okstra 0.180.0 → 0.184.0

package/dist/commands/report/translate.mjs

@@ -11,6 +11,9 @@ human HTML is localized.
 
 Usage:
   okstra report-translate extract <path-to-final-report.data.json>
+  okstra report-translate source --run-manifest <path>
+  okstra report-translate write --run-manifest <path> --source-digest <sha256> --translations <markdown>
+  okstra report-translate check-data --run-manifest <path>
       Write <stem>.translation-source.json — every pointer the report holds a
       translatable string at, paired with its English text. The translator
       fills in the values, so a sidecar cannot cite a path the report lacks.

package/dist/commands/report/translate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"translate.mjs","sourceRoot":"","sources":["../../../src/commands/report/translate.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;CAoBb,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,OAAO,kBAAkB,CAAC;QACxB,UAAU,EAAE,4BAA4B;QACxC,IAAI;QACJ,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"translate.mjs","sourceRoot":"","sources":["../../../src/commands/report/translate.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBb,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,OAAO,kBAAkB,CAAC;QACxB,UAAU,EAAE,4BAA4B;QACxC,IAAI;QACJ,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/host-registry-client.mjs

@@ -31,14 +31,18 @@ async function callHosts(runPython, args) {
         throw new HostRegistryClientError(`host registry returned invalid JSON: ${message}`);
     }
 }
-function resolutionContext(env = {}, capabilities = {}) {
-    return {
-        env: { OKSTRA_RUNTIME_HOST: String(env?.OKSTRA_RUNTIME_HOST ?? "") },
-        capabilities: {
-            claudeSkillHandoff: capabilities?.claudeSkillHandoff === true,
-            tmuxAvailable: capabilities?.tmuxAvailable === true,
-        },
-    };
+function resolutionContextArgs(env = {}, capabilities = {}) {
+    const args = [];
+    const environmentHost = String(env?.OKSTRA_RUNTIME_HOST ?? "");
+    if (environmentHost)
+        args.push("--environment-host", environmentHost);
+    if (capabilities?.claudeSkillHandoff === true) {
+        args.push("--capability", "claude-skill-handoff");
+    }
+    if (capabilities?.tmuxAvailable === true) {
+        args.push("--capability", "tmux");
+    }
+    return args;
 }
 export function createHostRegistryClient({ runPython = runPythonModule } = {}) {
     return {
@@ -50,7 +54,7 @@ export function createHostRegistryClient({ runPython = runPythonModule } = {}) {
                 "resolve",
                 "--requested", requestedRuntime,
                 "--command", command,
-                "--context-json", JSON.stringify(resolutionContext(env, capabilities)),
+                ...resolutionContextArgs(env, capabilities),
             ]);
         },
         async probeHost({ hostRuntime, entryMode, projectRoot, homeDir, availableFunctions = [], }) {

package/dist/lib/host-registry-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"host-registry-client.mjs","sourceRoot":"","sources":["../../src/lib/host-registry-client.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYtD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAI,SAAuB,EAAE,IAAuB;IAC1E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,MAAM,EAAE,8BAA8B;QACtC,IAAI;QACJ,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAG,GAAuB,EAAE,EAC5B,YAAY,GAAqB,EAAE;IAEnC,OAAO;QACL,GAAG,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,mBAAmB,IAAI,EAAE,CAAC,EAAE;QACpE,YAAY,EAAE;YACZ,kBAAkB,EAAE,YAAY,EAAE,kBAAkB,KAAK,IAAI;YAC7D,aAAa,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAE,SAAS,GAAG,eAAe,EAAE,GAA0C,EAAE;IAM3E,OAAO;QACL,KAAK,CAAC,OAAO;YACX,OAAO,MAAM,SAAS,CAAsB,SAAS,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;YACvE,OAAO,MAAM,SAAS,CAAwB,SAAS,EAAE;gBACvD,SAAS;gBACT,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,OAAO;gBACpB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;aACvE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,EACd,WAAW,EACX,SAAS,EACT,WAAW,EACX,OAAO,EACP,kBAAkB,GAAG,EAAE,GACN;YACjB,MAAM,IAAI,GAAG;gBACX,OAAO;gBACP,QAAQ,EAAE,WAAW;gBACrB,cAAc,EAAE,SAAS;gBACzB,gBAAgB,EAAE,WAAW;gBAC7B,YAAY,EAAE,OAAO;aACtB,CAAC;YACF,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;IAC3D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,gDAAgD,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,gBAAwB,EAAE,KAA8B;IAChF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,gBAAgB;QAChB,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;QAChB,cAAc,EAAE,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4B;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CACvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAC3E,CAAC,CAAC,IAAI,EAAE,CAAC;IACV,OAAO;QACL,EAAE,EAAE,IAAI;QACR,gBAAgB,EAAE,KAAK;QACvB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,SAAS;QACrB,cAAc;QACd,cAAc;QACd,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,yCAAyC;QACjD,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA2B;IAClE,OAAO,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,OAAO,MAAM,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,gBAAgB,GAAG,YAAY,EAC/B,OAAO,GAAG,KAAK,EACf,GAAG,GAAG,EAAE,EACR,YAAY,GAAG,EAAE,GAClB,GAAuB;IACtB,gBAAgB,EAAE,YAAY;IAC9B,OAAO,EAAE,KAAK;CACf;IACC,MAAM,OAAO,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,iBAAiB,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,kBAAkB,CAAC;YAC9B,gBAAgB,EAAE,OAAO;YACzB,OAAO;YACP,GAAG;YACH,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,OAAO,EACP,WAAW,EACX,OAAO,GAAG,OAAO,EAAE,EACnB,kBAAkB,GAAG,EAAE,SAAS,EAAE,GAQnC;IACC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,OAAO,MAAM,kBAAkB,CAAC,SAAS,CAAC;QACxC,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,iBAAiB;QAC5B,WAAW;QACX,OAAO;QACP,kBAAkB,EAAE,CAAC,gBAAgB,CAAC;KACvC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"host-registry-client.mjs","sourceRoot":"","sources":["../../src/lib/host-registry-client.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAYtD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAI,SAAuB,EAAE,IAAuB;IAC1E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,MAAM,EAAE,8BAA8B;QACtC,IAAI;QACJ,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,iBAAiB,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAG,GAAuB,EAAE,EAC5B,YAAY,GAAqB,EAAE;IAEnC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,eAAe;QAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,YAAY,EAAE,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,EAAE,aAAa,KAAK,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAE,SAAS,GAAG,eAAe,EAAE,GAA0C,EAAE;IAM3E,OAAO;QACL,KAAK,CAAC,OAAO;YACX,OAAO,MAAM,SAAS,CAAsB,SAAS,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;YACvE,OAAO,MAAM,SAAS,CAAwB,SAAS,EAAE;gBACvD,SAAS;gBACT,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,OAAO;gBACpB,GAAG,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,EACd,WAAW,EACX,SAAS,EACT,WAAW,EACX,OAAO,EACP,kBAAkB,GAAG,EAAE,GACN;YACjB,MAAM,IAAI,GAAG;gBACX,OAAO;gBACP,QAAQ,EAAE,WAAW;gBACrB,cAAc,EAAE,SAAS;gBACzB,gBAAgB,EAAE,WAAW;gBAC7B,YAAY,EAAE,OAAO;aACtB,CAAC;YACF,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;IAC3D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,gDAAgD,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,gBAAwB,EAAE,KAA8B;IAChF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,gBAAgB;QAChB,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,IAAI;QAChB,cAAc,EAAE,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4B;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CACvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAC3E,CAAC,CAAC,IAAI,EAAE,CAAC;IACV,OAAO;QACL,EAAE,EAAE,IAAI;QACR,gBAAgB,EAAE,KAAK;QACvB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,SAAS;QACrB,cAAc;QACd,cAAc;QACd,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,yCAAyC;QACjD,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA2B;IAClE,OAAO,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,OAAO,MAAM,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,gBAAgB,GAAG,YAAY,EAC/B,OAAO,GAAG,KAAK,EACf,GAAG,GAAG,EAAE,EACR,YAAY,GAAG,EAAE,GAClB,GAAuB;IACtB,gBAAgB,EAAE,YAAY;IAC9B,OAAO,EAAE,KAAK;CACf;IACC,MAAM,OAAO,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,iBAAiB,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,kBAAkB,CAAC;YAC9B,gBAAgB,EAAE,OAAO;YACzB,OAAO;YACP,GAAG;YACH,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,OAAO,EACP,WAAW,EACX,OAAO,GAAG,OAAO,EAAE,EACnB,kBAAkB,GAAG,EAAE,SAAS,EAAE,GAQnC;IACC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,OAAO,MAAM,kBAAkB,CAAC,SAAS,CAAC;QACxC,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,iBAAiB;QAC5B,WAAW;QACX,OAAO;QACP,kBAAkB,EAAE,CAAC,gBAAgB,CAAC;KACvC,CAAC,CAAC;AACL,CAAC"}

