okstra 0.179.2 → 0.183.2

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -78,6 +78,7 @@ from .execution_mutation_audit import (
     assert_compatible_batch,
 )
 from .convergence_store import write_json_atomic
+from .json_boundary import JsonBoundaryError, external_worker_json_source, load_external_json
 from .assignment_environment import load_assignment_context
 from .model_pool import ModelPool
 from .error_log_write import append_observed
@@ -97,12 +98,6 @@ from .schema_excerpt import (
     excerpt_contract_skew,
 )
 from .seeding import installed_version
-from .report_finalize import (
-    STEP_VALIDATE_RUN,
-    FinalizeContext,
-    FinalizeError,
-    run_finalize,
-)
 from .worker_audit_ledger import (
     check_worker_results_audit,
     parse_worker_result_name,
@@ -310,7 +305,7 @@ class DispatchPlan:
 @dataclass(frozen=True)
 class _BuildOptions:
     okstra_bin: Path | None
-    idle_timeout_seconds: int
+    idle_timeout_seconds: int | None
     default_backend: str
     supported_worker_wrappers: Mapping[str, str]
     unsupported_worker_label: str
@@ -335,7 +330,7 @@ def build_dispatch_plan(
     workspace_root: Path,
     okstra_bin: Path | None = None,
     requested_workers: Sequence[str] = (),
-    idle_timeout_seconds: int = 600,
+    idle_timeout_seconds: int | None = None,
     required_lead_runtime: str | None = None,
     default_backend: str = BACKEND_CLI_WRAPPER,
     supported_worker_wrappers: Mapping[str, str],
@@ -432,6 +427,43 @@ def dispatch_plan(plan: DispatchPlan, *, wait: bool = True) -> int:
     return 0
 
 
+def _orchestrator_artifact_roots(plan: DispatchPlan) -> tuple[Path, ...]:
+    """okstra 자신이 이 run 동안 쓰는 산출물 경로.
+
+    `_round_artifact_paths` 는 이번 배치의 job 만 알기 때문에 원리상 완결될 수
+    없다. 감사 창에 들어오는 것은 형제 job 의 산출물만이 아니라 같은 run 의 다른
+    라운드가 남기는 것들이다 — 재시도 프롬프트와 그 `.meta.json` / `.publish.lock`,
+    이전 라운드 워커의 `.log` / `.status.json` / `.mutation-audit.json`, critic 의
+    결과, design-prep 요청. 실측 한 건에서 그렇게 빠져나간 경로가 16개였고 그
+    배치의 디스패치 5건이 전부 `readonly source changed` 로 떨어졌다.
+
+    그래서 파일을 더 세는 대신 트리를 싣는다. 이 디렉터리 아래는 정의상 okstra 의
+    산출물이고 프로젝트 소스가 아니다 — 소스가 바뀌었는지를 묻는 질문의 답이 될 수
+    없다.
+    """
+    # 실행 매니페스트는 `<run_dir>/manifests/` 아래 놓인다.
+    roots = [plan.manifest_path.resolve().parents[1]]
+    # task 매니페스트와 discovery 카탈로그는 run 디렉터리 위에 있고, prep 과
+    # 완료 기록이 실행 중에 갱신한다. 경로는 매니페스트가 이미 들고 있으므로
+    # 디렉터리 깊이를 세지 않는다 — implementation 은 stage 층이 하나 더 있어
+    # 고정 인덱스로는 task root 에 닿지 못한다.
+    for key in ("taskManifestPath", "taskCatalogPath"):
+        value = plan.manifest.get(key)
+        if isinstance(value, str) and value:
+            candidate = Path(value)
+            roots.append(
+                candidate if candidate.is_absolute()
+                else (plan.project_root / candidate)
+            )
+    return tuple(roots)
+
+
+# 이 모듈이 정산하는 모든 디스패치의 집행 방식. 상수인 이유는
+# `dispatch_state._AGENT_ENFORCEMENT_MODES` 의 다른 값(`host-native-spec-link-gate`)
+# 이 호스트 원시 호출 전용이고 이 경로로 오지 않기 때문이다.
+CLI_DISPATCH_ENFORCEMENT_MODE = "core-pre-dispatch"
+
+
 def _round_artifact_paths(plan: DispatchPlan) -> tuple[Path, ...]:
     """Every artifact this round's workers are entitled to write.
 
