okstra 0.179.0 → 0.179.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.179.0",
+  "version": "0.179.1",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.179.0",
-  "builtAt": "2026-08-20T05:34:55.598Z",
+  "package": "0.179.1",
+  "builtAt": "2026-08-20T08:40:17.534Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/convergence.md

@@ -687,7 +687,7 @@ say so explicitly for that half; silence on one half is an incomplete result.
 ```
 
 ### Gap verification (1 adversarial reverify round)
-Each critic gap enters the verification queue as a finding with `originWorker = "<provider>-critic"` and `source = "critic"`. The lead runs ONE adversarial reverify round (§"Adversarial Verification Mode" classifier) with the Phase 4 analysers (excluding the critic itself) as voters. Only gaps classified `full-consensus` / `partial-consensus` merge into the final report findings; `contested` / `worker-unique` gaps are treated as hallucinations and dropped (recorded in the convergence state, not promoted).
+Each critic gap enters the verification queue as a finding with `originWorker = "<provider>-critic"` and `source = "critic"`. The lead runs ONE adversarial reverify round (§"Adversarial Verification Mode" classifier) with the Phase 4 analysers as voters, **excluding every analyser whose provider is the critic's provider** — the exclusion matches on the provider name (`codex`, `codex-worker`), not on the critic's worker id, so picking a critic provider that is already in the analyser roster removes that analyser from the vote and shrinks the quorum by one. `okstra apply-critic-gaps` refuses a vote from an excluded worker (`critic voter must be a non-critic analyser`), so dispatching one spends a worker whose verdict cannot be counted. Only gaps classified `full-consensus` / `partial-consensus` merge into the final report findings; `contested` / `worker-unique` gaps are treated as hallucinations and dropped (recorded in the convergence state, not promoted).
 
 **A gap that received no verdict is NOT a rejected gap (BLOCKING).** Dropping applies only to gaps the voters actually judged. A gap can also end the round *unjudged* — the verification dispatch returned a terminal non-result (`timeout`, `error`, no result file), the returned result covered only some of the gaps, or no non-critic analyser was available to vote at all. Nobody inspected those, so classifying them as hallucinations is a fabricated verdict. Each one MUST be recorded as a `## 5. Missing Information and Risks` row (`missingInformation`, `source: "critic-unverified"`) whose `risk` names the gap and the reason verification did not complete, and counted in `config.critic.gapsUnverified`. They are **not** promoted to findings (unverified) and **not** raised as `clarification` items — an unverified gap needs an analyser to verify it on the next run, not a decision from the user. Silently losing them is a contract violation: the batch that times out is exactly the batch of gaps too expensive to check, so the highest-risk items are the ones that vanish.
 
@@ -738,7 +738,7 @@ so explicitly.
 
 ### Verification — confirm-or-downgrade (BLOCKING)
 
-Each candidate blocker is verified by the Phase 4 analysers (excluding the critic). Do NOT use the adversarial finding classifier's "uncertain → reject" rule here.
+Each candidate blocker is verified by the Phase 4 analysers, excluding every analyser whose provider is the critic's provider (same rule as §"critic gaps" above). Do NOT use the adversarial finding classifier's "uncertain → reject" rule here.
 - Do NOT run `apply-critic-gaps` for this mode. That reducer implements coverage merge/drop semantics and rejects `acceptance-devils-advocate` input.
 - **Confirmed** (an analyser reproduces it or cites supporting evidence) → promote to a `## 5.8 Acceptance Blockers` row (keep severity + recommended follow-up phase).
 - **Not confirmed** (cannot reproduce, or evidence is weak) → **downgrade to a Residual Risk row — never drop it.** Record the escalation trigger so the user can re-judge a high-severity-but-unconfirmed candidate.

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -230,7 +230,7 @@ After context-loader completes, read **only the compact intake files below** in
 
 The `implementation` profile's thin core (`prompts/profiles/implementation.md`) is intentionally minimal so the Phase 1 baseline stays small. Three sidecar files carry the bulk of the rules and MUST be read at the listed phase — do NOT pre-load them at Phase 1. The sidecar list and each one's `Read at` phase live in that profile's "Lazy section pointers" table, which arrives in the Phase 1 intake via `analysis-profile.md`, so it is already in context whenever this discipline applies.
 
-**Entry guard (BLOCKING).** Before transitioning into Phase 5 or Phase 6 for an `implementation` run, lead MUST emit a single Read tool call for the sidecar(s) whose `Read at` (per that table) matches the entering phase. If lead enters the phase without that Read recorded in the selected adapter's conformance evidence/event source, phase entry is refused — lead writes a `contract-violation` to the run-level errors log with `--message "implementation-sidecar-not-loaded"` and stops. Re-entry requires the sidecar Read first. **Enforcement:** the Phase 7 validator (`validate_session_conformance.py`) verifies post-hoc that all three sidecar Reads exist in the selected adapter's declared source within this run's window, and that they precede the `phase-6-synthesis` / `phase-7-persist` checkpoints respectively.