package/docs/architecture.md

@@ -30,6 +30,7 @@ The host-native Okstra lead owns judgment policy and worker orchestration. `okst
 - [What okstra does](#what-okstra-does)
 - [Runtime assets vs support assets](#runtime-assets-vs-support-assets)
 - [Architecture: python authority + thin callers](#architecture-python-authority--thin-callers)
+  - [JSON ownership and model-facing projections](#json-ownership-and-model-facing-projections)
 - [Host runtime execution behavior](#host-runtime-execution-behavior)
 - [Lead prompt contract](#lead-prompt-contract)
 - [Required team contract](#required-team-contract)
@@ -189,6 +190,16 @@ okstra's prepare stage follows an on-disk authority + single Python entry-point
 └────────────────────────────────────────────────────────────────┘
 ```
 
+### JSON ownership and model-facing projections
+
+Project-owned JSON is confined to `<PROJECT_ROOT>/.okstra/`; global indexes and installation metadata remain under `~/.okstra/`. An owned object is read through `okstra_ctl.json_boundary.load_owned_object`, which rejects missing files, invalid UTF-8, non-standard numeric constants, non-object top levels, schema failures, and cross-field failures. The boundary census in `tests/contract/test_json_boundary_census.py` rejects direct JSON parsing and generic atomic-write clones outside the dedicated boundary modules.
+
+Owned-object writes validate the complete replacement value before publication. `write_owned_object_atomic` writes a temporary sibling, flushes and synchronizes the file, and uses atomic replace so a failed validation or partial write leaves the prior artifact in place. JSON Lines files use the dedicated `okstra_ctl.jsonl` append or rewrite operations because an append-only ledger has a different transaction contract from a replaced object.
+
+External JSON enters only through a purpose-specific adapter that validates its producer lane and path policy. The supported exceptions are user-supplied files outside `.okstra`, worker result lanes, Claude Code configuration, external-tool output inside its workspace, legacy error sidecars, and convergence results beside their state file. The sealed `ExternalJsonSource` type prevents a caller from granting itself a generic exception.
+
+Model callers receive fixed text projections instead of parsing owned objects. `okstra model-io` owns inspect projections, and `okstra preflight` renders named success or failure lines by default. A failure projection includes its stage, observed reason, and recovery action. Automation can request the unchanged preflight object with `--machine`; `--json` remains a deprecated one-release alias. A model-facing caller should rerun the named recovery action and then rerun the text command rather than opening the JSON artifact directly.
+
 ### State authority on disk
 
 Task identity, paths, and workflow state are not stored in per-process environment variables. Every reader recalculates them from the following files:
@@ -736,8 +747,8 @@ The latest final report opens in `$EDITOR`, and after saving, the same phase rer
 The default for an `implementation-planning` clarification rerun is **full re-verification**. However, if an answer has only local impact and the code is unchanged, the lead re-verifies only the downstream closure of affected stages and carries forward the other stages' plan-item verdicts from the previous run. The decision is split between deterministic CLI logic and lead judgment.
 
 - **C1 (CLI decision, deterministic)**: The `executorWorktree.baseRef` in the previous run's `state/active-run-context-implementation-planning-<prev-seq>.json` must match the current run's base-ref SHA. If they differ, the code changed, so the result is immediately `full`.
-- **C2 (lead judgment)**: The set of Stage Map stage numbers affected by the answer. Never include a number not in the Stage Map. If the mapping is uncertain or the answer reverses the selected Option/approach, pass an **empty set** and fall back to `full`.
-- **Closure cutoff**: `okstra incremental-scope` calculates the `downstream_stage_closure` of affected stages in the `implementationPlanning.stageMap` dependency graph. If its size is **more than half** of all stages, the result is `full`; otherwise it outputs `{mode, reverify_stages, carry_stages, reason}` JSON.
+- **C2 (lead judgment)**: The set of Stage Map stage numbers affected by the answer. Never include a number not in the Stage Map. An answered `C-NNN` that traces to no stage is `mode: unresolved`, not full — ask the user for those stage numbers (`--impacted`) rather than widening the whole re-run. If the answer reverses the selected Option, Stage Map, or approach, pass `--full-reason`; that is the only structural path that still forces `full`.
+- **Closure cutoff**: `okstra incremental-scope` calculates the `downstream_stage_closure` of affected stages in the `implementationPlanning.stageMap` dependency graph. If its size is **more than half** of all stages, the result is `full`; otherwise it outputs `{mode, reverify_stages, carry_stages, reason}` JSON. When the wizard pin is `auto` and the CLI returns `mode == "incremental"`, the lead must not upgrade to full.
 
 ```bash
 okstra incremental-scope --prev-data <prev data.json> --cur-base-sha <sha> --prev-base-sha <sha> --impacted 2,3

package/docs/cli.md

@@ -292,7 +292,7 @@ Pins how much of an `implementation-planning` clarification re-run is verified a
   - `full` — re-verify every stage. The lead still records the decision, passing `--full-reason "user requested full re-verification"`.
   - a stage-number list such as `2,3` — the named stages enter the lead's `--impacted` set, unioned with whatever it resolves itself. The CLI's dependency closure and cutoff still apply on top, so a wide enough pin correctly resolves to full.
 - Requires `--clarification-response`, and only `--task-type implementation-planning` accepts a non-empty value. Without a carried report there is no prior Stage Map to narrow against.
-- The wizard asks for this **only when the re-run is narrowable** — that is, when every answered `C-NNN` traces back to a stage in the prior report. When one does not, full is already fixed and the confirmation block's `reverify-scope` line names the unlinked id instead of offering a choice that cannot change the outcome. Direct stage input is validated against the prior report's Stage Map, so a number that plan never had is refused at the prompt.
+- The wizard asks for this when the re-run is narrowable **or** an answered `C-NNN` traces to no stage. An unlinked id does not freeze the run at full: the picker then offers stage numbers (recommended) or full, and omits `auto`. Direct stage input is validated against the prior report's Stage Map, so a number that plan never had is refused at the prompt. Empty input is auto only when every answered id already traces to a stage.
 - The value reaches the lead as the `REVERIFY_SCOPE_MODE` / `REVERIFY_SCOPE_STAGES` tokens the "Clarification Response Carried In" section of the lead prompt reads. It narrows or widens the inputs to `okstra incremental-scope`; it does not bypass that decision.
 
 ### `--resume-clarification`
@@ -442,13 +442,21 @@ The current Claude Code independence boundary covers the external lead prompt an
 Host-runtime readiness is independent of worker selection. When `/okstra-setup`
 creates `<PROJECT_ROOT>/.claude/settings.local.json` in an already-open Claude
 Code session, that session may not have accepted workspace trust yet. The next
-`/okstra-run` preflight reports `runtimeReadiness.checks[id=workspace-trust]`
-and stops before the wizard when trust is required or cannot be verified. The
-user reopens the project, accepts the one Claude Code workspace prompt, and
-reruns the command. This check applies only to a `claude-code` host; `codex`,
+`/okstra-run` preflight stops before the wizard when trust is required or cannot
+be verified. The default `okstra preflight` output is a fixed text projection
+whose first line is `Okstra preflight: ready` or `Okstra preflight: failed`.
+Success names the project ID, project root, runtime, readiness state, and relay
+contract. Each adapter check retains its ID, status, and action as three
+repeated lines. Failure names the stage, observed reason, and recovery action. The user runs
+that recovery and repeats the command. This check applies only to a `claude-code` host; `codex`,
 `antigravity`, and `external` hosts do not inspect Claude Code state, regardless of whether the
 worker roster contains Claude, Codex, or Antigravity.
 