@@ -1214,7 +1246,7 @@ def _invocation_job_fields(
         "instruction_digest": _require_string(digests, "instructionDigest"),
         "prompt_digest": _require_string(digests, "promptDigest"),
         "host_model_value": host_model_value,
-        "enforcement_mode": "core-pre-dispatch",
+        "enforcement_mode": CLI_DISPATCH_ENFORCEMENT_MODE,
     }
     schema = metadata.get("schemaVersion")
     identity_version = metadata.get("executionIdentityVersion")
@@ -1488,6 +1520,7 @@ def _mutation_snapshot(
         orchestrator_paths=(
             *round_artifact_paths,
             *_run_errors_log_path(plan),
+            *_orchestrator_artifact_roots(plan),
             plan.manifest_path,
             plan.team_state_path,
             Path(f"{plan.team_state_path}.lock"),
@@ -1840,6 +1873,31 @@ def _retry_from_record(
     _spawn_job(plan, _job_for_next_attempt(job), attempt + 1)
 
 
+# 사유 한 줄에 실을 경로 개수. 전부 실으면 team-state 행이 부풀고, 하나도 안
+# 실으면 읽는 쪽이 다른 파일을 뒤져야 한다.
+_MUTATION_REASON_PATH_LIMIT = 5
+
+
+def _mutation_failure_reason(mutation) -> str:
+    """왜 실패했는지와 무엇이 바뀌었는지를 한 줄에 담는다.
+
+    종전에는 디스패치 행에 `readonly source changed` 만 남고 바뀐 경로는
+    lead-events 에만 있었다. 읽는 쪽이 그 파일의 존재를 알아야 원인에 닿을 수
+    있었고, 실제로 두 번의 진단이 같은 자리에서 빗나갔다 — 한 번은 감사를 손으로
+    재구현해서, 한 번은 사용자 편집을 의심해서. 감사는 답을 이미 계산해 두었으니
+    사유 옆에 놓는다.
+    """
+    reason = "; ".join(mutation.violations) or mutation.status
+    paths = list(mutation.changed_paths)
+    if not paths:
+        return reason
+    shown = ", ".join(paths[:_MUTATION_REASON_PATH_LIMIT])
+    remaining = len(paths) - _MUTATION_REASON_PATH_LIMIT
+    if remaining > 0:
+        shown += f", +{remaining} more"
+    return f"{reason} [changed: {shown}]"
+
+
 def _finish_attempt(
     plan: DispatchPlan,
     job: WorkerJob,
@@ -1854,7 +1912,7 @@ def _finish_attempt(
         "contract-failed-unattributed",
         "mutation-present-unresolved",
     }:
-        reason = "; ".join(mutation.violations) or mutation.status
+        reason = _mutation_failure_reason(mutation)
         _transition_job_status(plan, job, "error", reason)
         _update_dispatch_status(
             plan.team_state_path, job, attempt, "error", reason
@@ -1867,28 +1925,6 @@ def _finish_attempt(
     settlement = _settle(plan, job, attempt, outcome)
     if settlement.completed:
         result_link = _link_result(plan, job, attempt)
-        post_process = _post_process_report_writer_result(plan, job)
-        if not post_process["ok"]:
-            reason = _require_string(post_process, "reason")
-            _transition_job_status(plan, job, "error", reason)
-            _update_dispatch_status(
-                plan.team_state_path,
-                job,
-                attempt,
-                "error",
-                reason,
-            )
-            details = _failure_details(
-                job,
-                attempt,
-                outcome,
-                reason,
-                exit_code=1,
-            )
-            details["postProcessing"] = post_process["steps"]
-            _append_event(plan, "worker-failed", details)
-            _finish_manifest_attempt(plan, job, attempt, mutation, None)
-            return False
         _transition_job_status(plan, job, "completed", "")
         _update_dispatch_status(
             plan.team_state_path,
@@ -1898,7 +1934,6 @@ def _finish_attempt(
             "; ".join(part for part in (settlement.note, result_link["reason"]) if part),
         )
         details = _result_details(job, attempt, outcome)
-        details["postProcessing"] = post_process["steps"]
         details["resultLink"] = result_link
         if settlement.error_log_append is not None:
             details["errorLogAppend"] = settlement.error_log_append
@@ -1950,7 +1985,9 @@ def _audit_attempt(
     return ExecutionMutationAudit().compare(
         snapshot,
         policies,
-        out_of_plan_edits=_out_of_plan_edit_paths(job.result_path),
+        out_of_plan_edits=_out_of_plan_edit_paths(
+            job.result_path, project_root=job.project_root
+        ),
         attempt_succeeded=succeeded,
         result_present=result_present,
     )
@@ -1987,14 +2024,26 @@ def _declared_out_of_plan_paths(result_path: Path) -> tuple[str, ...]:
     return tuple(paths)
 
