okstra 0.180.0 → 0.183.2

package/runtime/python/okstra_ctl/convergence_store.py

@@ -1,10 +1,7 @@
 """Validated JSON loading and atomic persistence for convergence artifacts."""
 from __future__ import annotations
 
-import json
-import os
 from pathlib import Path
-import tempfile
 from typing import Any, Mapping
 
 from .convergence_engine import ConvergenceContractError
@@ -14,6 +11,8 @@ from .execution_manifest import (
     read_execution_manifest,
     reserve_derived_role_invocation,
 )
+from .final_report_schema import load_named_schema
+from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
 from .worker_request import verifier_extra_dirs
 from .write_policy import build_invocation_write_contract
 
@@ -25,44 +24,66 @@ DYNAMIC_VERIFIER_SOURCE_ROLES = frozenset({
     "verifier",
 })
 
+_CRITIC_BATCH_SCHEMA = {
+    "type": "object",
+    "required": [
+        "schemaVersion", "taskKey", "mode", "provider",
+        "modelExecutionValue", "dispatches", "gaps",
+    ],
+    "additionalProperties": False,
+    "properties": {
+        "schemaVersion": {"const": "1.0"},
+        "taskKey": {"type": "string", "pattern": "\\S"},
+        "mode": {"const": "coverage"},
+        "provider": {"type": "string", "pattern": "\\S"},
+        "modelExecutionValue": {"type": "string", "pattern": "\\S"},
+        "dispatches": {"type": "array", "items": {"type": "object"}},
+        "gaps": {"type": "array", "items": {"type": "object"}},
+    },
+}
+
+
+def load_owned_json_object(path: Path) -> dict[str, Any]:
+    try:
+        return load_owned_object(path, artifact="convergence artifact")
+    except JsonBoundaryError as exc:
+        raise ConvergenceContractError(str(exc)) from exc
+
+
+def _load_convergence_result(
+    path: Path, *, schema: Mapping[str, Any]
+) -> dict[str, Any]:
+    try:
+        return load_owned_object(
+            path, artifact="convergence result", schema=schema
+        )
+    except JsonBoundaryError as exc:
+        raise ConvergenceContractError(str(exc)) from exc
+
+
+def load_convergence_round_results(path: Path) -> dict[str, Any]:
+    return _load_convergence_result(
+        path,
+        schema=load_named_schema("convergence-round-results-v1.0.schema.json"),
+    )
+
+
+def load_convergence_critic_batch(path: Path) -> dict[str, Any]:
+    return _load_convergence_result(path, schema=_CRITIC_BATCH_SCHEMA)
+
 
 def load_json_object(path: Path) -> dict[str, Any]:
-    value = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(value, dict):
-        raise ConvergenceContractError(f"JSON input must be an object: {path}")
-    return value
+    """Compatibility alias for convergence artifacts owned by okstra."""
+    return load_owned_json_object(path)
 
 
 def write_json_atomic(path: Path, payload: Mapping[str, Any]) -> None:
     if not isinstance(payload, Mapping):
         raise ConvergenceContractError("JSON output payload must be an object")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    temp_path: Path | None = None
     try:
-        with tempfile.NamedTemporaryFile(
-            mode="w",
-            encoding="utf-8",
-            dir=path.parent,
-            prefix=f".{path.name}.",
-            suffix=".tmp",
-            delete=False,
-        ) as handle:
-            temp_path = Path(handle.name)
-            json.dump(
-                payload,
-                handle,
-                ensure_ascii=False,
-                sort_keys=True,
-                indent=2,
-            )
-            handle.write("\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temp_path, path)
-        temp_path = None
-    finally:
-        if temp_path is not None:
-            temp_path.unlink(missing_ok=True)
+        write_owned_object_atomic(path, payload, artifact="convergence artifact")
+    except JsonBoundaryError as exc:
+        raise ConvergenceContractError(str(exc)) from exc
 
 
 def write_final_state_atomic(
@@ -111,7 +132,7 @@ def reserve_dynamic_verifier(
         source_role_execution_ref,
         duty_id,
     )
-    authority = load_json_object(manifest_path)
+    authority = load_owned_json_object(manifest_path)
     if authority.get("taskKey") not in (None, task_key):
         raise ExecutionManifestError("dynamic verifier taskKey does not match manifest")
     project_root = _manifest_project_root(authority, manifest_path)

package/runtime/python/okstra_ctl/design_prep.py

@@ -21,6 +21,7 @@ from pathlib import Path
 from typing import Any, Iterator
 
 from .final_report_schema import load_schema, validate as validate_schema
+from .json_boundary import JsonBoundaryError, load_owned_object
 from okstra_project import ResolverError, resolve_project_root
 