+External automation uses `okstra preflight --machine`, which returns the
+automation JSON contract with its existing exit codes. `--json` is a deprecated
+one-release alias for `--machine`. Model-facing skills use the default text
+projection and do not parse the machine response.
+
 ### Runtime auto-detection (`auto`)
 
 `okstra run` defaults to `auto`. `src/lib/host-registry-client.mts` asks the Python host registry to resolve explicit IDs and aliases, the `OKSTRA_RUNTIME_HOST` environment declaration, Claude Code skill handoff, or the external tmux claim. It fails fast when no adapter claims the session. Installed CLI presence alone never selects a host.
@@ -693,6 +701,7 @@ Disables the Phase 6 plan-body verification round for the `implementation-planni
 
 - **Enabled (default)**: Immediately after the report-writer worker drafts its narrative in Phase 6, the lead extracts the synthesized plan into `P-*` items and dispatches them for reverification to every analyzer worker: `claude`, `codex`, and opted-in `antigravity`. A selected-direction plan uses `P-Dir-1` plus its step, dependency, validation, rollback, requirement, preparation, and variation items. A legacy candidate plan retains `P-Opt-*`. Worker verdicts (`AGREE` / `DISAGREE(a-e)` / `SUPPLEMENT`) are aggregated into one of four gate results: `passed`, `passed-with-dissent`, `blocked-by-disagreement`, or `aborted-non-result`. The approval control is available only for `passed` or `passed-with-dissent`. Items with majority DISAGREE become rows with `Blocks=approval` in `## 1. Clarification Items`. There is no automatic revision; the user answers and resumes the same phase.
 - **Disabled (with `--no-plan-verification`)**: The entire Phase 6 substep is skipped and the Approval marker is always rendered at the top of the final report, matching legacy behavior. This is a fast-iteration opt-out and is not recommended for a handoff-ready plan.
+- **Advisory auto-path (not this flag)**: when `designPreparation.mode` is `no-design-inputs` and the Stage Map has exactly one row, `okstra plan-items prepare` sets `convergence.planBodyVerification.gating=false`. Extraction and one verification round still run; the self-fix loop and a sweep batch do not. Two-or-more stages, a PREP item, or non-empty design-preparation items keep `gating=true`.
 - The flag records `false` in the manifest at `convergence.planBodyVerification.enabled`. The resume command must include the same flag to preserve behavior; `_canonical_argv` guarantees faithful emission on resume.
 - For the detailed round protocol, verdict semantics, and state-file schema, see the "Plan-body verification mode (implementation-planning only)" section of `prompts/lead/convergence.md`.
 