 
-def _out_of_plan_edit_paths(result_path: Path) -> tuple[str, ...]:
+def _out_of_plan_edit_paths(
+    result_path: Path, *, project_root: Path | None = None
+) -> tuple[str, ...]:
     if result_path.suffix != ".json":
         return _declared_out_of_plan_paths(result_path)
     if not result_path.is_file():
         return ()
+    if project_root is None:
+        raise ValueError("JSON worker result requires project_root")
     try:
-        payload = json.loads(result_path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeError, json.JSONDecodeError):
+        # 외부 입력: 워커 모델이 게시한 결과 봉투를 디스패처가 수락 전에 판독한다.
+        payload = load_external_json(
+            external_worker_json_source(
+                result_path,
+                trusted_root=project_root,
+                lane_root=result_path.parent,
+            ),
+            artifact="worker result",
+        )
+    except JsonBoundaryError:
         return ()
     implementation = payload.get("implementation") if isinstance(payload, Mapping) else None
     rows = implementation.get("outOfPlanEdits") if isinstance(implementation, Mapping) else None
@@ -2380,36 +2429,6 @@ def _wrapper_log_tail(job: WorkerJob) -> str | None:
     return tail.decode("utf-8", errors="replace").strip() or None
 
 
-def _post_process_report_writer_result(
-    plan: DispatchPlan,
-    job: WorkerJob,
-) -> dict[str, Any]:
-    if job.worker_id != REPORT_WRITER_WORKER_ID:
-        return {"ok": True, "reason": "", "steps": []}
-    try:
-        context = FinalizeContext.from_manifest(
-            project_root=plan.project_root,
-            workspace_root=plan.workspace_root,
-            manifest_path=plan.manifest_path,
-            team_state_path=plan.team_state_path,
-            data_path=job.result_path,
-            manifest=plan.manifest,
-        )
-
-        def settle_before(step_name: str) -> None:
-            if step_name == STEP_VALIDATE_RUN:
-                _transition_worker_status(
-                    plan.team_state_path,
-                    job.worker_id,
-                    "completed",
-                    "",
-                )
-
-        return run_finalize(context, before_step=settle_before)
-    except FinalizeError as exc:
-        return {"ok": False, "reason": str(exc), "steps": []}
-
-
 def _projectionless_translator(plan: DispatchPlan, job: WorkerJob) -> bool:
     if not (
         job.has_execution_identity
@@ -2866,7 +2885,8 @@ def _job_from_record(project_root: Path, record: Mapping[str, Any]) -> WorkerJob
         completion_paths=tuple(_record_completion_paths(record)),
         worktree_path=_string_value(record.get("worktreePath")),
         role=_require_string(record, "role"),
-        idle_timeout_seconds=600,
+        # 복원된 job 은 다시 실행되지 않으므로 예산을 정하지 않는다.
+        idle_timeout_seconds=None,
         dispatch_kind=_require_string(record, "kind"),
         # Restored, never re-issued: both callers rebuild a job from its record
         # to settle a dispatch that already ran, and a fresh id would settle it
@@ -2888,7 +2908,15 @@ def _job_from_record(project_root: Path, record: Mapping[str, Any]) -> WorkerJob
             if isinstance(record.get("hostModelValue"), str)
             else None
         ),
-        enforcement_mode=_string_value(record.get("enforcementMode")),
+        # jobs 파일은 `agent-prompt materialize` 가 쓴 `.meta.json` 을 옮겨 적는
+        # 것이 정상 경로인데, materialize 는 이 값을 기록하지 않는다 — 기록할
+        # 것이 없기 때문이다. worker-dispatch 를 타는 디스패치의 집행 방식은
+        # 하나뿐이고, 다른 하나(`host-native-spec-link-gate`)는 리드가 호스트
+        # 원시 호출을 직접 기록할 때만 쓴다. 그래서 손으로 채우게 하지 않는다.
+        enforcement_mode=(
+            _string_value(record.get("enforcementMode"))
+            or CLI_DISPATCH_ENFORCEMENT_MODE
+        ),
         **(identity or {}),
     )
 