 
@@ -166,8 +167,10 @@ def assessment_fingerprint(item: Mapping[str, Any]) -> str:
 
 def _load_plan_data(data_path: Path) -> dict[str, Any]:
     try:
-        data = json.loads(data_path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
+        data = load_owned_object(data_path, artifact="planning report record")
+    except JsonBoundaryError as exc:
+        if exc.reason == "top-level JSON value must be an object":
+            raise DesignPrepError(f"planning data must be an object: {data_path}") from exc
         raise DesignPrepError(f"cannot read planning data {data_path}: {exc}") from exc
     if not isinstance(data, dict):
         raise DesignPrepError(f"planning data must be an object: {data_path}")
@@ -1045,8 +1048,8 @@ def _read_carry(path: Path, stage: int, warnings: list[str]) -> Mapping[str, Any
     if not path.is_file():
         return None
     try:
-        payload = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
+        payload = load_owned_object(path, artifact="design preparation carry")
+    except JsonBoundaryError as exc:
         warnings.append(f"malformed carry stage {stage}; ignored: {exc}")
         return None
     if not isinstance(payload, Mapping):

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -78,6 +78,7 @@ from .execution_mutation_audit import (
     assert_compatible_batch,
 )
 from .convergence_store import write_json_atomic
+from .json_boundary import JsonBoundaryError, external_worker_json_source, load_external_json
 from .assignment_environment import load_assignment_context
 from .model_pool import ModelPool
 from .error_log_write import append_observed
@@ -97,12 +98,6 @@ from .schema_excerpt import (
     excerpt_contract_skew,
 )
 from .seeding import installed_version
-from .report_finalize import (
-    STEP_VALIDATE_RUN,
-    FinalizeContext,
-    FinalizeError,
-    run_finalize,
-)
 from .worker_audit_ledger import (
     check_worker_results_audit,
     parse_worker_result_name,
@@ -463,6 +458,12 @@ def _orchestrator_artifact_roots(plan: DispatchPlan) -> tuple[Path, ...]:
     return tuple(roots)
 
 
+# 이 모듈이 정산하는 모든 디스패치의 집행 방식. 상수인 이유는
+# `dispatch_state._AGENT_ENFORCEMENT_MODES` 의 다른 값(`host-native-spec-link-gate`)
+# 이 호스트 원시 호출 전용이고 이 경로로 오지 않기 때문이다.
+CLI_DISPATCH_ENFORCEMENT_MODE = "core-pre-dispatch"
+
+
 def _round_artifact_paths(plan: DispatchPlan) -> tuple[Path, ...]:
     """Every artifact this round's workers are entitled to write.
 
