
+        if dispatch_id in seen_dispatch_ids:
             failures.append(f"agent dispatch ID is duplicated: {dispatch_id}")
             continue
-        ids[dispatch_id] = row
+        seen_dispatch_ids.add(dispatch_id)
         assignment_ref = str(row["assignmentRef"])
         try:
             assignment = agent_model_assignment_from_payload(
@@ -207,6 +294,118 @@ def _validate_agent_dispatch_contract(
         except AgentInvocationError as exc:
             failures.append(f"agent dispatch {dispatch_id}: {exc}")
             continue
+        execution_identity = None
+        if uses_v2_identity:
+            try:
+                execution_identity = invocation_execution_identity_from_manifest(
+                    run_manifest,
+                    assignment=assignment,
+                    assignment_ref=assignment_ref,
+                    duty_id=str(row["dutyId"]),
+                )
+            except AgentInvocationError as exc:
+                failures.append(f"agent dispatch {dispatch_id}: {exc}")
+                continue
+            if (
+                execution_identity is None
+                or row.get("participantRef") != execution_identity.participant_ref
+                or row.get("roleExecutionRef") != execution_identity.role_execution_ref
+            ):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: v2 identity does not match "
+                    "a canonical role execution"
+                )
+                continue
+            if row.get("executionLabel") != execution_identity.execution_label:
+                failures.append(
+                    f"agent dispatch {dispatch_id}: executionLabel does not match "
+                    "canonical role execution"
+                )
+                continue
+            dispatch_kind = row.get("dispatchKind") or row.get("kind")
+            if not isinstance(dispatch_kind, str) or not dispatch_kind:
+                failures.append(
+                    f"agent dispatch {dispatch_id}: dispatchKind is missing"
+                )
+                continue
+            invocation = canonical_invocations.get(row.get("invocationRef"))
+            if not isinstance(invocation, Mapping) or any((
+                invocation.get("participantRef") != row.get("participantRef"),
+                invocation.get("roleExecutionRef") != row.get("roleExecutionRef"),
+                invocation.get("dutyId") != row.get("dutyId"),
+                invocation.get("dispatchKind") != dispatch_kind,
+                invocation.get("inputDigest") != row.get("promptDigest"),
+                )):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: does not match canonical invocation"
+                )
+                continue
+            if row.get("writePolicyDigest") != invocation.get("writePolicyDigest"):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: writePolicyDigest does not "
+                    "match canonical invocation"
+                )
+                continue
+            if row.get("writeEnforcement") != invocation.get("writeEnforcement"):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: writeEnforcement does not "
+                    "match canonical invocation"
+                )
+                continue
+            mutation_mode = invocation.get("writeEnforcement", {}).get(
+                "mutationAudit"
+            ) if isinstance(invocation.get("writeEnforcement"), Mapping) else None
+            snapshot_value = row.get("mutationAuditSnapshotPath")
+            if mutation_mode == "batch" and not (
+                isinstance(snapshot_value, str) and snapshot_value.strip()
+            ):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: mutation audit snapshot is missing"
+                )
+                continue
+            if mutation_mode == "none" and snapshot_value not in (None, ""):
+                failures.append(
+                    f"agent dispatch {dispatch_id}: exact-path dispatch has a "
+                    "mutation audit snapshot"
+                )
+                continue
+            if (row.get("invocationRef"), attempt) not in canonical_attempts:
+                failures.append(
+                    f"agent dispatch {dispatch_id}: has no canonical invocation attempt"
+                )
+                continue
+            status_path_raw = row.get("statusSidecarPath")
+            if isinstance(status_path_raw, str) and status_path_raw.strip():
+                status_path = _resolve_prompt_record_path(
+                    project_root, status_path_raw
+                )
+                try:
+                    status = json.loads(status_path.read_text(encoding="utf-8"))
+                except (OSError, json.JSONDecodeError):
+                    failures.append(
+                        f"agent dispatch {dispatch_id}: wrapper status is missing or invalid"
+                    )
+                    continue
+                status_identity = {
+                    key: status.get(key)
+                    for key in (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+                } if isinstance(status, Mapping) else {}
+                dispatch_identity = {
+                    key: row.get(key)
+                    for key in (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+                }
+                if (
+                    not isinstance(status, Mapping)
+                    or status.get("schemaVersion") != "2.0"
+                    or status.get("executionIdentityVersion") != 2
+                    or status_identity != dispatch_identity
+                ):
+                    failures.append(
+                        f"agent dispatch {dispatch_id}: wrapper status identity "
+                        "does not match dispatch"
+                    )
+                    continue
+        ids[dispatch_id] = row
         metadata_path = _resolve_prompt_record_path(
             project_root, str(row["promptMetadataPath"])
         )
@@ -216,9 +415,20 @@ def _validate_agent_dispatch_contract(
             expected_run_manifest_path=run_manifest_path,
             expected_assignment=assignment,
             expected_invocation_id=str(row["invocationId"]),
-            expected_worker_id=str(row["workerId"]),
+            expected_worker_id=(
+                None if uses_v2_identity else str(row["workerId"])
+            ),
             expected_assignment_ref=assignment_ref,
             expected_audience=str(row["audience"]),
+            expected_participant_ref=(
+                str(row["participantRef"]) if uses_v2_identity else None
+            ),
+            expected_role_execution_ref=(
+                str(row["roleExecutionRef"]) if uses_v2_identity else None
+            ),
+            expected_invocation_ref=(
+                str(row["invocationRef"]) if uses_v2_identity else None
+            ),
         )
         failures.extend(
             f"agent dispatch {dispatch_id}: {error}" for error in errors
@@ -258,10 +468,23 @@ def _validate_agent_dispatch_contract(
                 else "host-native prompt delivery cannot be marked verified"
             )
 