+**Entry guard (BLOCKING).** Before transitioning into Phase 5 or Phase 6 for an `implementation` run, lead MUST load the sidecar(s) whose `Read at` (per that table) matches the entering phase — either a single `Read` tool call, or a shell command naming that file (`cat`, `sed -n`), since some hosts steer file reads to the shell. If lead enters the phase without that load recorded in the selected adapter's conformance evidence/event source, phase entry is refused — lead writes a `contract-violation` to the run-level errors log with `--message "implementation-sidecar-not-loaded"` and stops. Re-entry requires the sidecar Read first. **Enforcement:** the Phase 7 validator (`validate_session_conformance.py`) verifies post-hoc that all three sidecar loads exist in the selected adapter's declared source within this run's window, and that they precede the `phase-6-synthesis` / `phase-7-persist` checkpoints respectively.
 
 The guard is not satisfied by memory from a prior run — each implementation run re-reads the sidecar fresh, since `okstra install` may have updated it between runs.
 

package/runtime/prompts/wizard/prompts.ko.json

@@ -623,6 +623,7 @@
     "static_role": "  static-role   : {role}#{ordinal} / {model}",
     "dynamic_role": "  dynamic-role  : {role} / reuse selected participant model",
     "workers_implementation_default": "  workers       : (프로필 기본 — executor + verifier 2 + report-writer)",
+    "critic_shares_analyser_provider": "                  ⚠ critic provider 가 분석 워커 `{worker}` 와 같습니다 — gap 검증에서 그 워커는 투표할 수 없어 유효 투표자가 {remaining}명으로 줍니다",
     "base_ref_stage_isolated": "  base-ref      : (stage 격리 — 의존 stage 기준으로 run 준비 시점에 자동 해소)",
     "base_ref_reuse_task_dir": "  base-ref      : (기존 `{task_key}` 디렉터리 재사용 — 최초 base 유지)",
     "worktree_new": "  worktree      : 새 브랜치 `{branch}` (base-ref `{base_ref}`) → `{path}`",

package/runtime/python/okstra_ctl/agent_prompt_cli.py

@@ -97,7 +97,11 @@ def _parser() -> argparse.ArgumentParser:
         action="store_true",
         help="rewrite a prompt this invocation id already wrote, allowed only "
              "while no dispatch has referenced it — the exit for a prompt that "
-             "failed a pre-dispatch gate and never ran",
+             "failed a pre-dispatch gate and never ran. Not available for v2 "
+             "reverify prompts (--assignment-ref reverify/…): their reservation "
+             "records the prompt's input digest in the run manifest and "
+             "reservations are append-only, so a rewrite needs a fresh "
+             "invocation id and prompt path",
     )
     materialize.add_argument("--json", action="store_true")
 
@@ -426,6 +430,7 @@ def _materialize_run(
             args=args,
             manifest=manifest,
             manifest_path=manifest_path,
+            active_context=active_context,
             source_role_execution_ref=dynamic_source,
             artifact_paths=_dynamic_verifier_artifact_paths(
                 project_root,
@@ -440,12 +445,23 @@ def _materialize_run(
     return prepare_agent_invocation(request)
 
 
+def _run_worktree(
+    manifest: Mapping[str, Any], active_context: Mapping[str, Any]
+) -> Path | None:
+    """이 런의 워커 루트. 디스패치가 job 에 싣는 값과 같은 seam 에서 읽는다."""
+    from .dispatch_state import worktree_path
+
+    value = worktree_path(manifest, active_context)
+    return Path(value) if value else None
+
+
 def _reserve_dynamic_verifier_request(
     request: AgentInvocationRequest,
     *,
     args: argparse.Namespace,
     manifest: Mapping[str, Any],
     manifest_path: Path,
+    active_context: Mapping[str, Any],
     source_role_execution_ref: str,
     artifact_paths: tuple[Path, ...],
 ) -> AgentInvocationRequest:
@@ -464,6 +480,7 @@ def _reserve_dynamic_verifier_request(
         input_digest="sha256:" + hashlib.sha256(prompt_bytes).hexdigest(),
         invocation_ref=args.invocation_id,
         artifact_paths=artifact_paths,
+        worktree=_run_worktree(manifest, active_context),
     )
     bound = replace(
         request,
@@ -520,8 +537,10 @@ def _dynamic_verifier_source(
     if is_v2 and is_reverify:
         if args.replace_undispatched:
             raise AgentPromptCliError(
-                "v2 dynamic verifier prompts are append-only; use a fresh "
-                "invocation ID and prompt path"
+                "v2 dynamic verifier prompts are append-only: this "
+                "invocation's reservation already recorded this prompt's input "
+                "digest in the run manifest, and a reservation cannot be "
+                "rewritten. Use a fresh invocation ID and prompt path."
             )
         if not source:
             raise AgentPromptCliError(

package/runtime/python/okstra_ctl/convergence_store.py

@@ -87,8 +87,19 @@ def reserve_dynamic_verifier(
     input_digest: str,
     invocation_ref: str | None = None,
     artifact_paths: tuple[Path, ...],
+    worktree: Path | None = None,
 ) -> tuple[RoleExecution, Invocation]:
-    """Reserve one provider-neutral verifier identity for a logical round."""