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -47,6 +47,7 @@ from .execution_manifest import (
 )
 from .execution_mutation_audit import ExecutionMutationAudit, MutationSnapshot
 from .final_report_paths import final_report_data_path
+from .report_inputs import report_narrative_path, uses_report_contract_v3
 from .worker_prompt_body import REPORT_WRITER_WORKER_ID
 from .worker_prompt_contract import (
     PromptRecord,
@@ -67,6 +68,13 @@ from .write_policy import (
     write_policy_from_payload,
 )
 from .convergence_store import write_json_atomic
+from .json_boundary import (
+    JsonBoundaryError,
+    external_worker_json_source,
+    load_external_json,
+    load_owned_object,
+    write_owned_object_atomic,
+)
 
 BACKEND_CLI_WRAPPER = "cli-wrapper"
 BACKEND_CMUX_PANE = "cmux-pane"
@@ -152,7 +160,11 @@ class WorkerJob:
     completion_paths: tuple[Path, ...]
     worktree_path: str
     role: str
-    idle_timeout_seconds: int
+    # None 은 "이 디스패치가 예산을 정하지 않는다" 는 뜻이고, 그때 예산은
+    # 역할이 정한다(`domain/worker_role.role_spec`). 여기에 숫자 기본값을 두면
+    # 역할별 예산이 영영 도달 불가능해진다 — 엔트리포인트는 이 자리가 비었을
+    # 때만 역할을 보기 때문이다.
+    idle_timeout_seconds: int | None
     dispatch_kind: str
     invocation_id: str = ""
     audience: str = ""
@@ -188,7 +200,7 @@ class WorkerJob:
             str(self.prompt_path),
             self.worktree_path,
             self.wrapper_role,
-            str(self.idle_timeout_seconds),
+            self._idle_timeout_argument,
             "--presentation",
             self._presentation(),
         ]
@@ -201,6 +213,18 @@ class WorkerJob:
             argv += ["--session-id", self.session_id]
         return argv
 
+    @property
+    def _idle_timeout_argument(self) -> str:
+        """엔트리포인트가 읽는 유휴 예산 자리.
+
+        비워 두면 엔트리포인트가 역할의 예산을 쓴다. 이 자리를 항상 채우던
+        동안에는 `worker_request.idle_timeout` 의 역할 분기가 한 번도 실행되지
+        않았고, executor/verifier 의 1500s 도 함께 죽어 있었다.
+        """
+        if self.idle_timeout_seconds is None:
+            return ""
+        return str(self.idle_timeout_seconds)
+
     @property
     def wrapper_role(self) -> str:
         """The canonical role the entrypoint's role positional is read as.
@@ -352,8 +376,8 @@ def load_json_object(path: Path, label: str) -> dict[str, Any]:
     if not path.is_file():
         raise DispatchError(f"{label} not found: {path}")
     try:
-        payload = json.loads(path.read_text(encoding="utf-8"))
-    except json.JSONDecodeError as exc:
+        payload = load_owned_object(path, artifact=label)
+    except JsonBoundaryError as exc:
         raise DispatchError(f"{label} is invalid JSON: {path}: {exc}") from exc
     if not isinstance(payload, dict):
         raise DispatchError(f"{label} must be a JSON object: {path}")
@@ -364,26 +388,7 @@ def write_json(path: Path, payload: Mapping[str, Any]) -> None:
     # Write via temp file + os.replace so a crash mid-write cannot leave a
     # truncated team-state.json that every later load_json_object rejects;
     # os.replace is atomic on POSIX, matching run_context._atomic_write_json.
-    path.parent.mkdir(parents=True, exist_ok=True)
-    temp_path: Path | None = None
-    try:
-        with tempfile.NamedTemporaryFile(
-            mode="w",
-            encoding="utf-8",
-            dir=path.parent,
-            prefix=f".{path.name}.",
-            suffix=".tmp",
-            delete=False,
-        ) as handle:
-            temp_path = Path(handle.name)
-            handle.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temp_path, path)
-        temp_path = None
-    finally:
-        if temp_path is not None:
-            temp_path.unlink(missing_ok=True)
+    write_owned_object_atomic(path, payload, artifact="team state")
 