-    lead_ids = {
-        dispatch_id for dispatch_id, row in ids.items()
-        if row.get("audience") == "lead" and row.get("workerId") == "lead"
-    }
+    if uses_v2_identity:
+        role_executions = {
+            row.get("roleExecutionRef"): row
+            for row in run_manifest.get("roleExecutions") or []
+            if isinstance(row, Mapping)
+        }
+        lead_ids = {
+            dispatch_id for dispatch_id, row in ids.items()
+            if row.get("audience") == "lead"
+            and isinstance(role_executions.get(row.get("roleExecutionRef")), Mapping)
+            and role_executions[row["roleExecutionRef"]].get("role") == "leader"
+        }
+    else:
+        lead_ids = {
+            dispatch_id for dispatch_id, row in ids.items()
+            if row.get("audience") == "lead" and row.get("workerId") == "lead"
+        }
     if not lead_ids:
         failures.append("accepted lead result has no lead dispatch record")
 
@@ -277,6 +500,22 @@ def _validate_agent_dispatch_contract(
         if dispatch_id not in ids or not result_path:
             failures.append("agent result link has no matching dispatch record")
             continue
+        if uses_v2_identity:
+            dispatch = ids[dispatch_id]
+            identity_keys = (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+            link_identity = {key: link.get(key) for key in identity_keys}
+            dispatch_identity = {key: dispatch.get(key) for key in identity_keys}
+            if "workerId" in link or link_identity != dispatch_identity:
+                failures.append(
+                    f"agent result link identity does not match dispatch: {dispatch_id}"
+                )
+                continue
+        elif any(
+            key in link
+            for key in (*_V2_AGENT_DISPATCH_IDENTITY_KEYS, "attempt")
+        ):
+            failures.append("agent result link mixes v1 and v2 execution identity")
+            continue
         dispatch_link_counts[dispatch_id] = dispatch_link_counts.get(dispatch_id, 0) + 1
         previous = paths.setdefault(result_path, dispatch_id)
         if previous != dispatch_id:
@@ -296,7 +535,11 @@ def _validate_agent_dispatch_contract(
         worker_result = str(worker.get("resultPath") or "").strip()
         worker_dispatch_ids = {
             dispatch_id for dispatch_id, row in ids.items()
-            if row.get("workerId") == worker_id
+            if (
+                row.get("assignmentRef") == f"initial/{worker_id}"
+                if uses_v2_identity
+                else row.get("workerId") == worker_id
+            )
         }
         if worker_id and not worker_dispatch_ids:
             failures.append(
@@ -384,68 +627,6 @@ def write_json(path: Path, payload: dict) -> None:
     path.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n")
 