+    """Reserve one provider-neutral verifier identity for a logical round.
+
+    `worktree` 는 이 런의 워커가 실제로 서는 루트다. 디스패치가 정책을 다시
+    계산할 때 쓰는 값(`dispatch_core._canonical_write_contract` 이 job 의
+    worktree 를 넘긴다)과 같아야 한다. 여기서 None 으로 고정하면 예약된 정책의
+    `sourcePolicy.allowedRoot` 는 프로젝트 루트, 디스패치가 계산한 정책은 스테이지
+    워크트리가 되어 writePolicyDigest 가 갈리고, 같은 invocationRef 가
+    `invocationRef drift` 로 거부된다 — 워크트리를 쓰는 런(implementation stage)
+    에서만 나타나고 워크트리가 없는 런(implementation-planning)에서는 안 나타나
+    버전 문제로 보이기 쉽다.
+    """
     if round_number < 1:
         raise ExecutionManifestError("dynamic verifier round must be positive")
     manifest_path = Path(manifest_path).resolve()
@@ -128,7 +139,7 @@ def reserve_dynamic_verifier(
             policy, enforcement = build_invocation_write_contract(
                 role="verifier",
                 project_root=project_root,
-                worktree=None,
+                worktree=worktree,
                 artifact_paths=artifact_paths,
                 maximum_precision=capability.max_boundary_precision,
                 auxiliary_roots=verifier_extra_dirs("verifier"),

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -359,7 +359,9 @@ def build_dispatch_plan(
         default_provider_by_worker_id=dict(default_provider_by_worker_id or {}),
     )
     if jobs_file:
-        jobs = _jobs_from_file(project_root, workspace_root, jobs_file, manifest, options)
+        jobs = _jobs_from_file(
+            project_root, workspace_root, jobs_file, manifest, active_context, options
+        )
     else:
         jobs = _jobs_from_roster(
             project_root,
@@ -416,7 +418,10 @@ def dispatch_plan(plan: DispatchPlan, *, wait: bool = True) -> int:
         return 0
     round_artifact_paths = _round_artifact_paths(plan)
     handles = [
-        _spawn_job(plan, job, 1, batch_artifact_paths=round_artifact_paths)
+        _spawn_job(
+            plan, job, _next_attempt(plan, job),
+            batch_artifact_paths=round_artifact_paths,
+        )
         for job in plan.jobs
     ]
     _record_dispatch_facts(plan.team_state_path, _mode_from_handles(handles))
@@ -1292,6 +1297,7 @@ def _jobs_from_file(
     workspace_root: Path,
     jobs_file: Path | None,
     manifest: Mapping[str, Any],
+    active_context: Mapping[str, Any],
     options: _BuildOptions,
 ) -> list[WorkerJob]:
     if jobs_file is None:
@@ -1300,6 +1306,7 @@ def _jobs_from_file(
         project_root,
         jobs_file,
         manifest=manifest,
+        active_context=active_context,
         backend=options.default_backend,
         idle_timeout_seconds=options.idle_timeout_seconds,
         default_dispatch_kind=options.dispatch_kind,
@@ -1390,6 +1397,34 @@ def _spawn_cli_job_nonblocking(
     )
 
 
+def _next_attempt(plan: DispatchPlan, job: WorkerJob) -> int:
+    """이 invocation 이 다음에 청구할 attempt 번호.
+
+    attempt 를 1 로 고정하면 같은 워커를 두 번째로 디스패치할 수 없다. 원장은
+    단조 증가를 요구하므로(`execution_manifest._validate_next_attempt`) 두 번째
+    호출이 항상 `next attempt must be 2` 로 거부되고, 재시도 예산이 계약에는
+    있는데 그 경로에는 쓸 수단이 없는 상태가 된다. 예산은 프로세스가 아니라
+    invocation 에 붙어 있고, 그 잔액이 적힌 곳은 원장뿐이다.
+    """
+    if not job.has_execution_identity:
+        return job.attempt
+    manifest = read_execution_manifest(plan.manifest_path)
+    prior = [
+        row.attempt for row in manifest.attempts
+        if row.invocation_ref == job.invocation_ref
+    ]
+    if not prior:
+        return job.attempt
+    spent = max(prior)
+    if spent >= MAX_WORKER_ATTEMPTS:
+        raise DispatchError(
+            f"worker retry budget is spent: {job.invocation_ref} used "
+            f"{spent} of {MAX_WORKER_ATTEMPTS} attempts. Materialize a new "
+            "invocation to dispatch this worker again."