@@ -795,7 +804,7 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra model default set\|unset <role> ... --scope project\|global [--cwd <dir>]` | Atomically write or remove `modelDefaults` for one canonical role |
 | `okstra setup --project-id <id>` | Create or update `.okstra/project.json` in the current project |
 | `okstra check-project [--json]` | Verify that the current project is registered |
-| `okstra preflight [--runtime <name>] [--cwd <dir>] [--json]` | Single skill-preflight call combining `ensure-installed`, with silent reinstall when stale, `check-project`, and host-specific `runtimeReadiness` into one JSON response. A `claude-code` host checks project workspace trust. A `codex` current-session host verifies write access to `~/.okstra/worktrees/registry.lock`; a sandbox denial blocks before the wizard with the `switch-codex-to-full-access-and-rerun` action. `antigravity` and `external` hosts return ready without reading Claude Code state. Step 0 of every project-scoped skill converges on this command |
+| `okstra preflight [--runtime <name>] [--cwd <dir>] [--machine]` | Single skill-preflight call combining `ensure-installed`, with silent reinstall when stale, `check-project`, and host-specific `runtimeReadiness`. It defaults to a fixed text projection. `--machine` returns the automation JSON contract, and `--json` is a deprecated one-release alias. A `claude-code` host checks project workspace trust. A `codex` current-session host verifies write access to `~/.okstra/worktrees/registry.lock`; a sandbox denial blocks before the wizard with the `switch-codex-to-full-access-and-rerun` action. `antigravity` and `external` hosts return ready without reading Claude Code state. Step 0 of every project-scoped skill converges on this command |
 | `okstra convergence seed --groups <path> --work-state <path> --final-state <path> --migration-dir <dir> [--restart-from-round0]` | Create, resume, reuse, or explicitly recover deterministic convergence state |
 | `okstra convergence plan-round --work-state <path> --plan <path>` | Persist the next roster-aware dispatch plan without mutating working state |
 | `okstra convergence collect-results --plan <round-plan.json> --mode <adversarial\|collaborative> --result <worker>=<path>… --dispatch <worker>=<status>:<durationMs>… --output <round-results.json>` | Read one round's worker responses into the `apply-round --results` shape. `--mode` picks the verdict vocabulary — the adversarial prompt answers `REFUTED` / `SURVIVES` / `SURVIVES-WITH-CAVEAT` / `UNVERIFIABLE`, which this maps to `disagree` / `agree` / `supplement` / `unverifiable`, and copies `**Basis**` into `disagreeBasis`. `--dispatch` supplies the terminal status and duration, which live in the dispatch rather than the response; a worker that never returned gets a `--dispatch` and no `--result`. Exits 2 on a dispatched finding with no verdict, a verdict for a finding the plan did not dispatch to that worker, a planned worker with no recorded outcome, or a vote with no explanation |
@@ -807,26 +816,33 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra plan-items extract (--narrative <report-narrative.md>\|--data <historical-data.json>) --output <items.json>` | Deterministically extract the complete implementation-planning `P-*` queue. Contract v3 reads the report-writer narrative before publication; `--data` is the historical v2 reader. |
 | `okstra plan-items validate (--narrative <report-narrative.md>\|--data <historical-data.json>) --items <items.json>` | Require the persisted `P-*` queue to match a fresh deterministic extraction exactly. |
 | `okstra plan-items derivations --data <data.json> --response <user-response sidecar> [--clarification C-NNN]` | List the plan statements an answered clarification may have falsified. Extracts the symbols, paths, and ids the answer names (backticked spans plus `R-001` / `DEV-10174`-style ids) and reports every string in the plan body that mentions one, as a JSON pointer plus excerpt. Advisory: it says where a decision's subject is mentioned, never which mentions are now wrong — the supersession rule (`prompts/profiles/_common-contract.md`) requires the author to enumerate before editing, and this supplies the enumeration |
+| `okstra plan-items <prepare\|prompt\|validate-prepared> --run-manifest <path> …` | Bind the implementation-planning verification queue to the run manifest. `prepare` extracts the exact queue from `--narrative` and, when `designPreparation.mode` is `no-design-inputs` and the Stage Map has one row, flips `convergence.planBodyVerification.gating` to `false` (stdout `Gating`). `prompt` emits its fixed lossless view; `validate-prepared` proves the prepared queue still matches the narrative. Python resolves the convergence-owned state path, so model callers never choose it. |
 | `okstra plan-items seed --narrative <report-narrative.md> --state <plan-body-verification.json>` | Create the convergence-owned `planBodyVerification.planItems[]` rows every verdict lands in, from the same deterministic extraction `extract` uses. The historical v2 form is `--data <data.json>`. Idempotent by id: an existing row keeps its verdicts and carried fields. Reports `seeded` / `existing` counts. |
-| `okstra plan-items collect-verdicts --result <worker-id>=<path>… --items <items.json> --output <verdicts.json>` | Read one plan-verify round's worker responses into a verdicts envelope, using the `### <item-id>` / `**Verdict**` block shape fixed by `prompts/lead/plan-body-verification.md`. Exits 2 on an assigned item the worker left unanswered, a verdict for an item outside the persisted queue, a `DISAGREE` with no breakage kind, or a `DISAGREE` without a fixability value — every failure mode a per-round regex drops silently |
-| `okstra plan-items apply-verdicts --state <plan-body-verification.json> --verdicts <verdicts.json> --round <N>` | Overwrite the convergence-owned `planBodyVerification.planItems[].verdicts` with that envelope. The historical v2 form is `--data <data.json>`. Overwrites rather than merges, because the contract records one round at a time and a merged table lets the previous round's votes keep voting. Exits 2 when the state carries no row for an incoming item. `--round` stamps the verification round on every written row. `validate-run.py` fails a gate resting on any verdict whose round is at or before `selfFixRoundsApplied`. |
+| `okstra plan-items apply-verdicts --state <plan-body-verification.json> --result <worker-id>=<result.md>… --round <N>` | Read each worker's Markdown verdict directly, validate every current `P-*` id, reject duplicate worker submissions, and overwrite that round's stored verdicts. The historical `--verdicts <file>` form remains automation compatibility only. |
+| `okstra plan-items complete-round --state <plan-body-verification.json> --run-manifest <current-run-manifest.json> --round <N> [--self-fix-note <item-id>=<markdown-file>]… [--self-fix-group <cause-file>=<item-id>[,<item-id>...]]… [--self-fix-stop-reason <all-resolved\|no-progress\|max-rounds-reached>]` | After `plan-verify` succeeds, atomically derive and record the round's per-item votes, gate result, participant counts from the actual assigned roster, immutable completion time, convergence history, and optional self-fix notes/groups read from Markdown files. Models do not write the state JSON. Stdout also carries `nextDispatch`. |
+| `okstra plan-items next-dispatch --state <plan-body-verification.json> [--run-manifest <path>]` | After `apply-verdicts`, decide whether this round opens a worker batch. `kind: none` — missing-dependency `UNVERIFIABLE` only, no new batch. `kind: worker-correction` — re-prompt only those workers; peers stay idle. `kind: queue-reverify` — unsettled ties, those item ids only. A missing path is never environment-unverifiable. |
+| `okstra plan-items correction-prompt --state <plan-body-verification.json> --run-manifest <path> --worker <id>` | Emit the planning-time environment-gap paragraph, then the assigned queue. The environment exception is first. Exits 2 unless `next-dispatch` named that worker as a blanket-UNVERIFIABLE correction target. |
+| `okstra error-log append-observed --out <errors.jsonl> --task-key <key> --phase <phase> --agent <assigned-worker-id> --agent-role worker --model <model> --error-type tool-failure --command-file <markdown-file> --command-kind <kind> --message-file <markdown-file> [--cause <cause> --evidence-file <kind=file>]…` | Worker-facing typed error recording surface. Python validates and serializes the JSONL record; a worker supplies scalar identity fields plus Markdown files for free-form command, message, and probe content, never a JSON sidecar or JSON argument. `sandbox-denied` requires both `targetProbe` and `controlProbe` evidence files. |
 | `okstra config <get\|set\|unset\|show> [key] [value] [--scope project\|global\|all]` | Manage persistent settings such as `pr-template-path` with atomic JSON writes |
 | `okstra memory <add\|list\|search\|show\|archive>` | Manage global conversation memory in `~/.okstra/memory-book`, a user-home store separate from project `.okstra/` and the CLI basis of the `save this in okstra` natural-language skill |
-| `okstra manager <init\|discover-projects\|new\|task>` | Public CLI for grouping cross-project okstra tasks into manager-owned context. `new project`, `new task-group`, and `new task` create manager plans; `task assign`, `task note`, `task sync`, `task status`, and `task run` manage per-project assignments and snapshots. `new project --project-root` accepts only existing directories and performs setup-equivalent registration only if `.okstra/project.json` is absent. Public documentation uses the full `project-id:task-group:task-id` child task key; when child task IDs differ within the same manager task, select the exact child with `--child-task-id`. `task run` does not execute the child lead directly; it returns `prepared` launch metadata/event and a child launch-context packet as JSON |
-| `okstra rollup [--task-group <group>] [--project-root <dir>] [--cwd <dir>]` | Read-only backend for the okstra-rollup skill. For every catalog task, or one task group, it emits JSON with per-task run counts, raw duration in ms, error counts, latest report paths, group totals, and status/category/phase distributions. Omitting `--task-group` targets the whole project catalog. The caller skill formats raw ms as HH:MM:SS and synthesizes report prose. Use the `okstra inspect` family for a single-task drill-down |
-| `okstra usage-report [--days <positive-int>] [--project-root <dir>] [--cwd <dir>] [--json]` | Read-only backend for the okstra-usage skill. Defaults to the whole current project's last 30 days and emits task-type run coverage, raw/billable tokens, known USD cost, CPU-sum milliseconds, wall-clock milliseconds, unavailable reason counts, and unmatched pricing models |