 
-def default_next_phase(task_type: str) -> str:
-    return DEFAULT_NEXT_PHASE.get(task_type, "unknown")
-
-
-def advance_next_phase(
-    current_phase: str,
-    phase_sequence: list,
-) -> str:
-    """Compute the next recommended phase after `current_phase` completes.
-
-    Walk `phase_sequence` and return the entry following `current_phase`.
-    Falls back to the static `default_next_phase` mapping when the current
-    phase is the terminal entry or is absent from the sequence (e.g. custom
-    task types that aren't part of the standard 5-phase lifecycle).
-    """
-    if isinstance(phase_sequence, list) and current_phase in phase_sequence:
-        idx = phase_sequence.index(current_phase)
-        if idx + 1 < len(phase_sequence):
-            return phase_sequence[idx + 1]
-        return "done-or-follow-up"
-    return default_next_phase(current_phase)
-
-
-def _error_analysis_next_phase(data: Mapping[str, Any]) -> str | None:
-    if not isinstance(data, Mapping):
-        return None
-    header = data.get("header")
-    if not isinstance(header, Mapping) or header.get("taskType") != "error-analysis":
-        return None
-    error_analysis = data.get("errorAnalysis")
-    if not isinstance(error_analysis, Mapping):
-        return None
-    routing = error_analysis.get("routing")
-    if not isinstance(routing, Mapping):
-        return None
-    target = routing.get("nextTaskType")
-    if target in ERROR_ANALYSIS_ROUTING_DIRECTIONS:
-        return str(target)
-    return None
-
-
-def _requirements_discovery_next_phase(data: Mapping[str, Any]) -> str | None:
-    if not isinstance(data, Mapping):
-        return None
-    header = data.get("header")
-    if (
-        not isinstance(header, Mapping)
-        or header.get("taskType") != "requirements-discovery"
-    ):
-        return None
-    requirements = data.get("requirementsDiscovery")
-    if not isinstance(requirements, Mapping):
-        return None
-    routing = requirements.get("routing")
-    if not isinstance(routing, Mapping):
-        return None
-    target = routing.get("nextTaskType")
-    if target in REQUIREMENTS_DISCOVERY_ROUTING_TARGETS:
-        return str(target)
-    return None
-
-
 def update_workflow_metadata(
     run_manifest: dict,
     task_manifest: dict,
@@ -472,36 +653,49 @@ def update_workflow_metadata(
     for phase in phase_sequence:
         phase_states.setdefault(phase, "not-started")
 
+    # 포인터는 리드가 리포트에 저작하고, 이 검증기는 그것을 계산하지 않는다.
+    # 여기서 하는 일은 리포트의 Phase 라우팅 투영과 대조하는 것뿐이다.
+    authored = next_phase.promote(workflow.get("nextRecommendedPhase"))
+    workflow.pop("nextRecommendedPhaseCorrection", None)
+
     if validation_status == "passed":
         current_phase_state = "completed"
         if current_phase:
             phase_states[current_phase] = current_phase_state
         last_completed_phase = current_phase or workflow.get("lastCompletedPhase", "")
-        # Validation just passed → actively advance to the next phase in
-        # the sequence rather than preserving a stale value that may equal
-        # current_phase (which would cause the lifecycle pointer to stall).
-        if current_phase == "requirements-discovery":
-            report_next_phase = _requirements_discovery_next_phase(report_data or {})
-        elif current_phase == "error-analysis":
-            report_next_phase = _error_analysis_next_phase(report_data or {})
+        # 어긋나면 투영값으로 정정하되 실행은 죽이지 않는다 — 분석이 통과한 run 을
+        # 장부 필드 하나 때문에 버리지 않는다 (ADR-0004).
+        projected = next_phase.project(report_data or {})
+        if (
+            authored["phase"] == projected["phase"]
+            and authored["status"] == projected["status"]
+        ):
+            next_recommended_phase = authored
         else:
-            report_next_phase = None
-        next_recommended_phase = report_next_phase or advance_next_phase(
-            current_phase, phase_sequence
-        )
+            # 리드의 근거는 리드가 고른 phase 를 설명하는 문장이다. phase 를 정정한
+            # 뒤에도 들고 오면 포인터가 자기 목적지를 설명하지 않는 문장을 달게 된다.
+            # 원문은 아래 correction["authored"] 에 그대로 보존된다.
+            next_recommended_phase = next_phase.make(
+                phase=projected["phase"],
+                status=projected["status"],
+                rationale=(
+                    "리포트 라우팅에서 투영됨. 리드가 쓴 값과 근거는 "
+                    "nextRecommendedPhaseCorrection.authored 에 있다."
+                ),
+            )
+            # applied 는 사본이다. 살아 있는 포인터와 같은 dict 를 가리키면
+            # 나중에 포인터를 제자리 변형하는 호출부가 감사 기록까지 바꾼다.
+            workflow["nextRecommendedPhaseCorrection"] = {
+                "authored": authored,
+                "applied": dict(next_recommended_phase),
+            }
     else:
         current_phase_state = "blocked"
         if current_phase:
             phase_states[current_phase] = current_phase_state
         last_completed_phase = workflow.get("lastCompletedPhase", "")
-        next_recommended_phase = current_phase or workflow.get(
-            "nextRecommendedPhase", ""
-        )
-
-    routing_status = workflow.get("routingStatus")
-    if not isinstance(routing_status, str) or not routing_status.strip():
-        routing_status = (
-            "pending" if current_phase == "requirements-discovery" else "not-applicable"
+        next_recommended_phase = next_phase.make(
+            status=next_phase.STATUS_BLOCKED, rationale=authored["rationale"]
         )
 