+        )
+    return spent + 1
+
+
 def _prepare_job_attempt(
     plan: DispatchPlan, job: WorkerJob, attempt: int
 ) -> WorkerJob:
@@ -1622,7 +1657,7 @@ def _dispatch_round(dispatch_kind: str) -> int:
 
 
 def _dispatch_job_with_retry(plan: DispatchPlan, job: WorkerJob) -> int:
-    for attempt in range(1, MAX_WORKER_ATTEMPTS + 1):
+    for attempt in range(_next_attempt(plan, job), MAX_WORKER_ATTEMPTS + 1):
         handle = _spawn_job(plan, job, attempt)
         if handle.completed_process is None:
             return await_dispatches(plan, timeout_seconds=None)

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -1763,6 +1763,7 @@ def worker_jobs_from_file(
     jobs_file: Path,
     *,
     manifest: Mapping[str, Any],
+    active_context: Mapping[str, Any] | None = None,
     backend: str,
     idle_timeout_seconds: int,
     default_dispatch_kind: str,
@@ -1782,6 +1783,7 @@ def worker_jobs_from_file(
             project_root,
             item,
             manifest=manifest,
+            active_context=active_context,
             backend=backend,
             idle_timeout_seconds=idle_timeout_seconds,
             dispatch_kind=dispatch_kind,
@@ -1800,6 +1802,7 @@ def _worker_job_from_file(
     item: Mapping[str, Any],
     *,
     manifest: Mapping[str, Any],
+    active_context: Mapping[str, Any] | None = None,
     backend: str,
     idle_timeout_seconds: int,
     dispatch_kind: str,
@@ -1850,7 +1853,17 @@ def _worker_job_from_file(
         result_path=result_path,
         worker_result_path=worker_result_path,
         completion_paths=completion_paths,
-        worktree_path=string_value(item.get("worktreePath")),
+        # 파일이 적지 않았으면 run authority 에서 해소한다. 로스터 경로는
+        # 언제나 그렇게 하고(`dispatch_core._jobs_from_roster`), 예약 쪽
+        # (`agent_prompt_cli._run_worktree`)도 같은 seam 을 읽는다. 이 자리만
+        # 손으로 적은 값을 유일한 출처로 삼던 동안, 같은 run 이 어떤 경로로
+        # 디스패치됐는지에 따라 워커의 소스 루트가 달라졌다 — 그 값은
+        # writePolicy 의 `sourcePolicy.allowedRoot` 이므로, 예약본과 갈리면
+        # 같은 invocationRef 가 `invocationRef drift` 로 거부된다.
+        worktree_path=(
+            string_value(item.get("worktreePath"))
+            or worktree_path(manifest, active_context or {})
+        ),
         role=require_string(item, "role"),
         idle_timeout_seconds=idle_timeout_seconds,
         dispatch_kind=dispatch_kind,

package/runtime/python/okstra_ctl/execution_manifest.py

@@ -118,6 +118,22 @@ def append_role_execution(
             )
 
 
+def _drift_detail(existing: Invocation, incoming: Invocation) -> str:
+    """어긋난 필드를 이름으로 돌려준다.
+
+    `invocationRef drift: <ref>` 만으로는 무엇이 달라졌는지 알 수 없어, 리드가
+    새 invocation id 를 몇 개씩 만들어 보는 것 말고 할 수 있는 일이 없었다.
+    같은 ref 로 두 번째 예약이 오는 것 자체는 정상 경로(재materialize)이고,
+    거절해야 하는 것은 '내용이 달라진' 경우뿐이므로 그 내용을 이름 붙인다.
+    """
+    before = existing.to_payload()
+    after = incoming.to_payload()
+    changed = sorted(
+        key for key in (*before, *after) if before.get(key) != after.get(key)
+    )
+    return ", ".join(changed) if changed else "(no field differs)"
+
+
 def reserve_derived_role_invocation(
     path: Path,
     *,
@@ -169,7 +185,8 @@ def reserve_derived_role_invocation(
         if existing_invocation is not None:
             if existing_invocation != invocation:
                 raise ExecutionManifestError(
-                    f"invocationRef drift: {invocation.invocation_ref}"
+                    f"invocationRef drift: {invocation.invocation_ref} "
+                    f"(differs in: {_drift_detail(existing_invocation, invocation)})"
                 )
             if created:
                 raise ExecutionManifestError(
@@ -242,7 +259,8 @@ def ensure_invocation(path: Path, row: Invocation, *, task_key: str) -> Invocati
         if existing is not None:
             if existing != row:
                 raise ExecutionManifestError(
-                    f"invocationRef drift: {row.invocation_ref}"
+                    f"invocationRef drift: {row.invocation_ref} "
+                    f"(differs in: {_drift_detail(existing, row)})"
                 )
             return existing
         _validate_next_invocation(manifest, row)
@@ -289,7 +307,8 @@ def record_invocation_attempt(
         )
         if existing is not None and existing != invocation:
             raise ExecutionManifestError(
-                f"invocationRef drift: {invocation.invocation_ref}"
+                f"invocationRef drift: {invocation.invocation_ref} "
+                f"(differs in: {_drift_detail(existing, invocation)})"
             )
         invocations = manifest.invocations
         if existing is None:

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -528,6 +528,32 @@ def _stable_git_projection(snapshot: MutationSnapshot) -> dict[str, Any]:
     }
 
 
+def _path_ledger_is_unenforceable(policy: WritePolicy) -> bool:
+    """이 정책의 경로 장부를 근거로 변경을 거절할 수 있는가.