+| `okstra model-io active-context-input --project-root <dir> --run-manifest <path>` | Resolve the prior implementation-planning active context only through the current project and run authority, then emit fixed fields such as the executor base ref. Caller-supplied active-context paths are not accepted. |
+| `okstra report-translate <source\|write\|check-data> --run-manifest <path> …` | Resolve the report data and translation sidecar from the run manifest. `source` emits a source digest with the fixed translation queue; `write` requires that digest and rejects a stale report; `check-data` verifies the derived sidecar. Models never choose the data or sidecar path. |
+| `okstra convergence prepare-groups --run-manifest <path> --input <grouping.md>` | Parse fixed grouping Markdown, validate distinct per-worker evidence and group semantics against the run authority, then publish the schema-valid groups artifact at the run-owned path. |
+| `okstra manager <init\|discover-projects\|new\|task> [--json]` | Public CLI for grouping cross-project okstra tasks into manager-owned context. The default is purpose-specific fixed text for model use; `--json` preserves the machine contract and exit codes. `new project --project-root` accepts only existing directories and performs setup-equivalent registration only if `.okstra/project.json` is absent. |
+| `okstra rollup [--task-group <group>] [--project-root <dir>] [--cwd <dir>] [--text\|--json]` | Read-only backend for the okstra-rollup skill. `--text` emits ordered fixed labels for model use. The default and `--json` preserve the full machine JSON contract and exit codes. Omitting `--task-group` targets the whole project catalog. |
+| `okstra usage-report [--days <positive-int>] [--project-root <dir>] [--cwd <dir>] [--text\|--json]` | Read-only backend for the okstra-usage skill. `--text` emits ordered fixed labels for model use. The default and `--json` preserve the full machine JSON contract and exit codes. Defaults to the current project's last 30 days. |
 | `okstra worker-state transition --team-state <path> --worker <id> --status <in-progress\|completed\|timeout\|error\|not-run> [--reason <text>] [--model <execution-value>]` | Atomically update one persisted worker row. `in-progress` records the authoritative `startedAt` and clears `endedAt`; terminal states record `endedAt`; `timeout`, `error`, and `not-run` require a reason. Dispatch adapters use this same transition path, so CLI-backed and in-process orchestration share the status timestamp contract |
 | `okstra worker-liveness [--team-state <path> --worker <id>]… [--max-idle <seconds>] [--launch-grace <seconds>] [--stall-confirm <seconds>] [--json]` | Judge whether pending workers are still alive so the lead's poll ends a stalled wait early instead of paying the full deadline. The selector repeats; each `--team-state` must have a paired `--worker`. The worker row's `livenessMode` picks the probe: `audit-heartbeat` reads its `auditSidecarPath` and reports `stalled` when the `- PROGRESS:` heartbeat is past the idle budget; `wrapper-status` reads its `promptPath` and reports `did-not-launch` when neither the wrapper `.log` nor `.status.json` appears. Both graces start at the persisted `startedAt`, never at an artifact mtime — the audit sidecar is reused on re-dispatch, so a heartbeat older than this dispatch counts as no signal yet rather than a stall. A heartbeat budget breach is confirmed before it is reported: the probe re-reads the sidecar after `--stall-confirm` seconds (default: half that stage's budget; `0` disables) and reports `stalled` only when the newest heartbeat has not advanced, so a worker inside one long uninterruptible tool call is not judged dead for being slow. Healthy probes report `live`. It only judges—it never kills or re-dispatches. Exit 1 on an unhealthy verdict, so a poll loop can branch without parsing JSON. The heartbeat line shape and budget come from the `okstra_ctl.worker_heartbeat` SSOT shared with the Phase 7 audit (`validators/validate_session_conformance.py`) |
 | `okstra worker-audit-check --run-dir <runs/<task-type>/> --task-type <type> --seq <nnn> [--worker <id>]` | Apply the Phase 7 worker audit-sidecar rules mid-run, while the worker session is still alive. For each of this run's `worker-results/<worker>-<task-type>-<seq>.md` it checks that the file carries no `## 0. Reading Confirmation` heading, that the matching audit sidecar exists, and — for prompts carrying the required-v1 evidence-ledger marker — that every backticked `path:line` citation has an Evidence read row in that sidecar. `--worker` scopes it to the role that just returned. Emits `{ok, failures[]}` and exits 2 when `failures[]` is non-empty. The rules come from the `okstra_ctl.worker_audit_ledger` SSOT shared with `validate-run.py`, so an early pass and the Phase 7 pass cannot disagree. Run it right after collecting a result: the same failure at Phase 7 leaves only a retroactive edit, which breaks the audit chain, or a failed run |
 | `okstra log-report [--project-root <dir>] [--cwd <dir>] [--top <N>] [--json]` | Read-only inventory of wrapper transcript `.log` files and their sibling prompt `.md` files. Each ranked entry preserves `path` / `sizeBytes` for compatibility and also reports `transcriptPath`, `transcriptBytes`, `promptPath`, `promptBytes`, and `transcriptToPromptRatio`; totals distinguish prompt bytes from transcript bytes and count paired files. Ranking remains transcript-size descending |
 | `okstra recap <assemble\|record\|note> <task-root\|task-key> …` | Backend for the okstra-inspect `recap` facet. `assemble` is read-only and prints a JSON summary of phase transitions across a task's runs. `record --kind <summary\|qa> --mode <artifact\|code> --answer <text> [--question <text>] [--citation <path:line> …]` appends one line to `<task-root>/recap/recap-log.jsonl` and never mutates other artifacts. `note --kind <verification-evidence\|decision-draft\|analysis-note> --slug <topic> --purpose <text> --scope-note <text> (--body <markdown>\|--body-file <path>)` writes an agent-authored note to `<task-root>/notes/` and prints its path plus the `--clarification-response` argument for feeding it into a later run |
-| `okstra user-response <list\|show\|write> …` | Backend for the `/okstra-user-response` skill: answer a task's open clarification questions in-session and write the response sidecar. `list --home <dir> --project <id> [--limit <n>]` finds reports with open questions; `show --report <md>` reads one report's questions; `write --report <md> --answers <json> [--plan-decision <json>] [--task-key <key>]` writes the sidecar; the plan decision carries `status` (`approved` / `revision-requested` / `rejected`) and a `reason` that is mandatory for the latter two. A selected structured option preserves its exact gate `disposition` (`select`, `accept-risk`, `request-revision`, or `reject`); direct free text uses `answer`, and a request to re-ask uses `reframe`. A `reframe` is carried into the next run as a re-scoped brief. JSON output; exit 0 ok / 1 error |
-| `okstra pr <template\|branches\|gen> …` | Backend for the okstra-pr-gen skill. Git-only—no project registration required. `template list\|show <name\|default>\|add --name <name> (--content <text>\|--file <path>)\|path` manages PR body templates under `~/.okstra/template/pr/` (bundled fallback `src/commands/pr/default.md`); `branches` recommends a base branch; `gen --base <ref> [--template <name\|default>]` emits a JSON bundle of the template plus `<base>..HEAD` commits and `<base>...HEAD` diffstat |
+| `okstra user-response <list-view\|show-view\|begin\|answer\|plan-decision\|legacy-report-authoring\|finalize> …` | Backend for the `/okstra-user-response` skill. `list-view` and `show-view --report <md\|data.json> --project-root <dir>` are fixed-text model views; `show-view` validates that the report belongs to the explicit project root. The legacy `list` and `show` JSON reads retain their automation-compatible fields. `begin --report <md\|data.json> --task-key <key>` returns an opaque transaction id. A predefined clarification choice uses `answer --transaction <id> --clarification-id <C-NNN> --kind <kind> --option-number <N>`; Python resolves the answer, disposition, reach, and scope effects from the validated report. Direct input instead uses `--disposition <answer\|reframe> --value-file <md> [--rationale-file <md>]`. Every value, rationale, and reason file must be a regular file under `<PROJECT_ROOT>/.okstra/tmp/user-response/`; external paths and symbolic links are rejected. `plan-decision` accepts `approved`, `revision-requested`, or `rejected`, validates any `--implementation-option` against the report candidates, and requires `--reason-file` for the latter two statuses. `legacy-report-authoring` is restricted to report contract 2.0. `finalize` validates the complete existing sidecar before a lossless merge, uses compare-and-swap under a run-local lock, and atomically publishes only the user-owned sidecar; exit 0 ok / 1 error. |
+| `okstra pr <template\|branches\|gen> … [--json]` | Backend for the okstra-pr-gen skill. Git-only—no project registration required. `template list\|show <name\|default>\|add --name <name> (--content <text>\|--file <path>)\|path` manages PR body templates under `~/.okstra/template/pr/` (bundled fallback `src/commands/pr/default.md`); `branches` recommends a base branch; `gen --base <ref> [--template <name\|default>]` emits fixed `Base`, `Current branch`, `Template name`, `Commits`, `Diff stat`, and `Template` sections by default. `--json` preserves the machine bundle for automation. |
 | `okstra migrate [--apply] [--cwd <dir>] [--quiet]` | One-time migration of the project artifact root from `.project-docs/okstra/` to `.okstra/`. It is a dry run by default; `--apply` performs the move with `git mv` in a Git worktree, removes an empty `.project-docs/`, and synchronizes the `<PROJECT>/CLAUDE.md` import line, `.gitignore`, the project's rows in `~/.okstra/{recent,active}.jsonl`, and `~/.okstra/worktrees/registry.json`. It exits 1 if `.okstra/` already exists or the legacy directory is absent. Scheduled for removal by the end of v0.x |
 | `okstra task-list [--project-root <path>]` | Combine `list_project_tasks` and `read_latest_task` into JSON containing the task catalog and latest task |
 | `okstra task-show <task-key> [--project-root <path>]` | Summarize workflow, phase, status, and artifacts from the Task Read-Side Snapshot |