     awaiting_approval = workflow.get("awaitingApproval")
@@ -549,6 +743,9 @@ def update_workflow_metadata(
         }
     )
 
+    # routingStatus 는 포인터 status 로 흡수됐다. update() 는 키를 더할 뿐이라
+    # 이전 run 이 남긴 값은 명시적으로 지워야 사라진다.
+    workflow.pop("routingStatus", None)
     workflow.update(
         {
             "phaseSequence": phase_sequence,
@@ -558,7 +755,6 @@ def update_workflow_metadata(
             "lastCompletedPhase": last_completed_phase,
             "nextRecommendedPhase": next_recommended_phase,
             "awaitingApproval": awaiting_approval,
-            "routingStatus": routing_status,
             "lastSafeCheckpoint": last_safe_checkpoint,
         }
     )
@@ -567,6 +763,10 @@ def update_workflow_metadata(
     workflow_snapshot = run_manifest.get("workflowSnapshot", {})
     if not isinstance(workflow_snapshot, dict):
         workflow_snapshot = {}
+    # task manifest 의 workflow 는 다음 run 이 덮어쓰므로 정정 기록이 남지 않는다.
+    # run 단위 감사 기록은 이 스냅샷이 유일한 보관처다.
+    workflow_snapshot.pop("routingStatus", None)
+    workflow_snapshot.pop("nextRecommendedPhaseCorrection", None)
     workflow_snapshot.update(
         {
             "phaseSequence": workflow["phaseSequence"],
@@ -574,12 +774,20 @@ def update_workflow_metadata(
             "currentPhaseState": workflow["currentPhaseState"],
             "phaseStates": workflow["phaseStates"],
             "lastCompletedPhase": workflow["lastCompletedPhase"],
-            "nextRecommendedPhase": workflow["nextRecommendedPhase"],
+            # 포인터는 이제 문자열이 아니라 dict 다. 두 매니페스트가 같은 객체를
+            # 공유하면 한쪽을 제자리 변형할 때 다른 쪽이 조용히 따라 바뀐다.
+            "nextRecommendedPhase": dict(workflow["nextRecommendedPhase"]),
             "awaitingApproval": workflow["awaitingApproval"],
-            "routingStatus": workflow["routingStatus"],
             "lastSafeCheckpoint": workflow["lastSafeCheckpoint"],
         }
     )
+    if "nextRecommendedPhaseCorrection" in workflow:
+        # 두 매니페스트는 별개 파일로 나간다 — dict 를 공유시키지 않는다.
+        # 겉 dict 만 복사하면 authored·applied 는 여전히 같은 객체다.
+        workflow_snapshot["nextRecommendedPhaseCorrection"] = {
+            key: dict(value)
+            for key, value in workflow["nextRecommendedPhaseCorrection"].items()
+        }
     run_manifest["workflowSnapshot"] = workflow_snapshot
 