@@ -1245,7 +1246,7 @@ def _invocation_job_fields(
         "instruction_digest": _require_string(digests, "instructionDigest"),
         "prompt_digest": _require_string(digests, "promptDigest"),
         "host_model_value": host_model_value,
-        "enforcement_mode": "core-pre-dispatch",
+        "enforcement_mode": CLI_DISPATCH_ENFORCEMENT_MODE,
     }
     schema = metadata.get("schemaVersion")
     identity_version = metadata.get("executionIdentityVersion")
@@ -1924,28 +1925,6 @@ def _finish_attempt(
     settlement = _settle(plan, job, attempt, outcome)
     if settlement.completed:
         result_link = _link_result(plan, job, attempt)
-        post_process = _post_process_report_writer_result(plan, job)
-        if not post_process["ok"]:
-            reason = _require_string(post_process, "reason")
-            _transition_job_status(plan, job, "error", reason)
-            _update_dispatch_status(
-                plan.team_state_path,
-                job,
-                attempt,
-                "error",
-                reason,
-            )
-            details = _failure_details(
-                job,
-                attempt,
-                outcome,
-                reason,
-                exit_code=1,
-            )
-            details["postProcessing"] = post_process["steps"]
-            _append_event(plan, "worker-failed", details)
-            _finish_manifest_attempt(plan, job, attempt, mutation, None)
-            return False
         _transition_job_status(plan, job, "completed", "")
         _update_dispatch_status(
             plan.team_state_path,
@@ -1955,7 +1934,6 @@ def _finish_attempt(
             "; ".join(part for part in (settlement.note, result_link["reason"]) if part),
         )
         details = _result_details(job, attempt, outcome)
-        details["postProcessing"] = post_process["steps"]
         details["resultLink"] = result_link
         if settlement.error_log_append is not None:
             details["errorLogAppend"] = settlement.error_log_append
@@ -2007,7 +1985,9 @@ def _audit_attempt(
     return ExecutionMutationAudit().compare(
         snapshot,
         policies,
-        out_of_plan_edits=_out_of_plan_edit_paths(job.result_path),
+        out_of_plan_edits=_out_of_plan_edit_paths(
+            job.result_path, project_root=job.project_root
+        ),
         attempt_succeeded=succeeded,
         result_present=result_present,
     )
@@ -2044,14 +2024,26 @@ def _declared_out_of_plan_paths(result_path: Path) -> tuple[str, ...]:
     return tuple(paths)
 
 
-def _out_of_plan_edit_paths(result_path: Path) -> tuple[str, ...]:
+def _out_of_plan_edit_paths(
+    result_path: Path, *, project_root: Path | None = None
+) -> tuple[str, ...]:
     if result_path.suffix != ".json":
         return _declared_out_of_plan_paths(result_path)
     if not result_path.is_file():
         return ()
+    if project_root is None:
+        raise ValueError("JSON worker result requires project_root")
     try:
-        payload = json.loads(result_path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeError, json.JSONDecodeError):
+        # 외부 입력: 워커 모델이 게시한 결과 봉투를 디스패처가 수락 전에 판독한다.
+        payload = load_external_json(
+            external_worker_json_source(
+                result_path,
+                trusted_root=project_root,
+                lane_root=result_path.parent,
+            ),
+            artifact="worker result",
+        )
+    except JsonBoundaryError:
         return ()
     implementation = payload.get("implementation") if isinstance(payload, Mapping) else None
     rows = implementation.get("outOfPlanEdits") if isinstance(implementation, Mapping) else None
@@ -2437,36 +2429,6 @@ def _wrapper_log_tail(job: WorkerJob) -> str | None:
     return tail.decode("utf-8", errors="replace").strip() or None
 
 
-def _post_process_report_writer_result(
-    plan: DispatchPlan,
-    job: WorkerJob,
-) -> dict[str, Any]:
-    if job.worker_id != REPORT_WRITER_WORKER_ID:
-        return {"ok": True, "reason": "", "steps": []}
-    try:
-        context = FinalizeContext.from_manifest(
-            project_root=plan.project_root,
-            workspace_root=plan.workspace_root,
-            manifest_path=plan.manifest_path,
-            team_state_path=plan.team_state_path,
-            data_path=job.result_path,
-            manifest=plan.manifest,
-        )
-
-        def settle_before(step_name: str) -> None:
-            if step_name == STEP_VALIDATE_RUN:
-                _transition_worker_status(
-                    plan.team_state_path,
-                    job.worker_id,
-                    "completed",
-                    "",
-                )
-
-        return run_finalize(context, before_step=settle_before)
-    except FinalizeError as exc:
-        return {"ok": False, "reason": str(exc), "steps": []}
-
-
 def _projectionless_translator(plan: DispatchPlan, job: WorkerJob) -> bool:
     if not (
         job.has_execution_identity
@@ -2946,7 +2908,15 @@ def _job_from_record(project_root: Path, record: Mapping[str, Any]) -> WorkerJob
             if isinstance(record.get("hostModelValue"), str)
             else None
         ),
-        enforcement_mode=_string_value(record.get("enforcementMode")),
+        # jobs 파일은 `agent-prompt materialize` 가 쓴 `.meta.json` 을 옮겨 적는
+        # 것이 정상 경로인데, materialize 는 이 값을 기록하지 않는다 — 기록할
+        # 것이 없기 때문이다. worker-dispatch 를 타는 디스패치의 집행 방식은
+        # 하나뿐이고, 다른 하나(`host-native-spec-link-gate`)는 리드가 호스트
+        # 원시 호출을 직접 기록할 때만 쓴다. 그래서 손으로 채우게 하지 않는다.
+        enforcement_mode=(
+            _string_value(record.get("enforcementMode"))
+            or CLI_DISPATCH_ENFORCEMENT_MODE
+        ),
         **(identity or {}),
     )
 