+
+    승인된 계획서에 `plannedPaths` 컬럼이 있으면 실행기는 그 목록에 묶이고,
+    목록은 반드시 비어 있지 않다(`write_policy._planned_paths_from_report` 는
+    선언된 경우에만 항목을 싣는다). 그 컬럼이 없는 옛 계획서에서는 실을 값이
+    없어 장부가 빈 채로 온다 — 종전에는 산문에서 유도한 문장 조각(`28 rows)`,
+    `captured in Stage 1)`)을 실었고, 그래서 계획이 지시한 파일 전부가 미허가
+    변경으로 읽혔다.
+
+    `project-mutation` 정책에서만 빈 장부가 "물을 수 없음" 을 뜻한다.
+    `source-readonly` 워커는 장부가 원래 비어 있고 그것이 "아무것도 바꾸지
+    말라" 는 뜻이므로, 그쪽 집행은 건드리지 않는다.
+
+    이 판정은 감사의 두 절반이 같은 함수를 읽는다. 종전에는 git 쪽만
+    `plannedPathsDeclared` 를 봤는데 그 키는 `build_write_policy` 가 만드는
+    sourcePolicy 에 아예 실리지 않아(4개 키 고정, `validate_write_policy_payload`
+    가 그 집합을 강제) 어느 쪽에서도 참이 된 적이 없다.
+    """
+    source = policy.source_policy
+    return (
+        source.get("mode") == "project-mutation"
+        and not source.get("plannedPaths")
+    )
+
+
 def _source_policy_failures(
     policy: WritePolicy,
     changed: set[str],
@@ -537,7 +563,10 @@ def _source_policy_failures(
     declared = set(out_of_plan_edits)
     protected = set(policy.source_policy.get("protectedPaths", ()))
     failures: list[str] = []
-    if not changed <= planned | declared:
+    if (
+        not _path_ledger_is_unenforceable(policy)
+        and not changed <= planned | declared
+    ):
         failures.append("source changes exceed planned and declared out-of-plan paths")
     if not declared <= changed:
         failures.append("declared out-of-plan path did not change")
@@ -571,10 +600,10 @@ def _git_policy_failures(
     if not _is_ancestor(root, str(git.get("expectedBaseCommit")), str(after.git_projection.get("head"))):
         failures.append("final HEAD is not a fast-forward descendant")
     allowed = set(policy.source_policy.get("plannedPaths", ())) | set(out_of_plan_edits)
-    if policy.source_policy.get("plannedPathsDeclared") is False:
-        # The plan predates the declared path column, so `allowed` was derived
-        # from prose and is not a ledger anyone can be held to. Every other
-        # check above still applies; only the path comparison stands down.
+    if _path_ledger_is_unenforceable(policy):
+        # The plan predates the declared path column, so there is no ledger
+        # anyone can be held to. Every other check above still applies; only
+        # the path comparison stands down.
         return failures
     if any(
         not paths <= allowed

package/runtime/python/okstra_ctl/paths.py

@@ -377,16 +377,22 @@ def container_paths(project_root: Path, task_group: str, task_id: str) -> dict:
 
 
 def next_run_seq(run_seq_dir: Path, task_type_segment: str) -> int:
-    """run_seq_dir 안에서 `*-<task-type>-NNN.<ext>` 파일을 스캔해 다음 seq 번호를
+    """run_seq_dir 안에서 `*-<task-type>-NNN[.<ext>]` 항목을 스캔해 다음 seq 번호를
     돌려준다. 디렉터리 부재 시 1.
+
+    파일과 디렉터리를 함께 센다. 이 카운터가 배정하는 자리 중 하나는
+    `prompts/duty-contracts-<task-type>-NNN/` 이라는 **디렉터리**다(확장자도 없다).
+    파일만 세면 중단된 prepare 가 남긴 그 디렉터리가 카운터에 안 잡히고, 다음 런이
+    같은 seq 를 배정받아 남은 스냅샷 위에 착지한다. digest 가 다르면
+    `run._snapshot_duty_catalog` 이 매번 같은 자리에서 PrepareError 를 내므로,
+    잔재를 손으로 치우기 전까지 그 task 의 prepare 가 영구히 막힌다.
     """
-    pattern = re.compile(rf"-{re.escape(task_type_segment)}-(\d{{3,}})\.[^.]+$")
+    pattern = re.compile(
+        rf"-{re.escape(task_type_segment)}-(\d{{3,}})(?:\.[^.]+)?$"
+    )
     max_seq = 0
     if run_seq_dir.is_dir():
         for entry in os.listdir(run_seq_dir):
-            full = run_seq_dir / entry
-            if not full.is_file():
-                continue
             m = pattern.search(entry)
             if m:
                 n = int(m.group(1))

package/runtime/python/okstra_ctl/run.py

@@ -3102,6 +3102,23 @@ def _write_prior_run_error_digest(ctx: dict, instruction_set: Path) -> None:
         (instruction_set / "prior-run-errors.md").write_text(digest, encoding="utf-8")
 
 
+def _stage_or_clear(path: Path, body: str) -> None:
+    """이 런의 값을 쓰거나, 값이 없으면 이전 런이 남긴 파일을 지운다.
