okstra 0.177.0 → 0.178.0

package/runtime/validators/validate-report-views.py

@@ -2,20 +2,26 @@
 """Validate the self-contained HTML view produced by Phase 7 step 1.5
 (``scripts/okstra-render-report-views.py``).
 
-Checks, for a given final-report MD path:
-  1. ``*.html`` sibling exists when the report has clarification rows,
-     an analysis-review contract, or a plan-approval contract.
-  2. HTML's ``source-sha256`` in run-meta matches the current MD body —
-     stale html detection.
-  3. HTML's §5.6 / §5.7 / §5.8 deliverable regions contain no
-     ``<textarea>`` / ``<input>`` / ``<select>`` (form-attach is
-     restricted to §1 clarification rows).
-  4. HTML has no external URLs in ``<script src=>`` / ``<link href=>`` /
-     ``<img src=>`` — self-contained guarantee.
-  5. Every Response ID in HTML matches the §1 Clarification Items table
-     of the source MD (1:1).
-  6. Analysis reports contain all three Analysis Review decisions and an
-     affected-ID selector exactly matching the structured IDs in data.json.
+Takes the report's Markdown path as its handle and branches on schema.
+
+A schema-v2 report is checked against its ``.data.json`` — the record the
+HTML was rendered from — and never against the Markdown sibling, which is a
+second rendering of that same record:
+  1. the ``*.html`` sibling exists;
+  2. the document carries the task type's own template;
+  3. every human field the task type requires is present, and no audit field
+     leaked into the human main;
+  4. each visualization's svg node ids match its fallback ids;
+  5. the Response IDs in the HTML match ``clarificationItems[]`` 1:1;
+  6. no external URL appears in ``<script src=>`` / ``<link href=>`` /
+     ``<img src=>`` — the self-contained guarantee.
+
+A schema-v1 report keeps the Markdown as its source, so its checks read the
+§1 Clarification Items table (fail-closed when the heading is present but the
+table will not parse), require the HTML sibling only when the report carries
+clarification rows or an analysis-review / plan-approval contract, forbid form
+controls in the §5.6 / §5.7 / §5.8 deliverable regions, and enforce the same
+Response-ID parity and self-contained rules.
 
 Exit codes: 0 on success, 1 on any failure. Failures are printed one
 per line to stderr.
@@ -179,14 +185,21 @@ def _validate_analysis_review_html(
 
 
 def validate(report_path: Path) -> list[str]:
+    """Validate the html view of the report named by *report_path*.
+
+    A schema-v2 report is checked against its data.json and the rendered html;
+    the AI-handoff markdown is a sibling rendering of the same record and is
+    never read here, so it does not have to exist. Schema-v1 reports keep the
+    markdown as their source and still require it.
+    """
     failures: list[str] = []
+    v2 = _load_v2_data(report_path)
+    if v2 is not None:
+        return _validate_v2(report_path, v2[0], v2[1])
     if not report_path.is_file():
         return [f"final-report not found: {report_path}"]
 
     md = report_path.read_text(encoding="utf-8")
-    v2 = _load_v2_data(report_path)
-    if v2 is not None:
-        return _validate_v2(report_path, v2[0], v2[1])
     html_path = html_view_path(report_path)
     # §1 헤딩이 있는데 파싱이 실패하면 md_ids 가 빈 []이 되어 "clarification 없음
     # → skip" 으로 흘러 HTML form parity 게이트가 조용히 열린다. fail-closed.

package/runtime/validators/validate-run.py

@@ -51,6 +51,10 @@ from okstra_ctl.conformance import (  # noqa: E402
     qa_result_from_dict,
     validate_conformance_manifest,
 )
+from okstra_ctl.dispatch_state import (  # noqa: E402
+    DispatchError,
+    v2_worker_state_key,
+)
 from okstra_ctl.paths import RunRef  # noqa: E402
 from okstra_ctl.report_contract import CURRENT_REPORT_SCHEMA_VERSION  # noqa: E402
 from okstra_ctl.release_gate import (  # noqa: E402
@@ -862,6 +866,12 @@ def extract_contract(
         required_worker_roles = []
         failures.append("requiredWorkerRoles is missing from run/task manifest")
 