 
 @contextlib.contextmanager
@@ -707,6 +712,10 @@ def record_verified_agent_dispatch(
             snapshot = ExecutionMutationAudit().snapshot(
                 (write_policy,),
                 orchestrator_paths=(
+                    # run 산출물 트리 전체. 같은 run 의 다른 라운드가 감사 창
+                    # 안에 남기는 프롬프트·로그·사이드카를 파일 단위로 미리 셀
+                    # 수 없고, 그 아래는 정의상 소스가 아니다.
+                    Path(run_manifest_path).resolve().parents[1],
                     run_manifest_path,
                     team_state_path,
                     Path(f"{team_state_path}.lock"),
@@ -1086,6 +1095,33 @@ def _finish_native_agent_attempt(
     if dispatch.get("writeEnforcement") != invocation.write_enforcement:
         raise DispatchError("agent dispatch write enforcement changed")
     policy = write_policy_from_payload(invocation.write_policy)
+    status, summary = _native_mutation_result(
+        project_root=project_root,
+        dispatch=dispatch,
+        result_path=result_path,
+        policy=policy,
+    )
+    _close_native_attempt(
+        manifest_path,
+        manifest,
+        identity,
+        status,
+        result_relative,
+        summary,
+    )
+    if status != "ok":
+        violations = summary.get("violations")
+        detail = "; ".join(violations) if isinstance(violations, list) else status
+        raise DispatchError(f"agent mutation audit failed: {detail or status}")
+
+
+def _native_mutation_result(
+    *,
+    project_root: Path,
+    dispatch: Mapping[str, Any],
+    result_path: Path,
+    policy: WritePolicy,
+) -> tuple[str, Mapping[str, Any]]:
     snapshot_value = string_value(dispatch.get("mutationAuditSnapshotPath"))
     if snapshot_value:
         snapshot_payload = load_json_object(
@@ -1099,7 +1135,9 @@ def _finish_native_agent_attempt(
         result = ExecutionMutationAudit().compare(
             snapshot,
             (policy,),
-            out_of_plan_edits=_native_out_of_plan_paths(result_path),
+            out_of_plan_edits=_native_out_of_plan_paths(
+                result_path, project_root=project_root
+            ),
             attempt_succeeded=True,
             result_present=True,
         )
@@ -1118,18 +1156,7 @@ def _finish_native_agent_attempt(
             "beforeDigest": "",
             "afterDigest": "",
         }
-    _close_native_attempt(
-        manifest_path,
-        manifest,
-        identity,
-        status,
-        result_relative,
-        summary,
-    )
-    if status != "ok":
-        violations = summary.get("violations")
-        detail = "; ".join(violations) if isinstance(violations, list) else status
-        raise DispatchError(f"agent mutation audit failed: {detail or status}")
+    return status, summary
 
 
 def _close_native_attempt(
@@ -1170,12 +1197,22 @@ def _close_native_attempt(
     )
 