 | `okstra stage-map <task-key> [--cwd <dir>\|--project <dir>]` | Dump the task's implementation-planning Stage Map as JSON: `{ ok, taskKey, taskRoot, state, sourcePlanPath, stages:[{stage_number,title,depends_on,step_count}], doneStages:[int] }`. `state` is `ready` for one resolved source and `missing` when no Stage Map exists; corrupt or conflicting sources return structured non-zero errors instead of silently selecting another report. `doneStages` is read from the implementation-planning stage consumer state (with carry recovery). This is the read-side source `/okstra-schedule-gen [task-group]` uses to derive selectable unfinished stages and their completed dependency closure |
-| `okstra incremental-scope <args…>` | Decide re-verify vs carry-forward scope for an `implementation-planning` clarification re-run. Thin shim into `scripts/okstra_ctl/incremental_scope.py` (deterministic pure function): it reads the dependency graph from the prior run `data.json`'s `implementationPlanning.stageMap` and returns `mode:"incremental"` only when the base-ref SHA is unchanged and the affected stages' `downstream_stage_closure` covers at most half of all stages; otherwise it signals a full re-run. Used to bound the cost of a clarification re-run. `--preview --prev-data <path> --answered-clarifications <csv>` runs the link half alone — no base SHA, no side effects — and prints `{wouldForceFull, unlinkedIds, reason}`, so the cost of the next re-run is visible before `render-bundle` fixes a base commit |
+| `okstra incremental-scope <args…>` | Decide re-verify vs carry-forward scope for an `implementation-planning` clarification re-run. Thin shim into `scripts/okstra_ctl/incremental_scope.py` (deterministic pure function): it reads the dependency graph from the prior run `data.json`'s `implementationPlanning.stageMap` and returns `mode:"incremental"` only when the base-ref SHA is unchanged and the affected stages' `downstream_stage_closure` covers at most half of all stages; `--full-reason` (selected option / Stage Map / approach) still forces `mode:"full"`. An answered `C-NNN` that traces to no stage returns `mode:"unresolved"` rather than full — pass `--impacted` with the stage numbers or `--full-reason`. `--preview --prev-data <path> --answered-clarifications <csv>` runs the link half alone — no base SHA, no side effects — and prints `{wouldForceFull, unlinkedIds, reason}`; unlinked ids set `wouldForceFull: false` and fill `unlinkedIds` |
 | `okstra incremental-carry <args…>` | Merge carried-forward plan-item verdicts into an incremental re-run. Contract v3 takes `--prev-data`, `--cur-narrative`, and the convergence-owned `--state`; it verifies carried stage rows and writes only `--out-state`, tagging copied verdicts with `carriedForwardFromSeq`. The historical v2 `--cur-data --out` form remains readable. Ownership, scope, item, or schema drift raises `CarryError` and forces a full fallback. |
 | `okstra code-review target --task-key <k> --stage <N> [--project-root <dir>] [--cwd <dir>] [--json]` / `okstra code-review target --branch <name> [--base <ref>] [--date <YYYY-MM-DD>] [--project-root <dir>] [--cwd <dir>] [--json]` | Resolve what a code review reads and where its result file goes. Output is always JSON, so `--json` only makes that explicit. `--project-root` and `--cwd` are shared pre-dispatch arguments and apply to both modes; `--cwd` is only consulted when `--project-root` is absent. Both modes return `{ ok, projectRoot, mode, worktreePath, branch, baseCommit, headCommit, reviewPath, round }`; stage mode additionally returns `taskKey`, `taskRoot`, and `stage`. Stage mode takes the diff base from the `base_ref` recorded on that stage's worktree-registry row when it was provisioned — not from a rule re-applied at review time — and names the result `.okstra/tasks/<task-group>/<task-id>/code-reviews/stage-<NN>.md`, where a re-review of the same stage becomes `-r2`, `-r3`, … (the `round` field). Only a legacy row provisioned before `base_ref` was recorded falls back to re-deriving the base through `stage_targets`, and a failure there is reported as `stage_base_unresolved`. `worktreePath` comes back empty whenever the stage worktree is not usable as a live checkout — the registry row is no longer `active` (whole-task final-verification released it), the row never carried a path, or the recorded directory is gone — and the review then reads the `branch` ref instead. Branch mode uses `--base` when given, otherwise the merge-base with the default branch (`refs/remotes/origin/HEAD`, else `main`/`master`), and names the result `.project-docs/code-reviews/<branch>/<YYYY-MM-DD>-<NN>.md`, where `<NN>` (the `round` field) is the next sequence number for that date — the highest already on disk plus one. Read-only: it resolves paths and creates no directory and no file, so the review directory does not exist until the caller writes the report. Backend for the okstra-code-review skill |
 | `okstra set-work-status <token> <todo\|in-progress\|blocked\|done> [--note <text>] [--task-group <g>] [--project-root <dir>]` | Update user-managed `workStatus` in task-manifest.json, along with `workStatusUpdatedAt` and, when `--note` is supplied, `workStatusNote`. `<token>` is a full task key or bare task ID. It uses the manifest renderer's serialization rules and returns `stage:"ambiguous"` plus `matches[]` when ambiguous |
@@ -840,7 +856,7 @@ The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and
 | `okstra codex-dispatch --project-root <dir> --run-manifest <path> [--workers <csv>] [--dry-run]` | Compatibility alias for `okstra worker-dispatch`; it no longer selects a Codex-only transport-agent path. |
 | `okstra agent-prompt materialize\|verify\|record-dispatch\|link-result\|materialize-result\|complete\|verify-completion` | Internal invocation-contract CLI. `materialize` composes model assignment, functional duty, and task instructions; `verify` rejects identity, path, snapshot, assignment, source, or digest drift. Run-backed calls resolve `assignmentRef` from the manifest, enforce `authorizedPaths`, and reject real-path or symbolic-link escape. `record-dispatch` records a verified host-native specification before dispatch and `link-result` binds the accepted result; one result path belongs to one dispatch, so a corrective round retires the first attempt with `reject-result --dispatch-id <first> --superseded-by <corrective> --reason <text>` before the new link is accepted — the rejected row stays in `agentResultLinks` carrying `supersededBy` and `rejectionReason` rather than being deleted. Standalone calls are identified by `(purpose, invocationId)` under `.okstra/agent-invocations/<purpose>/`; they publish a canonical result envelope and publish the completion marker last. Consumers use only the `returnedBody` from `verify-completion`. Metadata contains exactly `catalogDigest`, `assignmentDigest`, `dutyDigest`, `instructionDigest`, and `promptDigest`; JSON inputs use UTF-8, sorted keys, compact separators, and no non-finite values, while duty files use versioned sorted-name/byte framing. Instruction sources use `{kind: project\|runtime, path: <relative POSIX path>}` and never persist an installed absolute runtime path. A published prompt is immutable, so re-running `materialize` with an edited instruction file fails as `existing_invocation_conflict`; `--replace-undispatched` is the one exit, for a call that failed a pre-dispatch gate and therefore ran nowhere — it covers a differing prompt and a differing metadata alike, since the two are published together and describe one call. It republishes prompt and metadata together, and it is verified rather than trusted — a row in `agentDispatches` or `workerDispatches` naming this `invocationId` refuses the replacement and names the dispatch that used it. |
 | `okstra team dispatch --project-root <dir> --run-manifest <path> [--workers <csv>] [--jobs-file <path>] [--dry-run]` / `okstra team await --project-root <dir> --run-manifest <path> [--json]` / `okstra team teardown --project-root <dir> --run-manifest <path> [--dry-run] [--json]` | Read a `leadRuntime=external` run manifest and dispatch, await, or tear down tmux-pane workers. Default dispatch excludes report writer; Phase 6 selects it explicitly, and mixed analysis/report jobs are rejected. If a tmux pane cannot be created, gracefully degrade to the CLI wrapper and record the fallback in `workerDispatches[].degradedFrom` |
-| `okstra agent-activity append --project-root <dir> --run-manifest <path> --kind <kind> --agent <id> --summary <text> --outcome <outcome> [--plan-item-id <id>]… [--evidence-ref <ref>]… [--command-record <json>]… [--result-path <path>] [--audit-sidecar <path>]` | Append one structured activity to the run manifest's `leadEventsPath`. `kind` accepts `worker-dispatched`, `worker-completed`, `verification-round-completed`, `self-fix-applied`, `user-decision-required`, or `user-decision-evaluated`. `outcome` accepts `pending`, `completed`, `failed`, `blocked`, or `resolved`. Repeated `--command-record` values and `Evidence command` rows from `--audit-sidecar` must contain exactly `command`, `cwd`, `exitCode`, and `outputSummary`; malformed or potentially secret-bearing evidence stops the append. The command requires `activityContractVersion: 1` and returns the assigned `activityId` in JSON. |
+| `okstra agent-activity append --project-root <dir> --run-manifest <path> --kind <kind> --agent <assigned-id> (--summary <text>\|--summary-file <markdown>) --outcome <outcome> [--plan-item-id <current-id>]… [--command <text> --command-cwd <dir> --command-exit-code <n> --command-output-file <markdown>] [--request-ref <returned-ref>]` | Append one structured activity after checking the agent against this run's role assignments and every plan item against its current convergence state. Python returns an `activityRequestRef`; supply only that returned value with `--request-ref` to retry idempotently. A new call without it remains a distinct activity even with identical contents. Legacy JSON command records remain automation compatibility only. |
 | `okstra agent-activity project --project-root <dir> --run-manifest <path> --data <data.json>` | Project this run's canonical activity events into `agentActivity[]`. The command preserves event order, rejects duplicate or decreasing activity IDs, and replaces no other report field. A historical manifest without `activityContractVersion: 1` returns an empty projection and leaves data.json unchanged. Normal Phase 7 execution reaches this behavior through `report-finalize`; use the standalone command only for diagnostics. |
 | `okstra approval-decision <open\|resolve\|carry> --ledger <approval-decisions.json> …` | Write the lead-owned clarification and approval ledger. `open` validates classification-specific dispositions and complete option fields, `resolve` requires real `A-NNN` check references, and `carry` keeps prior resolved decisions outside the active clarification list. |
 | `okstra design-snapshot --narrative <report-narrative.md> --output <design-preparation.json>` | Detect implementation-planning design surfaces and write the detector-owned snapshot consumed by final report assembly. |