 
@@ -590,13 +798,16 @@ def update_validation_metadata(
     validation_status: str,
     failures: list[str],
     report_data: Mapping[str, Any] | None = None,
+    advisories: list[str] | None = None,
 ) -> None:
     checked_at = utc_now()
+    advisories = list(advisories or [])
 
     team_state.setdefault("validator", {})
     team_state["validator"]["status"] = validation_status
     team_state["validator"]["lastValidatedAt"] = checked_at
     team_state["validator"]["failures"] = failures
+    team_state["validator"]["advisories"] = advisories
 
     run_manifest.setdefault("validation", {})
     run_manifest["validation"]["required"] = True
@@ -604,6 +815,8 @@ def update_validation_metadata(
     run_manifest["validation"]["lastCheckedAt"] = checked_at
     run_manifest["validation"]["passed"] = validation_status == "passed"
     run_manifest["validation"]["failures"] = failures
+    # Reported, not blocking — a passing run can carry these.
+    run_manifest["validation"]["advisories"] = advisories
     run_manifest["status"] = (
         "completed" if validation_status == "passed" else "contract-violated"
     )
@@ -709,35 +922,127 @@ def _persisted_prompt_records(
     project_root: Path,
     selected_ids: set[str],
     team_state: dict,
-) -> list[PromptRecord]:
-    dispatches = team_state.get("workerDispatches")
-    source = dispatches if isinstance(dispatches, list) and dispatches else (
-        team_state.get("workers") or []
+    run_manifest: Mapping[str, Any],
+) -> tuple[list[PromptRecord], list[str]]:
+    uses_v2_identity = (
+        run_manifest.get("schemaVersion") == "2.0"
+        and run_manifest.get("executionIdentityVersion") == 2
     )
+    dispatches = team_state.get("workerDispatches")
+    if uses_v2_identity:
+        source = [
+            *(dispatches if isinstance(dispatches, list) else []),
+            *(
+                team_state.get("agentDispatches")
+                if isinstance(team_state.get("agentDispatches"), list)
+                else []
+            ),
+        ]
+    else:
+        source = dispatches if isinstance(dispatches, list) and dispatches else (
+            team_state.get("workers") or []
+        )
     records: list[PromptRecord] = []
     seen: set[tuple[str, str, str]] = set()
+    errors: list[str] = []
+    role_executions = {
+        str(row.get("roleExecutionRef") or ""): row
+        for row in run_manifest.get("roleExecutions") or []
+        if isinstance(row, Mapping)
+    } if uses_v2_identity else {}
     for worker in source:
         if not isinstance(worker, dict):
             continue
-        worker_id = str(worker.get("workerId") or "").strip()
+        assignment_ref = str(worker.get("assignmentRef") or "").strip()
+        worker_id = (
+            assignment_ref.removeprefix("initial/")
+            if uses_v2_identity and assignment_ref.startswith("initial/")
+            else str(worker.get("workerId") or "").strip()
+        )
         prompt_value = str(worker.get("promptPath") or "").strip()
-        if worker_id not in selected_ids or not prompt_value:
+        if worker_id not in selected_ids:
             continue
-        dispatch_kind = str(worker.get("kind") or "").strip()
+        if not prompt_value:
+            errors.append(f"{worker_id}: persisted initial prompt path is missing")
+            continue
+        dispatch_kind = str(
+            worker.get("kind") or worker.get("dispatchKind") or ""
+        ).strip()
         if not dispatch_kind:
             dispatch_kind = _fallback_dispatch_kind(prompt_value)
+        duty_id = ""
+        if uses_v2_identity:
+            execution = role_executions.get(
+                str(worker.get("roleExecutionRef") or "").strip()
+            )
+            participant_ref = str(worker.get("participantRef") or "").strip()
+            duty_id = str(worker.get("dutyId") or "").strip()
+            audience = str(worker.get("audience") or "").strip()
+            assignments = run_manifest.get("invocationAssignments")
+            assignment = (
+                assignments.get(assignment_ref)
+                if isinstance(assignments, Mapping)
+                else None
+            )
+            if not isinstance(execution, Mapping):
+                errors.append(
+                    f"{worker_id}: persisted prompt has unknown roleExecutionRef"
+                )
+                continue
+            try:
+                expected_role = role_for_duty(duty_id)
+            except RoleCatalogError as exc:
+                errors.append(f"{worker_id}: {exc}")
+                continue
+            if (
+                execution.get("participantRef") != participant_ref
+                or execution.get("role") != expected_role
+                or execution.get("executionLabel") != worker.get("executionLabel")
+                or not isinstance(assignment, Mapping)
+                or execution.get("provider") != assignment.get("provider")
+                or not isinstance(execution.get("binding"), Mapping)
+                or execution["binding"].get("resolvedExecutionValue")
+                != assignment.get("modelExecutionValue")
+            ):
+                errors.append(
+                    f"{worker_id}: persisted prompt identity does not match role execution"
+                )
+                continue
+            if audience != duty_id:
+                errors.append(
+                    f"{worker_id}: persisted prompt audience does not match duty"
+                )
+                continue
         identity = (worker_id, dispatch_kind, prompt_value)
         if identity in seen:
             continue
         seen.add(identity)
+        metadata_value = str(worker.get("promptMetadataPath") or "").strip()
         records.append(
             PromptRecord(
                 worker_id=worker_id,
                 dispatch_kind=dispatch_kind,
                 path=_resolve_prompt_record_path(project_root, prompt_value),
+                expected_model=(
+                    str(worker.get("modelExecutionValue") or "").strip() or None
+                    if uses_v2_identity else None
+                ),
+                metadata_path=(
+                    _resolve_prompt_record_path(project_root, metadata_value)
+                    if uses_v2_identity and metadata_value else None
+                ),
+                expected_duty_audience=(duty_id if uses_v2_identity else None),
             )
         )
-    return records
+    if uses_v2_identity:
+        recorded_ids = {record.worker_id for record in records}
+        missing_ids = sorted(selected_ids - recorded_ids)
+        if missing_ids:
+            errors.append(
+                "no persisted initial prompt records for selected role executions: "
+                + ", ".join(missing_ids)
+            )
+    return records, errors
 