+
+    instruction-set 은 run 단위가 아니라 **task 단위** 디렉터리다
+    (`paths.py`: `task_root / "instruction-set"`). 그래서 값이 있을 때만 쓰고
+    없을 때 아무것도 안 하면, 이전 런의 파일이 그대로 남아 다음 런의 입력이 된다.
+    directive 를 비우고 준비한 런에서 워커들이 예전 directive 를 읽고, 그 내용이
+    현재 기록과 어긋나 반박에 시간을 쓴 사례가 보고됐다. carry-in 답변
+    (`clarification-response.md`)은 같은 형태에 결과가 더 나쁘다 — 남은 파일이
+    analysis packet 에 그대로 실린다.
+    """
+    if body:
+        path.write_text(body, encoding="utf-8")
+        return
+    path.unlink(missing_ok=True)
+
+
 def _write_instruction_set_sources(
     inp: PrepareInputs,
     ctx: dict,
@@ -3178,22 +3195,26 @@ def _write_instruction_set_sources(
         )
     ctx["HOST_ORCHESTRATION_RULES_RELATIVE_PATH"] = host_rules_relative
     if inp.clarification_response_path:
-        (instruction_set / "clarification-response.md").write_text(
-            clarification_response_with_sidecars(Path(inp.clarification_response_path)),
-            encoding="utf-8",
+        clarification_body = clarification_response_with_sidecars(
+            Path(inp.clarification_response_path)
         )
     elif inp.task_type == "implementation" and inp.approved_plan_path:
         # implementation carry-in: the approved plan reaches this run by path
         # (executor re-reads it), so attach ONLY the planning HTML form answers
         # (`runs/implementation-planning/.../user-responses/`) — without these
         # the user's clarification answers never reach the implementation run.
-        plan_responses = attached_user_responses_section(Path(inp.approved_plan_path))
-        if plan_responses:
-            (instruction_set / "clarification-response.md").write_text(
-                plan_responses, encoding="utf-8",
-            )
-    if inp.directive:
-        (instruction_set / "directive.txt").write_text(inp.directive + "\n", encoding="utf-8")
+        clarification_body = attached_user_responses_section(
+            Path(inp.approved_plan_path)
+        )
+    else:
+        clarification_body = ""
+    _stage_or_clear(
+        instruction_set / "clarification-response.md", clarification_body
+    )
+    _stage_or_clear(
+        instruction_set / "directive.txt",
+        inp.directive + "\n" if inp.directive else "",
+    )
     render_reference_expectations(
         str(inp.brief_path), str(instruction_set / "reference-expectations.md"), ctx,
     )

package/runtime/python/okstra_ctl/wizard.py

@@ -5138,6 +5138,39 @@ def _worktree_preview_line_impl(state: WizardState) -> str:
                 stage=stage, path=str(decision.path), branch=decision.branch)
 
 
+def _critic_collision_lines(state: WizardState) -> list[str]:
+    """critic provider 가 분석 로스터와 겹칠 때 그 대가를 확인 화면에서 말한다.
+
+    gap 검증 투표자는 `convergence_engine._is_critic_worker` 가 critic **provider
+    이름**으로 걸러낸다 — critic 워커 id 가 아니라 provider 다. 그래서 같은
+    provider 의 분석 워커가 투표에서 빠지고, 분석 워커가 둘뿐인 로스터에서는
+    정족수가 1로 준다. 그 사실이 선택 시점에는 어디에도 드러나지 않아, critic 도
+    돌고 gap 검증 라운드도 완료된 뒤 `apply-critic-gaps` 가 거부할 때에야 알려졌다
+    — 이미 워커 실행 비용을 쓴 다음이다.
+
+    막지는 않는다. 겹치는 provider 를 고르는 것이 잘못은 아니고, 그 대가를 알고
+    고르는 것과 모르고 고르는 것의 차이만 없앤다.
+    """
+    if not state.critic or state.critic == "off":
+        return []
+    analysers = [
+        worker for worker in _resolved_roster(state) if worker != "report-writer"
+    ]
+    excluded = [
+        worker for worker in analysers
+        if worker in {state.critic, f"{state.critic}-worker"}
+    ]
+    if not excluded:
+        return []
+    return [
+        _msg(
+            state.workspace_root, "confirmation", "critic_shares_analyser_provider",
+            worker=excluded[0],
+            remaining=len(analysers) - len(excluded),
+        )
+    ]
+
+
 def _build_confirm(state: WizardState) -> Prompt:
     t = _p(state.workspace_root, "confirm")
     return Prompt(
@@ -5406,19 +5439,6 @@ STEPS: list[Step] = [
          applies=lambda s: s.base_ref_pending_text,
          build=_build_base_ref_text, submit=_submit_base_ref_text,
          owns=("base_ref", "base_ref_pending_text")),
-    Step(S_SELECTED_DIRECTION_PICK,
-         applies=lambda s: (
-             s.task_type == "implementation-planning"
-             and not s.selected_direction_path
-             and not _planning_rerun_selected(s)
-             and _brief_resolved(s)
-             and _base_ref_ready(s)
-             and not s.base_ref_pending_text
-             and S_SELECTED_DIRECTION_PICK not in s.answered
-         ),
-         build=_build_selected_direction_pick,
-         submit=_submit_selected_direction_pick,
-         owns=("selected_direction_path",)),
     Step(S_APPROVED_PLAN_PICK,
          applies=lambda s: (s.task_type in _STAGE_SCOPED_TASK_TYPES
                             and not s.approved_plan_path
@@ -5635,6 +5655,31 @@ STEPS: list[Step] = [
                             and S_CLARIFICATION not in s.answered),
          build=_build_clarification, submit=_submit_clarification,
          owns=("clarification_response_path", "clarification_pending_text")),
+    # clarification 뒤에 온다. `_planning_rerun_selected` 는 clarification 답을 읽어
+    # "이 런은 기존 계획서의 재실행" 인지 판정하는데, 이 단계가 clarification 앞에
+    # 있던 동안 그 값은 언제나 비어 있었다 — 가드가 참이 될 수 없는 자리에 놓여
+    # 있었다. 그 결과 재실행이어야 할 런이 매번 방향 선택으로 들어갔고,
+    # implementation-option-selection 리포트가 없는 레거시 후보비교 task 는
+    # 거기서 끝났다.