package/docs/container.md

@@ -21,14 +21,14 @@
 ## Command format
 
 ```
-okstra container <up|status|logs|stop-watcher|down> --project-root <PATH> --task-key <KEY> [options]
+okstra container <up|status|logs|stop-watcher|down> --project-root <PATH> --task-key <KEY> [--text] [options]
 ```
 
 | sub-command | Behavior | Additional options |
 |---|---|---|
 | `up` | Verify stage integration → validate `docker-compose.yml` → compose env override → `docker compose -p <project> up -d` → poll health checks → start a tail/watcher pane for each container | — |
 | `status` | Show the live container group status by querying Docker labels | — |
-| `logs` | Report `watchersDir` and registered watcher entries as JSON; it does not stream Docker container logs | `--service <NAME>` (filters watcher metadata; all registered watchers when omitted) |
+| `logs` | Report the watcher directory and registered watcher entries; it does not stream Docker container logs | `--service <NAME>` (filters watcher metadata; all registered watchers when omitted) |
 | `stop-watcher` | Stop the watcher panes for the task (containers remain running) | — |
 | `down` | Tear down the container group and stop attached watchers | `--all` |
 
@@ -45,6 +45,8 @@ Identifier of the task to deploy, in the form `<project-id>:<task-group>:<task-i
 
 The actual `logs` output from `logs_container_group()` contains `watchersDir` and registered watcher entries in `watchers`. It does not run `docker compose logs` and does not stream Docker container logs. Inspect each watcher's `findings_path` and the files beneath `watchersDir` for monitoring results.
 
+`--text` emits command-specific fixed labels for model-facing skills. Without it, the command preserves the full machine JSON bytes and exit codes.
+
 ### `--all` (`down` only)
 Clean up **all** task container groups and watchers within the current project root's `.okstra/` scope. The boundary is limited to the `<project-root>/.okstra/` prefix, so panes belonging to **other projects** in concurrent sessions are never touched. Without `--all`, a single `down` cleans up exactly the panes for the specified task.
 
@@ -99,13 +101,13 @@ container/
 
 ## Exit behavior/output
 
-Each sub-command writes its result to stdout as JSON and returns exit code 0. Validation failures (missing configuration files, merge conflicts, health check timeouts, and so on) terminate abnormally with a `PrepareError` that identifies what went wrong.
+Each sub-command returns exit code 0 on success. `--text` writes its command-specific fixed labels for model callers; the default writes the full machine JSON contract. Validation failures (missing configuration files, merge conflicts, health check timeouts, and so on) terminate abnormally with a `PrepareError` that identifies what went wrong.
 
 ## Usage examples
 
 ```bash
 # Deploy and start monitoring
-okstra container up --project-root /path/to/proj --task-key proj:auth:login-fix
+okstra container up --project-root /path/to/proj --task-key proj:auth:login-fix --text
 
 # Status
 okstra container status --project-root /path/to/proj --task-key proj:auth:login-fix

package/docs/contributor-change-matrix.md

@@ -11,6 +11,6 @@ Use this matrix before changing high-risk repo contracts. Update the source file
 | Add phase | `scripts/okstra_ctl/workflow.py`, `prompts/profiles/`, `validators/`, `tests/` | workflow and validation contract tests |
 | Change worker roster | `prompts/profiles/*.md`, `scripts/okstra_ctl/workers.py`, `tests/contract/test_repo_contracts.py` | worker roster contract tests |
 | Change report section | `schemas/final-report-v2.0.schema.json`, `templates/reports/final-report-v2.template.md`, `scripts/okstra_ctl/render_final_report.py`, `validators/validate-run.py` | final-report schema, renderer, and validator tests |
-| Maintain Korean review mirrors | `config/korean-sources.json`, `tools/korean-sources/` (`lifecycle.mjs` plus its `lifecycle-*.mjs` support modules, CLI/hooks adapters, and shared workflow), `.agents/skills/sync-korean-sources/`, `.claude/skills/sync-korean-sources/` | `tests-js/korean-sources-*.test.mjs` (`lifecycle`, `cli`, `hooks`, and `skill`) |
+| Maintain Korean review mirrors | `config/korean-sources.json`, `tools/korean-sources/` (`cli.mjs`, `baseline.mjs`, `config.mjs`, `markdown.mjs`, and the shared workflow), `.agents/skills/sync-korean-sources/`, `.claude/skills/sync-korean-sources/` | `tests-js/korean-sources-*.test.mjs` (`cli`, `config`, `markdown`, and `skill`) |
 
 `runtime/` is build output. Never edit it directly; change source files and rebuild the runtime payload instead.

package/docs/for-ai/README.md

@@ -32,13 +32,13 @@ This directory is a compressed manual for an AI to quickly select and precisely
 
 ## Shared Execution Rules
 
-1. Run commands as separate Bash calls whenever the source skill requires it. In particular, do not wrap `okstra preflight --runtime claude-code --json`, `okstra wizard ...`, or `okstra container ...` calls in `&&`, `||`, `$(...)`, a leading variable assignment, `eval`, or `export`.
+1. Run commands as separate Bash calls whenever the source skill requires it. In particular, do not wrap `okstra preflight --runtime claude-code`, `okstra wizard ...`, or `okstra container ...` calls in `&&`, `||`, `$(...)`, a leading variable assignment, `eval`, or `export`.
 2. An `okstra <subcmd>` call bootstraps its own Python path. Unless a skill states otherwise, do not build `okstra paths --shell` or `export PYTHONPATH=...`.
 3. Most skills except `okstra-setup` do not use an `npx` fallback. If the runtime is missing, tell the user to run `/okstra-setup` and stop. But if it fails with `unknown command: <cmd>`, the `okstra` binary on PATH is older than the skill — point the user to `npm i -g okstra@latest` rather than `/okstra-setup`, and stop.
 4. Project artifacts go under `<PROJECT_ROOT>/.okstra/` by default. The exception is `okstra-memory`, which uses the global user memory `~/.okstra/memory-book/`.
 5. `runtime/` is build output. When fixing a source skill or template, edit the source under `skills/`, `templates/`, `validators/`, `scripts/`, `src/` and apply it via a build.
 6. Do not guess the contents of a tracker, URL, file, report, log, zip, template, or validator. Use only what you have confirmed by reading or running with a tool.
-7. Read-side skills also produce some artifacts. `okstra-inspect errors` produces an error report Markdown and `okstra-inspect error-zip` produces an anonymized zip. Even in these cases, keep the CLI stdout JSON as the source of truth.
+7. Read-side skills also produce some artifacts. `okstra-inspect errors` produces an error report Markdown and `okstra-inspect error-zip` produces an anonymized zip. Even in these cases, keep the purpose-specific fixed CLI fields as the source of truth.
 
 ## The Order the AI Reads In
 

package/docs/for-ai/skills/okstra-brief-gen.md

@@ -43,10 +43,12 @@ Output location:
 Run as a single call.
 