+    optional_worker_roles = run_contract.get("optionalWorkerRoles")
+    if not isinstance(optional_worker_roles, list):
+        optional_worker_roles = task_contract.get("optionalWorkerRoles")
+    if not isinstance(optional_worker_roles, list):
+        optional_worker_roles = []
+
     lead_role = (
         run_contract.get("leadRole")
         or task_contract.get("leadRole")
@@ -892,6 +902,7 @@ def extract_contract(
             or ""
         ),
         "required_worker_roles": required_worker_roles,
+        "optional_worker_roles": optional_worker_roles,
         "required_agent_status_entries": [
             item
             for item in required_agent_status_entries
@@ -1216,6 +1227,24 @@ def _is_legal_concurrent_run_skip(
     )
 
 
+def _dispatch_roster_key(row: Mapping[str, Any]) -> str:
+    """The roster worker this dispatch row started, v1 or v2.
+
+    A v2 row carries no `workerId` — `_validate_agent_dispatch_contract`
+    fails the run when one is present, calling it a v1/v2 identity mix. So
+    reading the roster key off that field alone left every v2 row invisible
+    and reported workers okstra had in fact started as never dispatched. The
+    v2 projection is the one dispatch itself uses.
+    """
+    worker_id = str(row.get("workerId", "")).strip()
+    if worker_id:
+        return worker_id
+    try:
+        return v2_worker_state_key(row)
+    except DispatchError:
+        return ""
+
+
 def _validate_cmux_workers_were_dispatched_by_okstra(
     team_state: dict,
     workers: list,
@@ -1243,9 +1272,11 @@ def _validate_cmux_workers_were_dispatched_by_okstra(
     if str(adapter.get("name", "")).strip() != "cmux":
         return
     recorded = {
-        str(row.get("workerId", "")).strip()
+        key
         for row in team_state.get("workerDispatches") or []
         if isinstance(row, dict)
+        for key in (_dispatch_roster_key(row),)
+        if key
     }
     missing = []
     for worker in workers:
@@ -1447,7 +1478,15 @@ def validate_team_state(
         if status != "completed" and not reason:
             failures.append(f"{role} with status `{status}` must include a reason")
 
-    unexpected_roles = set(by_role) - set(expected_workers)
+    # A declared optional role may appear in the roster and may equally be
+    # absent: the run states which ones it can dispatch (today, the critics),
+    # and running one is not a contract violation.
+    optional_roles = {
+        str(worker.get("role", "")).strip()
+        for worker in contract.get("optional_worker_roles", [])
+        if isinstance(worker, dict) and str(worker.get("role", "")).strip()
+    }
+    unexpected_roles = set(by_role) - set(expected_workers) - optional_roles
     for role in sorted(unexpected_roles):
         failures.append(f"unexpected worker role detected: {role}")
 
@@ -1621,60 +1660,46 @@ def _scan_token_usage_summary(
 # a section heading line (not as inline text inside a paragraph or table).
 _VERDICT_CARD_HEADING_RE = re.compile(r"^##[ \t]+Verdict Card\b", re.MULTILINE)
 