 
 def _markdown_section(text: str, heading: str) -> str:
@@ -863,15 +1168,16 @@ def _validate_initial_analysis_prompts(
     team_state = data.get("teamState") or {}
     manifest = dict(run_manifest)
     manifest["taskType"] = task_type
-    records = _persisted_prompt_records(
+    records, collection_errors = _persisted_prompt_records(
         project_root=project_root,
         selected_ids=selected_ids,
         team_state=team_state,
+        run_manifest=run_manifest,
     )
-    errors = validate_initial_prompt_records(
+    errors = [*collection_errors, *validate_initial_prompt_records(
         manifest=manifest,
         records=records,
-    )
+    )]
     if task_type == "improvement-discovery":
         errors.extend(
             _validate_improvement_primary_assignments(
@@ -2638,22 +2944,30 @@ def _report_run_seq(report_path: Path) -> str | None:
 
 
 def validate_worker_results_audit(
-    report_path: Path, task_type: str, failures: list[str]
+    report_path: Path,
+    task_type: str,
+    failures: list[str],
+    advisories: list[str] | None = None,
 ) -> None:
     """Enforce the worker audit sidecar contract at Phase 7.
 
     The rules themselves live in `okstra_ctl.worker_audit_ledger` so that
     `okstra worker-audit-check` can apply the identical checks mid-run, while
-    the worker session is still alive and can fix its own citations. All this
-    wrapper adds is the Phase 7 anchor: the run directory and this run's seq,
-    both read off the report path.
+    the worker session is still alive and can fix its own citations. This
+    wrapper adds the Phase 7 anchor — the run directory and this run's seq, both
+    read off the report path — and routes the citation-ledger findings to
+    *advisories*, which do not fail the run. Mid-run the worker can still fix a
+    citation; at Phase 7 the only remedy left is to void a finished run over a
+    spelling, so the finding is reported instead.
     """
-    failures.extend(check_worker_results_audit(
+    blocking, ledger = worker_results_audit_findings(
         # `report_path` is `runs/<task-type>/reports/final-report-...md`.
         report_path.parent.parent,
         task_type,
         _report_run_seq(report_path),
-    ))
+    )
+    failures.extend(blocking)
+    (advisories if advisories is not None else failures).extend(ledger)
 
 
 def validate_team_state_usage(team_state: dict, failures: list[str]) -> None:
@@ -3080,6 +3394,13 @@ def validate_final_report_data(
         return data
 
     manifest = run_manifest or {}
+    if data.get("executionIdentityVersion") == 2 or data.get("executionRoles"):
+        try:
+            from okstra_ctl.report_contract import assert_execution_roles_match_manifest
+
+            assert_execution_roles_match_manifest(data, manifest)
+        except ValueError as exc:
+            failures.append(str(exc))
     _validate_approval_context(data, manifest, failures, report_path)
     _validate_activity_contract_plan_limits(data, manifest, failures)
 