+    Step(S_SELECTED_DIRECTION_PICK,
+         applies=lambda s: (
+             s.task_type == "implementation-planning"
+             and not s.selected_direction_path
+             and not _planning_rerun_selected(s)
+             and _brief_resolved(s)
+             and _base_ref_ready(s)
+             and not s.base_ref_pending_text
+             and S_SELECTED_DIRECTION_PICK not in s.answered
+             # 고를 것이 없으면 묻지 않는다. 물으면 build 가 WizardError 를 내고
+             # `current: null` 로 끝나 재프롬프트조차 불가능해진다 — 사용자가
+             # 되돌릴 수 없는 막다른 길이다. 방향 없이 진행한 런은
+             # `run._validate_planning_entry_inputs` 가 두 입력을 모두 이름 붙여
+             # 거절하므로, 실패는 복구 가능한 자리로 옮겨간다.
+             and bool(_selected_direction_candidates(s))
+         ),
+         build=_build_selected_direction_pick,
+         submit=_submit_selected_direction_pick,
+         owns=("selected_direction_path",)),
     Step(S_PR_TEMPLATE_PICK,
          applies=lambda s: (s.use_defaults is False
                             and s.task_type == "release-handoff"
@@ -6451,6 +6496,7 @@ def confirmation_block(state: WizardState) -> str:
     if (not role_selection
             and state.task_type in ("requirements-discovery", "error-analysis", "implementation-planning", "final-verification")):
         lines.append(f"  critic        : {state.critic or '(off)'}")
+        lines.extend(_critic_collision_lines(state))
     if state.task_type in _STAGE_SCOPED_TASK_TYPES:
         lines.append(f"  approved-plan : {state.approved_plan_path}")
         stage = wizard_stage_confirmation_label(

package/runtime/python/okstra_ctl/write_policy.py

@@ -508,24 +508,27 @@ def _planned_paths_from_report(
     if paths:
         return _relative_paths(tuple(sorted(paths))), True
     # A plan approved before `plannedPaths` existed carries its paths only in
-    # the prose `files` cell. Deriving them there is exactly what this change
-    # removed — it mis-splits globs and parentheticals — so the derived set is
-    # not used to reject anything. It travels with `plannedPathsDeclared:
-    # false`, which turns the path comparison off for that stage rather than
-    # failing every file the plan asked for. An in-flight task keeps running;
-    # the next planning run produces a plan the audit can actually enforce.
-    derived = {
-        part.strip().strip("`")
+    # the prose `files` cell. That prose does not survive being split into
+    # paths — it mis-splits globs and parentheticals — so the ledger stays
+    # EMPTY rather than carrying values nobody can be held to. An empty ledger
+    # on a `project-mutation` policy is what tells the mutation audit to stand
+    # its path comparison down (`execution_mutation_audit`); carrying the
+    # derived fragments instead is what made every file the plan asked for read
+    # as an unauthorized source change. An in-flight task keeps running; the
+    # next planning run produces a plan the audit can actually enforce.
+    #
+    # The prose is still read, for one decision only: telling a pre-column plan
+    # apart from a malformed one whose rows name no files at all.
+    names_files = any(
+        str(step.get("files") or "").strip()
         for step in rows if isinstance(step, Mapping)
-        for part in str(step.get("files") or "").replace("<br>", ",").split(",")
-        if part.strip()
-    }
-    if not derived:
+    )
+    if not names_files:
         raise WritePolicyError(
             "implementer write policy stage has no planned paths: the approved "
             "plan's stepwise rows carry neither `plannedPaths` nor `files`"
         )
-    return _relative_paths(tuple(sorted(derived))), False
+    return (), False
 
 
 def _rooted(project_root: Path, value: str) -> Path:

package/runtime/validators/validate_session_conformance.py

@@ -9,8 +9,9 @@ Design: docs/superpowers/specs/2026-06-10-blocking-contract-posthoc-conformance-
 | 3. implementation entry guard | prompts/lead/okstra-lead-contract.md "Entry guard (BLOCKING)" + prompts/launch.template.md "Host Orchestration Rules" (only when the run staged the rules file) | selected adapter evidence source |
 
 Evidence rules prevent false passes:
-- `claude-jsonl` accepts only assistant text and Read tool-use records, excluding
-  injected skill text and sidechain records.