-_V2_AI_HANDOFF_HEADINGS = (
-    "## AI Handoff Summary",
-    "## Clarification and User Decisions",
-    "## Evidence Ledger",
-    "## Task Deliverable:",
-    "## Cross Verification Audit",
-    "## Execution Audit",
-    "## Token and Cost Audit",
-)
-
-
-# `humanSummary` / `userNarrative` belong to the human HTML. The AI Markdown
-# renders field names as headings or bold labels
-# (scripts/okstra_ctl/report_markdown.py `humanise`), so this matches the two
-# forms the renderer can emit rather than the raw JSON key — a key name in
-# quotes no longer appears anywhere in the Markdown. Anchored to the start of a
-# line so the same words inside worker prose are not a violation.
-_V2_HUMAN_ONLY_RENDERED_RE = re.compile(
-    r"^(?:#{2,6}[ \t]+(?P<heading>Human Summary|User Narrative)[ \t]*$"
-    r"|[ \t]*-[ \t]+\*\*(?P<label>Human Summary|User Narrative)\*\*[ \t]*:)",
-    re.MULTILINE,
-)
-
-
-def _validate_v2_ai_handoff(content: str, failures: list[str]) -> None:
-    positions: list[int] = []
-    for heading in _V2_AI_HANDOFF_HEADINGS:
-        count = content.count(heading)
-        if count != 1:
+def _validate_v2_report(
+    report_data: Mapping[str, Any],
+    required_agent_status_entries: list[str],
+    failures: list[str],
+) -> None:
+    """Contract checks for a schema-v2 report, read from its data.json.
+
+    The AI-handoff markdown is a deterministic rendering of this record, so the
+    checks that used to scan it — heading count and order, human-only fields
+    leaking into the AI artifact, a Reading Confirmation heading — were asking
+    whether the renderer had done its job, not whether the report was sound.
+    Schema enforcement in `render_final_report._enforce_schema` already answers
+    the second question, and the first is settled by the template. What is left
+    is the pair of facts the markdown could only ever carry second-hand: which
+    agents the run must account for, and whether the token cells were filled.
+
+    Both are scanned over the serialized record, as text, because that is what
+    the markdown scan was. Requiring each label to equal an
+    `executionStatus[].role` would be a stricter rule than the contract states
+    anywhere: the schema types `role` as a free string, no prompt or worker spec
+    fixes its vocabulary, and `okstra_token_usage.report._match_worker_index`
+    treats function-role spellings ("Analysis verifier", "Acceptance critic") as
+    a shape reports do take — matching them by containment, never equality.
+    Tightening this belongs with an authoring rule that says what to write, not
+    on its own. Nothing is lost by reading the record instead of its rendering:
+    the labels never come from the template or the i18n dictionaries.
+    """
+    serialized = json.dumps(report_data, ensure_ascii=False)
+    for label in required_agent_status_entries:
+        if label not in serialized:
             failures.append(
-                "schema-v2 AI handoff markdown requires exactly one "
-                f"`{heading}` heading; found {count}."
+                f"final report does not include required agent status entry: {label}"
+            )
+    for placeholder in TOKEN_PLACEHOLDERS:
+        if placeholder in serialized:
+            failures.append(
+                f"final report contains unsubstituted token placeholder `{placeholder}` — "
+                "run `okstra-token-usage.py ... --substitute-data <report-path>` during Phase 7"
             )
-            continue
-        positions.append(content.index(heading))
-    if len(positions) == len(_V2_AI_HANDOFF_HEADINGS) and positions != sorted(
-        positions
-    ):
-        failures.append(
-            "schema-v2 AI handoff markdown heading order does not match "
-            "templates/reports/final-report-v2.template.md."
-        )
-    for match in _V2_HUMAN_ONLY_RENDERED_RE.finditer(content):
-        field = match.group("heading") or match.group("label")
-        failures.append(
-            "schema-v2 AI handoff markdown contains human-only field "
-            f"{field!r}; render it only in the task-specific HTML."
-        )
-    if READING_CONFIRMATION_HEADING_RE.search(content) is not None:
-        failures.append(
-            "final report contains a `## 0. Reading Confirmation` heading — "
-            "Reading Confirmation lives in the worker audit sidecar, never "
-            "in the AI handoff markdown."
-        )
+
 
 # Top-of-report Index block. The renderer
 # (scripts/okstra_ctl/render_final_report.py) injects `<a id="report-index">`
@@ -1782,16 +1807,34 @@ def _load_conformance_results(qa_dir: Path, manifest: dict) -> dict:
     return results
 
 
-_DIFF_SUMMARY_RE = re.compile(r"^###\s+5\.7\.3\b.*?(?=^###\s|\Z)", re.MULTILINE | re.DOTALL)
-_DIFF_ROW_PATH_RE = re.compile(r"^\|\s*`([^`]+)`\s*\|", re.MULTILINE)
+def _diff_summary_files(report_data: Mapping[str, Any]) -> list[str]:
+    """implementation 리포트가 신고한 변경 파일 목록 (`implementation.diffSummary.files[].file`).
 
+    렌더된 §5.7.3 표를 정규식으로 긁던 자리다. 표는 data.json 의 이 배열에서
+    렌더되는 파생물이라, 표를 읽는 쪽은 렌더 형식이 바뀔 때마다 조용히 빈
+    목록을 돌려주고 — conformance / self-mock 두 게이트가 전부 통과로 열렸다.
+    스키마가 `implementation` 블록에서 `diffSummary` 를 required 로 잡고
+    `rawStat` 이 비어있지 않으면 `files` 최소 1행을 요구하므로, 여기서는
+    구조가 어긋난 경우만 빈 목록으로 떨어뜨린다.
 