@@ -3373,7 +3694,17 @@ _ADVISORY_ONLY_KINDS = {"d"}
 # Stop reasons that justify promoting a still-broken planner-fixable item to the
 # user: the self-fix budget ran out, or a round produced no net resolution so
 # further rounds would repeat themselves.
-_SELF_FIX_EXHAUSTED_REASONS = frozenset({"max-rounds-reached", "no-progress"})
+#
+# `cause-group-recurrence` is the legacy spelling of that same exhaustion
+# (plan-body-verification.md "Loop termination"). A pre-activity-contract report
+# carrying it is a report whose loop stopped because the cause kept recurring —
+# refusing it here left such a run with no exit at all: the loop may not run
+# again, and the surviving item may not be promoted either.
+# `_validate_activity_contract_plan_limits` still forbids a NEW v1 run from
+# emitting it, so this admits the legacy shape without reopening it.
+_SELF_FIX_EXHAUSTED_REASONS = frozenset(
+    {"max-rounds-reached", "no-progress", "cause-group-recurrence"}
+)
 
 
 def _is_variation_point_item(item: dict) -> bool:
@@ -4758,10 +5089,11 @@ def _items_resolved_in_round(plan_items: object, round_number: int) -> set[str]:
 def _detect_self_fix_recurrence(pbv: dict) -> list[str]:
     """Rounds that re-target ground the previous round already worked, unresolved.
 
-    `no-progress` counts resolutions, which a round can claim while its
-    correction introduces the next round's defect — the observed shape was two
-    rounds spent on one identical seven-item set. Repeating the previous
-    round's *unresolved* remainder is the earlier signal.
+    `no-progress` is judged at the round's end from what it resolved. Repeating
+    the previous round's *unresolved* remainder is the same conclusion reached
+    one dispatch earlier — the observed shape was two rounds spent on one
+    identical seven-item set. This names that shape so the loop can exit on it
+    rather than paying for the round that proves it.
 
     Advisory only. Narrowing onto what the last round genuinely left open is
     legitimate progress, and the rule separating that from re-digging the same
@@ -4790,8 +5122,8 @@ def _detect_self_fix_recurrence(pbv: dict) -> list[str]:
                 f"self-fix round {round_number} re-targets only items round "
                 f"{round_number - 1} left unresolved ({', '.join(sorted(current))}) "
                 "— the previous round's correction did not move this cause. "
-                "Consider exiting with `cause-group-recurrence` instead of "
-                "spending the remaining budget on the same ground."
+                "Consider exiting with `no-progress` instead of spending the "
+                "remaining budget on the same ground."
             )
     return warnings
 
@@ -7582,13 +7914,6 @@ def _validate_stage_has_requirement(data: dict, failures: list[str]) -> None:
         )
 
 
-_FINAL_VERIFICATION_ROUTING_TOKEN_RE = re.compile(
-    r"(?<![A-Za-z-])(?:release-handoff\(stage-group\)|release-handoff|done|"
-    r"implementation|error-analysis|implementation-option-selection|"
-    r"implementation-planning)(?![A-Za-z-])"
-)
-
-
 def _validate_final_verification_consistency(data: dict, failures: list[str]) -> None:
     """Enforce verdict ↔ blocker/condition/routing consistency on the
     final-verification data.json (SSOT). The schema guarantees field SHAPE;
@@ -7604,15 +7929,15 @@ def _validate_final_verification_consistency(data: dict, failures: list[str]) ->
     blockers = fv.get("acceptanceBlockers") or []
     conditions = verdict.get("conditionalAcceptanceConditions") or []
     routing_value = fv.get("routingRecommendation")
-    routing = routing_value if isinstance(routing_value, str) else ""
-    routing_tokens = _FINAL_VERIFICATION_ROUTING_TOKEN_RE.findall(routing)
-    routing_token = routing_tokens[0] if len(routing_tokens) == 1 else None
-
-    if routing_token is None:
+    routing_token = ""
+    if isinstance(routing_value, dict):
+        routing_token = str(routing_value.get("target") or "")
+    if not routing_token:
         failures.append(
-            "final-verification: routingRecommendation must contain exactly one "
-            "supported routing token."
+            "final-verification: routingRecommendation.target must name exactly one "
+            "supported routing target."
         )
+        routing_token = None
 