+- `claude-jsonl` accepts only assistant text and file-read tool-use records (a
+  `Read` call, or a shell command naming the file), excluding injected skill text
+  and sidechain records.
 - Session evidence is scoped to the current run window so a previous run cannot
   satisfy the neutral lead lifecycle contract.
 - Checkpoints emitted after validation begins (`phase-7-teardown`, `complete`)
@@ -143,6 +144,40 @@ _TRACKED_READ_BASENAMES = (
 )
 
 
+# 셸 read 도 증거다. 계약이 요구하는 것은 "이 run 안에서 그 파일의 내용을 실제로
+# 적재했는가" 이고, `cat` / `sed -n` 는 Read 도구와 동일하게 그것을 만족한다.
+# 도구 이름만 인정하면, 호스트가 "가능하면 Bash 로 파일을 읽으라"고 지시하는 모드
+# (Claude Code auto 모드)에서는 계약을 그대로 이행한 lead 가 매번
+# `contract-violated` 로 끝난다 — 두 지시가 정면으로 충돌한다.
+#
+# basename 이 경로 토큰으로 등장할 때만 인정한다. 트리 전체를 훑는 명령
+# (`grep -rn "..." prompts/`)은 그 파일을 지목하지 않았으므로 매칭되지 않고,
+# 파일을 인자로 준 명령은 매칭된다 — 후자는 실제로 그 파일을 읽는다.
+_SHELL_READ_TOOL_NAME = "Bash"
+_SHELL_READ_PATTERNS = {
+    base: re.compile(rf"(?:^|[\s'\"`=(/]){re.escape(base)}(?:$|[\s'\"`);:,])")
+    for base in _TRACKED_READ_BASENAMES
+}
+
+
+def _read_evidence_basenames(block: dict) -> tuple[str, ...]:
+    """tool_use 블록 하나가 증거로 인정되는 tracked basename 들."""
+    name = block.get("name")
+    payload = block.get("input") or {}
+    if name == "Read":
+        base = Path(str(payload.get("file_path") or "")).name
+        return (base,) if base in _TRACKED_READ_BASENAMES else ()
+    if name == _SHELL_READ_TOOL_NAME:
+        command = str(payload.get("command") or "")
+        if not command:
+            return ()
+        return tuple(
+            base for base, pattern in _SHELL_READ_PATTERNS.items()
+            if pattern.search(command)
+        )
+    return ()
+
+
 @dataclass
 class SessionConformanceResult:
     errors: list[str] = field(default_factory=list)
@@ -247,9 +282,8 @@ def _scan_one_jsonl(
                     for m in _PROGRESS_LINE_RE.finditer(block.get("text") or ""):
                         line = f"PROGRESS: {m.group('phase')}{m.group('rest')}".rstrip()
                         progress.append((ts, m.group("phase"), line))
-                elif block.get("type") == "tool_use" and block.get("name") == "Read":
-                    base = Path(str((block.get("input") or {}).get("file_path") or "")).name
-                    if base in _TRACKED_READ_BASENAMES:
+                elif block.get("type") == "tool_use":
+                    for base in _read_evidence_basenames(block):
                         reads.setdefault(base, []).append(ts)
     return progress, reads, agent_name
 
@@ -1326,7 +1360,8 @@ def _check_cmux_adapter_read(
     if evidence.sidecar_reads.get(CMUX_ADAPTER_BASENAME):
         return
     errors.append(
-        f"cmux adapter: no `Read` of `{CMUX_ADAPTER_BASENAME}` found in the "
+        f"cmux adapter: no read of `{CMUX_ADAPTER_BASENAME}` (a `Read` call or a "
+        f"shell command naming it) found in the "
         "selected adapter evidence source within this run's window — the cmux "
         "adapter is selected by environment, not by lead runtime, so it MUST be "
         f"read before dispatch ({_CMUX_ADAPTER_CITE})."
@@ -1358,7 +1393,8 @@ def _check_implementation_entry_guard(
                 else "the staged copy MUST be read at least once inside that window"
             )
             errors.append(
-                f"implementation entry guard: no `Read` of `{row.basename}` found in "
+                f"implementation entry guard: no read of `{row.basename}` (a `Read` call "
+                f"or a shell command naming it) found in "
                 f"the selected adapter evidence source within this run's window — "
                 f"{demand} ({row.cite})."
             )
@@ -1369,7 +1405,7 @@ def _check_implementation_entry_guard(
         anchor_ts = anchors.get(anchor_phase)
         if anchor_ts and min(ts_list) >= anchor_ts:
             errors.append(
-                f"implementation entry guard: `{row.basename}` was first Read at "
+                f"implementation entry guard: `{row.basename}` was first read at "
                 f"{min(ts_list)}, not before the first `PROGRESS: {anchor_phase}` "
                 f"line ({anchor_ts}) — it must be loaded {when}, before "
                 f"that checkpoint ({row.cite})."