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -68,6 +68,13 @@ from .write_policy import (
     write_policy_from_payload,
 )
 from .convergence_store import write_json_atomic
+from .json_boundary import (
+    JsonBoundaryError,
+    external_worker_json_source,
+    load_external_json,
+    load_owned_object,
+    write_owned_object_atomic,
+)
 
 BACKEND_CLI_WRAPPER = "cli-wrapper"
 BACKEND_CMUX_PANE = "cmux-pane"
@@ -369,8 +376,8 @@ def load_json_object(path: Path, label: str) -> dict[str, Any]:
     if not path.is_file():
         raise DispatchError(f"{label} not found: {path}")
     try:
-        payload = json.loads(path.read_text(encoding="utf-8"))
-    except json.JSONDecodeError as exc:
+        payload = load_owned_object(path, artifact=label)
+    except JsonBoundaryError as exc:
         raise DispatchError(f"{label} is invalid JSON: {path}: {exc}") from exc
     if not isinstance(payload, dict):
         raise DispatchError(f"{label} must be a JSON object: {path}")
@@ -381,26 +388,7 @@ def write_json(path: Path, payload: Mapping[str, Any]) -> None:
     # Write via temp file + os.replace so a crash mid-write cannot leave a
     # truncated team-state.json that every later load_json_object rejects;
     # os.replace is atomic on POSIX, matching run_context._atomic_write_json.
-    path.parent.mkdir(parents=True, exist_ok=True)
-    temp_path: Path | None = None
-    try:
-        with tempfile.NamedTemporaryFile(
-            mode="w",
-            encoding="utf-8",
-            dir=path.parent,
-            prefix=f".{path.name}.",
-            suffix=".tmp",
-            delete=False,
-        ) as handle:
-            temp_path = Path(handle.name)
-            handle.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temp_path, path)
-        temp_path = None
-    finally:
-        if temp_path is not None:
-            temp_path.unlink(missing_ok=True)
+    write_owned_object_atomic(path, payload, artifact="team state")
 
 
 @contextlib.contextmanager
@@ -1107,6 +1095,33 @@ def _finish_native_agent_attempt(
     if dispatch.get("writeEnforcement") != invocation.write_enforcement:
         raise DispatchError("agent dispatch write enforcement changed")
     policy = write_policy_from_payload(invocation.write_policy)
+    status, summary = _native_mutation_result(
+        project_root=project_root,
+        dispatch=dispatch,
+        result_path=result_path,
+        policy=policy,
+    )
+    _close_native_attempt(
+        manifest_path,
+        manifest,
+        identity,
+        status,
+        result_relative,
+        summary,
+    )
+    if status != "ok":
+        violations = summary.get("violations")
+        detail = "; ".join(violations) if isinstance(violations, list) else status
+        raise DispatchError(f"agent mutation audit failed: {detail or status}")
+
+
+def _native_mutation_result(
+    *,
+    project_root: Path,
+    dispatch: Mapping[str, Any],
+    result_path: Path,
+    policy: WritePolicy,
+) -> tuple[str, Mapping[str, Any]]:
     snapshot_value = string_value(dispatch.get("mutationAuditSnapshotPath"))
     if snapshot_value:
         snapshot_payload = load_json_object(
@@ -1120,7 +1135,9 @@ def _finish_native_agent_attempt(
         result = ExecutionMutationAudit().compare(
             snapshot,
             (policy,),
-            out_of_plan_edits=_native_out_of_plan_paths(result_path),
+            out_of_plan_edits=_native_out_of_plan_paths(
+                result_path, project_root=project_root
+            ),
             attempt_succeeded=True,
             result_present=True,
         )
@@ -1139,18 +1156,7 @@ def _finish_native_agent_attempt(
             "beforeDigest": "",
             "afterDigest": "",
         }
-    _close_native_attempt(
-        manifest_path,
-        manifest,
-        identity,
-        status,
-        result_relative,
-        summary,
-    )
-    if status != "ok":
-        violations = summary.get("violations")
-        detail = "; ".join(violations) if isinstance(violations, list) else status
-        raise DispatchError(f"agent mutation audit failed: {detail or status}")
+    return status, summary
 