-def _parse_diff_summary_files(content: str) -> list[str]:
-    """implementation 리포트 §5.7.3 Diff Summary 표의 첫 셀(백틱 경로)들을 추출."""
-    section = _DIFF_SUMMARY_RE.search(content)
-    if section is None:
+    `diffSummary` 를 가진 task-type 은 implementation 뿐이다. final-verification
+    은 diff 를 `diffSummaryQuote` 문자열로만 인용하므로 두 게이트는 거기서
+    (md 를 읽던 시절과 똑같이) vacuous 하다.
+    """
+    implementation = report_data.get("implementation")
+    if not isinstance(implementation, Mapping):
+        return []
+    diff_summary = implementation.get("diffSummary")
+    if not isinstance(diff_summary, Mapping):
         return []
-    return _DIFF_ROW_PATH_RE.findall(section.group(0))
+    rows = diff_summary.get("files")
+    if not isinstance(rows, list):
+        return []
+    return [
+        row["file"]
+        for row in rows
+        if isinstance(row, Mapping) and isinstance(row.get("file"), str) and row["file"]
+    ]
 
 
 _STAGE_RUN_DIR_RE = re.compile(r"^stage-\d+$")
@@ -2155,12 +2198,12 @@ def _validate_planning_conformance_declared(report_path: Path, failures: list[st
 
 
 def _validate_conformance_surfaces(
-    report_path: Path,
+    report_data: Mapping[str, Any],
     scoped_manifest: dict,
     surface_patterns: object,
     failures: list[str],
 ) -> None:
-    changed_files = _parse_diff_summary_files(report_path.read_text(encoding="utf-8"))
+    changed_files = _diff_summary_files(report_data)
     if not changed_files:
         return
     uncovered = (
@@ -2196,6 +2239,7 @@ def _validate_conformance(
     own stage suffix. Whole-task runs evaluate every entry.
     """
     warnings: list[str] = []
+    report_data = _load_final_report_data(report_path)
     # conformance 산출물은 task-level(<task_root>/qa)에 있어 planning/
     # implementation/final-verification 가 공유한다. report_path 는
     # task_root/runs/<task-type>/reports/final-report.md (implementation 은
@@ -2236,7 +2280,7 @@ def _validate_conformance(
                     f"{manifest_path} is absent"
                 )
         _validate_conformance_surfaces(
-            report_path,
+            report_data,
             empty_scoped_manifest,
             surface_patterns,
             failures,
@@ -2300,7 +2344,7 @@ def _validate_conformance(
                 f"docs/superpowers/specs/2026-06-07-stage-conformance-qa-design.md."
             )
     _validate_conformance_surfaces(
-        report_path,
+        report_data,
         scoped,
         surface_patterns,
         failures,
@@ -2638,13 +2682,13 @@ def _validate_selfmock(report_path: Path, failures: list[str]) -> None:
     Stage-isolated runs read their own `self-mock-stage-<N>.json`; whole-task runs
     read the flat `self-mock.json`.
 
-    Only the implementation template renders the §5.7.3 diff summary
-    (`templates/reports/final-report-v2.template.md:589`); a final-verification report
-    quotes the diff as a blockquote instead, so this gate is vacuous there by
-    design — self-mock is enforced at the implementation stage, and
-    final-verification is a read-only re-verify that adds no test files.
+    Only an implementation report carries `implementation.diffSummary.files[]`;
+    a final-verification report records the diff as the `diffSummaryQuote`
+    string instead, so this gate is vacuous there by design — self-mock is
+    enforced at the implementation stage, and final-verification is a read-only
+    re-verify that adds no test files.
     """
-    changed = _parse_diff_summary_files(report_path.read_text(encoding="utf-8"))
+    changed = _diff_summary_files(_load_final_report_data(report_path))
     test_files = [
         path
         for path in changed
@@ -2745,8 +2789,8 @@ def _check_selfmock_changed_files(
     `--changed-file` is what the mutation adapters select their production
     sources from. Omit it and every adapter gets an empty target set, which is
     not a finding but reads like one had been looked for. Requiring the sidecar
-    to account for every file in the §5.7.3 diff summary keeps "gate B saw this
-    stage" apart from "gate B was handed nothing".
+    to account for every file in `implementation.diffSummary.files[]` keeps
+    "gate B saw this stage" apart from "gate B was handed nothing".
 