     if token == "accepted" and blockers:
         failures.append(
@@ -7898,11 +8223,16 @@ def _validate_session_conformance(
     task_type: str,
     claude_projects_dir: str | None,
     failures: list[str],
+    advisories: list[str] | None = None,
 ) -> None:
     """prompts/lead/okstra-lead-contract.md의 PROGRESS / activity / heartbeat /
     implementation entry guard 사후 검사를 위임하고 실패를
     ``session-conformance: `` 접두로 folding 한다. 설계:
     docs/superpowers/specs/2026-06-10-blocking-contract-posthoc-conformance-design.md
+
+    PROGRESS 서술 라인 누락은 ``result.advisories`` 로 돌아오며 run 을
+    실패시키지 않는다 — 그 라인을 쓸 세션은 이 검사가 도는 시점에 이미 끝나 있어
+    남은 구제책이 phase 폐기뿐이다.
     """
     _validators_dir = Path(__file__).resolve().parent
     if str(_validators_dir) not in sys.path:
@@ -7924,6 +8254,9 @@ def _validate_session_conformance(
         claude_projects_dir=Path(claude_projects_dir) if claude_projects_dir else None,
     )
     failures.extend(f"session-conformance: {err}" for err in result.errors)
+    (advisories if advisories is not None else failures).extend(
+        f"session-conformance: {note}" for note in result.advisories
+    )
 
 
 def _validate_forbidden_actions(
@@ -8677,8 +9010,21 @@ def main() -> int:
             print(f"validate-run: Phase 7 auto-recovery skipped — {msg}", file=sys.stderr)
 
     failures: list[str] = []
+    # Findings that are reported but do not fail the run.
+    #
+    # The line is whether a remedy still exists at Phase 7. A defect in the
+    # report is fixable — re-author it and re-render. A defect in what a
+    # *finished session* wrote down is not: the worker that would restate its
+    # citation and the lead pane that would emit its PROGRESS line have both
+    # ended, so the only remaining move is to void the phase. That blocks the
+    # next phase without establishing that any conclusion in the report is
+    # wrong. Those findings are surfaced and carried in the run manifest
+    # instead — currently the worker citation ledger and the PROGRESS narration
+    # lines.
+    advisories: list[str] = []
     if autofix_state == "accuracy-failed":
         failures.extend(autofix_messages)
+    _validate_execution_identity_v2(run_manifest, failures)
     contract = extract_contract(run_manifest, task_manifest, failures)
     concurrent_run_authorized = bool(
         (run_manifest.get("concurrentRun") or {}).get("detected")
@@ -8743,7 +9089,7 @@ def main() -> int:
         failures,
     )
     if task_type:
-        validate_worker_results_audit(report_path, task_type, failures)
+        validate_worker_results_audit(report_path, task_type, failures, advisories)
         _validate_session_conformance(
             team_state,
             team_state_path,
@@ -8753,6 +9099,7 @@ def main() -> int:
             task_type,
             args.claude_projects_dir,
             failures,
+            advisories,
         )
         _validate_forbidden_actions(
             team_state,
@@ -8850,6 +9197,7 @@ def main() -> int:
         validation_status,
         failures,
         report_data=validation_data,
+        advisories=advisories,
     )
 
     write_json(team_state_path, team_state)
@@ -8876,10 +9224,14 @@ def main() -> int:
             + "\n"
         )
 
+    for note in advisories:
+        print(f"validate-run: advisory — {note}", file=sys.stderr)
+
     result = {
         "validationStatus": validation_status,
         "finalRunStatus": run_manifest.get("status"),
         "failures": failures,
+        "advisories": advisories,
         "teamStatePath": str(team_state_path),
         "reportPath": str(report_path),
     }