 
 def _close_native_attempt(
@@ -1191,12 +1197,22 @@ def _close_native_attempt(
     )
 
 
-def _native_out_of_plan_paths(result_path: Path) -> tuple[str, ...]:
+def _native_out_of_plan_paths(
+    result_path: Path, *, project_root: Path
+) -> tuple[str, ...]:
     if result_path.suffix != ".json":
         return ()
     try:
-        payload = json.loads(result_path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeError, json.JSONDecodeError):
+        # 외부 입력: 네이티브 모델 결과에서 선택적 수정 경로만 투영한다.
+        payload = load_external_json(
+            external_worker_json_source(
+                result_path,
+                trusted_root=project_root,
+                lane_root=result_path.parent,
+            ),
+            artifact="native worker result",
+        )
+    except JsonBoundaryError:
         return ()
     implementation = payload.get("implementation") if isinstance(payload, Mapping) else None
     rows = implementation.get("outOfPlanEdits") if isinstance(implementation, Mapping) else None
@@ -1668,6 +1684,26 @@ def _validate_agent_invocations(
         raise DispatchError("agent invocation contract: " + "; ".join(errors))
 
 
+def divergent_fields(
+    pairs: Sequence[tuple[str, Any, Any]],
+    *,
+    left: str,
+    right: str,
+) -> list[str]:
+    """어긋난 필드만 이름과 두 값으로 적는다.
+
+    이 두 검사는 각각 일곱 개와 다섯 개의 조건을 `or` 로 묶어 한 문장으로
+    보고했다. 그래서 재시도 프롬프트의 `dispatchKind` 하나가 틀린 경우와
+    provider 가 틀린 경우가 같은 문장으로 나왔고, 읽는 쪽이 어느 값을 봐야 할지
+    알 수 없었다. 판정에 쓴 값은 이미 손에 있으므로 감출 이유가 없다.
+    """
+    return [
+        f"{name}: {left}={found!r} {right}={expected!r}"
+        for name, found, expected in pairs
+        if found != expected
+    ]
+
+
 def _v2_job_authority_errors(
     job: WorkerJob,
     metadata: Mapping[str, Any],
@@ -1682,14 +1718,22 @@ def _v2_job_authority_errors(
     errors: list[str] = []
     if job.invocation_ref != identity.invocation_ref:
         errors.append("jobs file invocationRef does not match invocation metadata")
-    if (
-        job.participant_ref != identity.participant_ref
-        or job.role_execution_ref != identity.role_execution_ref
-        or job.execution_label != identity.execution_label
-        or job.duty_id != identity.duty_id
-        or job.attempt != identity.attempt
-    ):
-        errors.append("jobs file v2 identity does not match invocation metadata")
+    divergent = divergent_fields(
+        (
+            ("participantRef", identity.participant_ref, job.participant_ref),
+            ("roleExecutionRef", identity.role_execution_ref, job.role_execution_ref),
+            ("executionLabel", identity.execution_label, job.execution_label),
+            ("dutyId", identity.duty_id, job.duty_id),
+            ("attempt", identity.attempt, job.attempt),
+        ),
+        left="metadata",
+        right="job",
+    )
+    if divergent:
+        errors.append(
+            "jobs file v2 identity does not match invocation metadata — "
+            + "; ".join(divergent)
+        )
     prompt = metadata.get("prompt")
     metadata_prompt_value = (
         string_value(prompt.get("path")) if isinstance(prompt, Mapping) else ""
@@ -1734,19 +1778,50 @@ def _v2_job_authority_errors(
                     assignment=parsed_assignment,
                 )
             )
-    if (
-        not isinstance(execution, Mapping)
-        or not isinstance(participant, Mapping)
-        or not isinstance(assignment, Mapping)
-        or execution.get("participantRef") != job.participant_ref
-        or execution.get("executionLabel") != job.execution_label
-        or execution.get("role") != job.role