     Coverage is asked of the WHOLE diff, not just its test files: the production
     sources are precisely the part gate A never looks at.
@@ -2771,7 +2815,8 @@ def _check_selfmock_changed_files(
             f"the mutation gate — {sidecar} records changedFiles={declared}. Each "
             "adapter picks its production sources out of that set, so a file left "
             "out is a file no mutant was ever generated for. Pass every path from "
-            "the §5.7.3 diff summary with `--changed-file`, production sources "
+            "the report's `implementation.diffSummary.files[]` with `--changed-file`, "
+            "production sources "
             "included — filtering to the test files leaves gate B nothing to run "
             "on and reports a pass it never earned."
         )
@@ -2835,6 +2880,10 @@ def validate_report(
         failures.append(f"final report is missing: {report_path}")
         return
 
+    if (report_data or {}).get("schemaVersion") == "2.0":
+        _validate_v2_report(report_data or {}, required_agent_status_entries, failures)
+        return
+
     content = report_path.read_text()
     for label in required_agent_status_entries:
         if label not in content:
@@ -2849,10 +2898,6 @@ def validate_report(
                 "run `okstra-token-usage.py ... --substitute-data <report-path>` during Phase 7"
             )
 
-    if (report_data or {}).get("schemaVersion") == "2.0":
-        _validate_v2_ai_handoff(content, failures)
-        return
-
     # Catch the "workers typed `0` / `pending` instead of the placeholder"
     # failure mode that bypasses the placeholder check above.
     _scan_token_usage_summary(
@@ -3454,6 +3499,7 @@ def validate_final_report_data(
         )
     elif task_type == "implementation":
         _validate_stage_carry_sidecar_exists(data, report_path, failures)
+    _validate_lead_authored_report(data, report_path, failures)
     if task_type == "error-analysis":
         _validate_error_analysis_consistency(data, failures)
     elif task_type == "final-verification":
@@ -6324,6 +6370,138 @@ def _validate_verifier_fail_blocks_verdict(data: dict, failures: list[str]) -> N
         )
 