 
-def _native_out_of_plan_paths(result_path: Path) -> tuple[str, ...]:
+def _native_out_of_plan_paths(
+    result_path: Path, *, project_root: Path
+) -> tuple[str, ...]:
     if result_path.suffix != ".json":
         return ()
     try:
-        payload = json.loads(result_path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeError, json.JSONDecodeError):
+        # 외부 입력: 네이티브 모델 결과에서 선택적 수정 경로만 투영한다.
+        payload = load_external_json(
+            external_worker_json_source(
+                result_path,
+                trusted_root=project_root,
+                lane_root=result_path.parent,
+            ),
+            artifact="native worker result",
+        )
+    except JsonBoundaryError:
         return ()
     implementation = payload.get("implementation") if isinstance(payload, Mapping) else None
     rows = implementation.get("outOfPlanEdits") if isinstance(implementation, Mapping) else None
@@ -1468,6 +1505,8 @@ def dispatch_result_path(
     """
     if worker_id != REPORT_WRITER_WORKER_ID:
         return worker_result_path
+    if uses_report_contract_v3(manifest):
+        return report_narrative_path(project_root, manifest)
     return final_report_data_path(
         resolve_required_path(project_root, manifest, "expectedReportRecordPath")
     )
@@ -1487,6 +1526,8 @@ def dispatch_completion_paths(
     """
     if worker_id != REPORT_WRITER_WORKER_ID:
         return (worker_result_path,)
+    if uses_report_contract_v3(manifest):
+        return (report_narrative_path(project_root, manifest), worker_result_path)
     data_json = final_report_data_path(
         resolve_required_path(project_root, manifest, "expectedReportRecordPath")
     )
@@ -1643,6 +1684,26 @@ def _validate_agent_invocations(
         raise DispatchError("agent invocation contract: " + "; ".join(errors))
 
 
+def divergent_fields(
+    pairs: Sequence[tuple[str, Any, Any]],
+    *,
+    left: str,
+    right: str,
+) -> list[str]:
+    """어긋난 필드만 이름과 두 값으로 적는다.
+
+    이 두 검사는 각각 일곱 개와 다섯 개의 조건을 `or` 로 묶어 한 문장으로
+    보고했다. 그래서 재시도 프롬프트의 `dispatchKind` 하나가 틀린 경우와
+    provider 가 틀린 경우가 같은 문장으로 나왔고, 읽는 쪽이 어느 값을 봐야 할지
+    알 수 없었다. 판정에 쓴 값은 이미 손에 있으므로 감출 이유가 없다.
+    """
+    return [
+        f"{name}: {left}={found!r} {right}={expected!r}"
+        for name, found, expected in pairs
+        if found != expected
+    ]
+
+
 def _v2_job_authority_errors(
     job: WorkerJob,
     metadata: Mapping[str, Any],
@@ -1657,14 +1718,22 @@ def _v2_job_authority_errors(
     errors: list[str] = []
     if job.invocation_ref != identity.invocation_ref:
         errors.append("jobs file invocationRef does not match invocation metadata")
-    if (
-        job.participant_ref != identity.participant_ref
-        or job.role_execution_ref != identity.role_execution_ref
-        or job.execution_label != identity.execution_label
-        or job.duty_id != identity.duty_id
-        or job.attempt != identity.attempt
-    ):
-        errors.append("jobs file v2 identity does not match invocation metadata")
+    divergent = divergent_fields(
+        (
+            ("participantRef", identity.participant_ref, job.participant_ref),
+            ("roleExecutionRef", identity.role_execution_ref, job.role_execution_ref),
+            ("executionLabel", identity.execution_label, job.execution_label),
+            ("dutyId", identity.duty_id, job.duty_id),
+            ("attempt", identity.attempt, job.attempt),
+        ),
+        left="metadata",
+        right="job",
+    )
+    if divergent:
+        errors.append(
+            "jobs file v2 identity does not match invocation metadata — "
+            + "; ".join(divergent)
+        )
     prompt = metadata.get("prompt")
     metadata_prompt_value = (
         string_value(prompt.get("path")) if isinstance(prompt, Mapping) else ""
@@ -1709,19 +1778,50 @@ def _v2_job_authority_errors(
                     assignment=parsed_assignment,
                 )
             )
-    if (
-        not isinstance(execution, Mapping)
-        or not isinstance(participant, Mapping)
-        or not isinstance(assignment, Mapping)
-        or execution.get("participantRef") != job.participant_ref
-        or execution.get("executionLabel") != job.execution_label
-        or execution.get("role") != job.role
-        or execution.get("role") != duty_role
-        or execution.get("provider") != job.provider
-        or assignment.get("modelExecutionValue") != job.model_execution_value
-        or metadata.get("dispatchKind") != job.dispatch_kind
-    ):
-        errors.append("jobs file v2 identity does not match role execution authority")
+    missing = [
+        name for name, value in (
+            ("roleExecution", execution),
+            ("participant", participant),
+            ("modelAssignment", assignment),
+        )
+        if not isinstance(value, Mapping)
+    ]
+    if missing:
+        errors.append(
+            "jobs file v2 identity does not match role execution authority: "
+            f"the run manifest has no {', '.join(missing)} for this job"
+        )
+        return errors
+    # 어긋난 필드를 이름으로 댄다. 일곱 조건을 한 문장으로 접던 동안, dispatchKind
+    # 하나가 틀린 경우와 provider 가 틀린 경우가 같은 문장으로 보고됐다 —
+    # 재시도 프롬프트를 만들다 `initial-retry` 로 적은 리드가 원인을 좁히지
+    # 못했다. 판정에 쓴 값은 여기 다 있으므로 굳이 감출 이유가 없다.
+    divergent = divergent_fields(
+        (
+            ("participantRef",
+             execution.get("participantRef"), job.participant_ref),
+            ("executionLabel",
+             execution.get("executionLabel"), job.execution_label),
+            ("role", execution.get("role"), job.role),
+            ("modelExecutionValue",
+             assignment.get("modelExecutionValue"), job.model_execution_value),
+            ("dispatchKind",
+             metadata.get("dispatchKind"), job.dispatch_kind),
+            ("provider", execution.get("provider"), job.provider),
+        ),
+        left="manifest",
+        right="job",
+    )
+    if execution.get("role") != duty_role:
+        divergent.append(
+            f"role: roleExecution={execution.get('role')!r} "
+            f"duty {job.duty_id!r} requires {duty_role!r}"
+        )
+    if divergent:
+        errors.append(
+            "jobs file v2 identity does not match role execution authority — "
+            + "; ".join(divergent)
+        )
     return errors
 