-        or execution.get("role") != duty_role
-        or execution.get("provider") != job.provider
-        or assignment.get("modelExecutionValue") != job.model_execution_value
-        or metadata.get("dispatchKind") != job.dispatch_kind
-    ):
-        errors.append("jobs file v2 identity does not match role execution authority")
+    missing = [
+        name for name, value in (
+            ("roleExecution", execution),
+            ("participant", participant),
+            ("modelAssignment", assignment),
+        )
+        if not isinstance(value, Mapping)
+    ]
+    if missing:
+        errors.append(
+            "jobs file v2 identity does not match role execution authority: "
+            f"the run manifest has no {', '.join(missing)} for this job"
+        )
+        return errors
+    # 어긋난 필드를 이름으로 댄다. 일곱 조건을 한 문장으로 접던 동안, dispatchKind
+    # 하나가 틀린 경우와 provider 가 틀린 경우가 같은 문장으로 보고됐다 —
+    # 재시도 프롬프트를 만들다 `initial-retry` 로 적은 리드가 원인을 좁히지
+    # 못했다. 판정에 쓴 값은 여기 다 있으므로 굳이 감출 이유가 없다.
+    divergent = divergent_fields(
+        (
+            ("participantRef",
+             execution.get("participantRef"), job.participant_ref),
+            ("executionLabel",
+             execution.get("executionLabel"), job.execution_label),
+            ("role", execution.get("role"), job.role),
+            ("modelExecutionValue",
+             assignment.get("modelExecutionValue"), job.model_execution_value),
+            ("dispatchKind",
+             metadata.get("dispatchKind"), job.dispatch_kind),
+            ("provider", execution.get("provider"), job.provider),
+        ),
+        left="manifest",
+        right="job",
+    )
+    if execution.get("role") != duty_role:
+        divergent.append(
+            f"role: roleExecution={execution.get('role')!r} "
+            f"duty {job.duty_id!r} requires {duty_role!r}"
+        )
+    if divergent:
+        errors.append(
+            "jobs file v2 identity does not match role execution authority — "
+            + "; ".join(divergent)
+        )
     return errors
 
 

package/runtime/python/okstra_ctl/doctor.py

@@ -15,6 +15,7 @@ from . import improvement_lenses, worktree_registry
 from .models import provider_wrappers
 from .workers import resolve_profile_workers
 from .worktree import is_git_work_tree, main_worktree_path
+from .json_boundary import JsonBoundaryError, load_owned_object
 
 SUPPORTED_PHASES: tuple[str, ...] = (
     "implementation",
@@ -156,7 +157,9 @@ def _architecture_declaration_check(project_root: Path) -> DoctorCheck | None:
     value is read here: `resolve_architecture()` maps absent and `none` alike.
     """
     try:
-        payload = json.loads(project_json_path(project_root).read_text(encoding="utf-8"))
+        payload = load_owned_object(
+            project_json_path(project_root), artifact="project configuration"
+        )
     except (OSError, ValueError):
         return None
     architecture = payload.get("architecture") if isinstance(payload, dict) else None
@@ -383,8 +386,8 @@ def _worktree_registry_check() -> DoctorCheck:
     if not path.exists():
         return _ok("worktree registry", f"no registry yet ({path})")
     try:
-        data = json.loads(path.read_text())
-    except (OSError, json.JSONDecodeError) as exc:
+        data = load_owned_object(path, artifact="worktree registry")
+    except JsonBoundaryError as exc:
         return _fail("worktree registry", f"{path} is unreadable: {exc}")
     if not isinstance(data, dict) or not isinstance(data.get("tasks"), dict):
         return _fail("worktree registry", f"{path} is missing a valid 'tasks' table")