 
+
+_LEAD_AUTHORED = "Okstra lead"
+_REPORT_AUTHORING_HEADING_RE = re.compile(r"^## REPORT AUTHORING\s*$", re.MULTILINE)
+_REPORT_AUTHORING_APPROVED = "approved"
+# `report-writer.md` "Lead-authored fallback": the attempt must have reached one
+# of these with a concrete reason. `completed` means the worker produced the
+# report, so the lead had nothing to fall back from.
+_DISPATCH_FAILURE_STATUSES = {"error", "timeout", "not-run"}
+
+
+def _report_authoring_approval(report_path: Path) -> str:
+    """The user's recorded answer on letting the lead author this report.
+
+    Read from the run's `user-responses/` sidecars, the same channel the
+    clarification and plan-decision answers already use. The file is written by
+    the user through `okstra user-response write`, which is the point: an
+    approval the lead could author itself would be the self-report this gate
+    exists to remove.
+    """
+    sidecar_dir = report_path.parent.parent / "user-responses"
+    if not sidecar_dir.is_dir():
+        return ""
+    for sidecar in sorted(sidecar_dir.glob("*.md")):
+        try:
+            text = sidecar.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        match = _REPORT_AUTHORING_HEADING_RE.search(text)
+        if not match:
+            continue
+        block = text[match.end():]
+        next_heading = re.search(r"^## ", block, re.MULTILINE)
+        if next_heading:
+            block = block[: next_heading.start()]
+        status = re.search(r"^-\s*Status:\s*(.+?)\s*$", block, re.MULTILINE)
+        if status:
+            return status.group(1).strip()
+    return ""
+
+
+def _validate_lead_authored_report(
+    data: dict,
+    report_path: Path,
+    failures: list[str],
+) -> None:
+    """A lead-authored final report needs a failed dispatch AND a user approval.
+
+    `header.reportAuthor` renders in the report but nothing read it, so a lead
+    could name itself the author with no dispatch behind it. The contract has
+    always required a real attempt that recorded a terminal failure with a
+    reason; this adds the second door, because a lead that dispatches once,
+    lets it fail, and proceeds has still decided alone. Neither door retires
+    the other: an approval does not excuse a missing attempt, and an attempt
+    that failed is the cue to ask, not the permission.
+
+    The record is not consumed by passing. The failure reason and the approval
+    both stay on disk, and `header.reportAuthor` stays `Okstra lead` in the
+    rendered report, so a later reader sees that this run took the fallback and
+    why.
+    """
+    header = data.get("header")
+    if not isinstance(header, Mapping):
+        return
+    if str(header.get("reportAuthor") or "").strip() != _LEAD_AUTHORED:
+        return
+    # release-handoff has no worker roster at all: it is single-lead by design,
+    # so there is no dispatch to fail and nothing for the user to permit.
+    if str(header.get("taskType") or "").strip() == "release-handoff":
+        return
+
+    team_state = data.get("teamState")
+    dispatches = (
+        team_state.get("workerDispatches") if isinstance(team_state, Mapping) else None
+    )
+    attempts = [
+        row
+        for row in (dispatches if isinstance(dispatches, list) else [])
+        if isinstance(row, Mapping)
+        and str(row.get("workerId") or "").strip() == "report-writer"
+    ]
+    failed = [
+        row
+        for row in attempts
+        if str(row.get("status") or "").strip() in _DISPATCH_FAILURE_STATUSES
+    ]
+    if not failed:
+        failures.append(
+            "final-report data.json: `header.reportAuthor` is `Okstra lead` but "
+            "no report-writer dispatch recorded a terminal failure "
+            f"({', '.join(sorted(_DISPATCH_FAILURE_STATUSES))}) in team-state. "
+            "The lead-authored fallback is reachable only from an attempt that "
+            "actually failed (prompts/lead/report-writer.md "
+            "'Lead-authored fallback')"
+        )
+    elif not any(str(row.get("reason") or "").strip() for row in failed):
+        failures.append(
+            "final-report data.json: the report-writer dispatch failed but "
+            "recorded no reason, so the lead-authored fallback rests on an "
+            "unexplained failure. Record the tool error, the timeout, or the "
+            "external blocker on the dispatch row"
+        )
+
+    fallback = header.get("leadAuthoredFallback")
+    if not isinstance(fallback, Mapping):
+        failures.append(
+            "final-report data.json: `header.reportAuthor` is `Okstra lead` but "
+            "`header.leadAuthoredFallback` is absent. The approval passes the "
+            "gate; it does not erase it — the failure reason and the approving "
+            "sidecar belong in the report a human reads, not only in the "
+            "sidecars they would have to go find"
+        )
+    else:
+        recorded = str(fallback.get("dispatchFailureReason") or "").strip()
+        reasons = {str(row.get("reason") or "").strip() for row in failed}
+        if recorded and reasons and recorded not in reasons:
+            failures.append(
+                "final-report data.json: "
+                "`header.leadAuthoredFallback.dispatchFailureReason` does not "
+                "match any reason recorded on a failed report-writer dispatch. "
+                "Quote the dispatch row verbatim rather than restating it"
+            )
+
+    approval = _report_authoring_approval(report_path)
+    if approval != _REPORT_AUTHORING_APPROVED:
+        found = f"`{approval}`" if approval else "no `## REPORT AUTHORING` block"
+        failures.append(
+            "final-report data.json: `header.reportAuthor` is `Okstra lead` but "
+            f"the run's `user-responses/` sidecars carry {found}. Only the user "
+            "may permit the lead to author the report; ask at a gate and have "
+            "the answer written through `okstra user-response write`"
+        )
+
 def _validate_stage_carry_sidecar_exists(
     data: dict,
     report_path: Path,

package/runtime/validators/validate_session_conformance.py

@@ -1034,7 +1034,7 @@ def _check_batch_cleanup_checkpoints(
     실제로 일어났는지 (prompts/profiles/_common-contract.md 'Phase-start cleanup').
     R1=convergence round 1 직전, R2=report-writer dispatch 직전(수렴이 있었으면
     마지막 라운드 이후 별도 1회). ISO-8601 ts 는 lexicographic 비교가 곧 시간순."""
-    detail = "prompts/profiles/_common-contract.md 'Phase-start cleanup'"
+    detail = "prompts/lead/okstra-lead-contract.md 'Run-scoped worker-resource lifecycle'"
     cleanup_ts = sorted(ts for ts, _line in by_phase.get("phase-batch-cleanup", []))
     conv_ts = sorted(ts for ts, _line in by_phase.get("phase-5.5-convergence", []))
     synth_ts = sorted(ts for ts, _line in by_phase.get("phase-6-synthesis", []))