 
@@ -1765,7 +1865,7 @@ def worker_jobs_from_file(
     manifest: Mapping[str, Any],
     active_context: Mapping[str, Any] | None = None,
     backend: str,
-    idle_timeout_seconds: int,
+    idle_timeout_seconds: int | None,
     default_dispatch_kind: str,
     resolve_wrapper: Callable[[str], Path],
     default_provider: Callable[[str], str],
@@ -1804,7 +1904,7 @@ def _worker_job_from_file(
     manifest: Mapping[str, Any],
     active_context: Mapping[str, Any] | None = None,
     backend: str,
-    idle_timeout_seconds: int,
+    idle_timeout_seconds: int | None,
     dispatch_kind: str,
     resolve_wrapper: Callable[[str], Path],
     default_provider: Callable[[str], str],

package/runtime/python/okstra_ctl/doctor.py

@@ -15,6 +15,7 @@ from . import improvement_lenses, worktree_registry
 from .models import provider_wrappers
 from .workers import resolve_profile_workers
 from .worktree import is_git_work_tree, main_worktree_path
+from .json_boundary import JsonBoundaryError, load_owned_object
 
 SUPPORTED_PHASES: tuple[str, ...] = (
     "implementation",
@@ -156,7 +157,9 @@ def _architecture_declaration_check(project_root: Path) -> DoctorCheck | None:
     value is read here: `resolve_architecture()` maps absent and `none` alike.
     """
     try:
-        payload = json.loads(project_json_path(project_root).read_text(encoding="utf-8"))
+        payload = load_owned_object(
+            project_json_path(project_root), artifact="project configuration"
+        )
     except (OSError, ValueError):
         return None
     architecture = payload.get("architecture") if isinstance(payload, dict) else None
@@ -383,8 +386,8 @@ def _worktree_registry_check() -> DoctorCheck:
     if not path.exists():
         return _ok("worktree registry", f"no registry yet ({path})")
     try:
-        data = json.loads(path.read_text())
-    except (OSError, json.JSONDecodeError) as exc:
+        data = load_owned_object(path, artifact="worktree registry")
+    except JsonBoundaryError as exc:
         return _fail("worktree registry", f"{path} is unreadable: {exc}")
     if not isinstance(data, dict) or not isinstance(data.get("tasks"), dict):
         return _fail("worktree registry", f"{path} is missing a valid 'tasks' table")