 ```bash
-okstra preflight --runtime claude-code --json
+okstra preflight --runtime claude-code
 ```
 
-If runtime or project setup is missing, guide the user to `/okstra-setup` and stop. This skill does not use an `npx` fallback.
+On `Okstra preflight: ready`, carry the fixed `Project root` line. On
+`Okstra preflight: failed`, show `Reason` and `Recovery`, then stop. This skill
+does not use an `npx` fallback.
 
 ## Input collection
 
@@ -107,7 +109,7 @@ Processing:
 
 ## task-group and filename
 
-For task-group, show existing-group recommendations first. Call `okstra task-list`, extract the distinct `taskGroup` values from `tasks[]` in most-recent order, and offer the 2 most recent + enter-directly. In tracker recursion, task-group must be obtained before building any child path.
+For task-group, show existing-group recommendations first. Call `okstra task-list --text`, read the distinct fixed `Task group` values in `Updated at` order, and offer the 2 most recent + enter-directly. If `Status` is `error`, report `Failure stage` and `Failure reason`, then stop. If `Task count` is `0`, ask for free text. In tracker recursion, task-group must be obtained before building any child path.
 
 File path rule:
 

package/docs/for-ai/skills/okstra-code-review.md

@@ -34,15 +34,15 @@ The branch-mode result path is the one deliberate exception to the `.okstra/`-on
 A single Bash call with the literal `okstra` token (not wrapped in `if` / `eval` / `export` / `$(...)` / `VAR=` / `||` / `&&` / `npx`):
 
 ```bash
-okstra preflight --runtime claude-code --json
+okstra preflight --runtime claude-code
 ```
 
-`ok:true` → carry `projectRoot` as a literal. `ok:false` → retry the intended directory with `--cwd <dir>`; if that also fails, point at `/okstra-setup` and stop. `unknown command: preflight` or `unknown command: code-review` means the `okstra` binary predates the skill — `npm i -g okstra@latest`, then stop.
+`Okstra preflight: ready` → carry `Project root` as a literal. `Okstra preflight: failed` → retry the intended directory with `--cwd <dir>`; if that also fails, show `Reason` and `Recovery`, then stop. `unknown command: preflight` or `unknown command: code-review` means the `okstra` binary predates the skill — `npm i -g okstra@latest`, then stop.
 
 ## Flow
 
-1. **Resolve the target.** Stage mode: `okstra resolve-task-key <token> --project-root <projectRoot> --json`, then `okstra stage-map <taskKey> --project <projectRoot> --json`, and pick the stage with a 3-option picker (recommendations first, `Enter directly` last). Branch mode: pick the branch the same way; a detached HEAD is refused.
-2. **Call the target CLI**: `okstra code-review target --task-key <k> --stage <N> --project-root <dir> --json`, or `okstra code-review target --branch <name> [--base <ref>] --project-root <dir> --json`. It returns `{ok, projectRoot, mode, worktreePath, branch, baseCommit, headCommit, reviewPath, round}` (stage mode adds `taskKey`, `taskRoot`, `stage`). **Never derive the base** — the CLI owns it, and `baseCommit` may be a ref rather than a commit id, so pass it through verbatim. Run git in `worktreePath` when non-empty, otherwise in `projectRoot` against `branch`.
+1. **Resolve the target.** A full `project-id:task-group:task-id` token is already the key. For a bare token, run `okstra model-io task-selection-input --project-root <projectRoot> --task-ref <token>` and use the fixed `Match count`, `Task`, and `Updated at` rows. Then run `okstra stage-map <taskKey> --project <projectRoot> --text` and pick from the fixed `Stages` and `Done stages` rows with a 3-option picker (recommendations first, `Enter directly` last). Branch mode picks the branch the same way; a detached HEAD is refused.
+2. **Call the target CLI**: `okstra code-review target --task-key <k> --stage <N> --project-root <dir> --text`, or `okstra code-review target --branch <name> [--base <ref>] --project-root <dir> --text`. Carry the returned `Project root`, `Mode`, `Worktree path`, `Branch`, `Base commit`, `Head commit`, `Review path`, and `Round` values; stage mode also carries `Task key`, `Task root`, and `Stage`. Then run `okstra model-io code-review-input --project-root <projectRoot> --base <baseCommit> --head <headCommit>` and pass only that fixed Markdown view to model prompts. **Never derive the base** — the CLI owns it, and `Base commit` may be a ref rather than a commit id, so pass it through verbatim. Run git in `Worktree path` when non-empty, otherwise in `Project root` against `Branch`.
 3. **Show the base and confirm it** with a 3-option picker before censusing anything — the returned `baseCommit` plus `git log -1 --oneline <baseCommit>` first, `Enter directly` last. Only an override calls the target CLI a second time, with `--base <ref>`.
 4. **Census the diff** per `census-rules.md`: four axes (`structural`, `semantic`, `state-and-tests`, `general`), one cell per target per axis — the axis **is** the rule group, never one cell per individual rule. Membership is mechanical; judgment only ever decides a verdict. Route the coding-preflight packs exactly once here (`okstra paths --field home` → `<okstraHome>/prompts/coding-preflight/overview.md`), and fix the calibration path the briefs carry (`~/.claude/skills/okstra-code-review/references/review-calibration.md`). Print every cell table, every exclusion with its reason, the applied packs, and both completion criteria. Never truncate a large census — report the cell count and confirm.
 5. **Materialize and dispatch four reviewers in parallel.** Each reviewer is a separate standalone invocation under `.okstra/agent-invocations/code-review/`. Write `<invocation-id>.instructions.md`, run `okstra agent-prompt materialize --purpose code-review --audience code-reviewer ...`, and verify the returned `metadataPath` before dispatch. A native host call receives the verified prompt body and `hostModelValue`; a deterministic provider process receives the prompt path and `modelExecutionValue` through `okstra worker-dispatch`. Each brief carries the diff, the work directory, its own axis's cell list verbatim, its packs' absolute paths, and the absolute calibration path.

package/docs/for-ai/skills/okstra-container-build.md

@@ -27,10 +27,13 @@
 Single call:
 
 ```bash
-okstra preflight --runtime claude-code --json
+okstra preflight --runtime claude-code
 ```
 
-If the project is not set up, point to `/okstra-setup` and stop. A Docker daemon is required. On a Docker connection error, tell the user to start Docker Desktop/daemon; do not start Docker yourself.
+On `Okstra preflight: ready`, carry the fixed `Project root` line. On
+`Okstra preflight: failed`, show `Reason` and `Recovery`, then stop. A Docker
+daemon is required. On a Docker connection error, tell the user to start Docker
+Desktop/daemon; do not start Docker yourself.
 
 ## task-key resolution
 
@@ -40,7 +43,7 @@ Most sub-commands need a full task-key.
 2. For a bare task-id, use the resolver:
 
 ```bash
-okstra resolve-task-key <task-id> --project-root <projectRoot> --json
+okstra model-io task-selection-input --project-root <projectRoot> --task-ref <task-id>
 ```
 
 3. On multiple matches, show the candidates and let the user pick.
@@ -63,7 +66,7 @@ If ambiguous, show the full facet list and offer an Enter directly option. When
 Run:
 
 ```bash
-okstra container up --project-root <projectRoot> --task-key <task-key>
+okstra container up --project-root <projectRoot> --task-key <task-key> --text
 ```
 
 Preconditions:
@@ -79,17 +82,17 @@ Handling failure messages:
 - `final-verification(whole-task): stage N not done`: tell the user to finish that stage via implementation.
 - healthcheck failure: relay the failing service and the `docker compose ... logs` line the CLI provides, verbatim.
 
-On success, parse the stdout JSON and summarize services, watcher pane, and published ports. Tell the user that management from here is via `okstra container status <task-key>` and `down <task-key>`. For *what to verify* once it is up, point to the implementation report's §5.7.9 Manual User Test (Draft) — those steps and expected results are the manual test script for this build.
+On success, read the fixed `Service` and `Watcher` rows, then run the `status --text` command below and read its numbered container `ports` fields. Tell the user that management from here is via `okstra container status <task-key>` and `down <task-key>`. For *what to verify* once it is up, point to the implementation report's §5.7.9 Manual User Test (Draft) — those steps and expected results are the manual test script for this build.
 
 ## status
 
 Run:
 
 ```bash
-okstra container status --project-root <projectRoot> --task-key <task-key>
+okstra container status --project-root <projectRoot> --task-key <task-key> --text
 ```
 
-stdout JSON:
+Fixed fields:
 
 - `projectName`: compose project name
 - `containers`: running containers found by run-trace label
@@ -102,52 +105,52 @@ The `containers` label query is authoritative for whether it is alive. The watch
 Run:
 
 ```bash
-okstra container logs --project-root <projectRoot> --task-key <task-key>
+okstra container logs --project-root <projectRoot> --task-key <task-key> --text
 ```
 
 service scope:
 
 ```bash
-okstra container logs --project-root <projectRoot> --task-key <task-key> --service <service>
+okstra container logs --project-root <projectRoot> --task-key <task-key> --service <service> --text
 ```
 
-Show the stdout JSON's `watchersDir` and `watchers`. The live stream is in the tmux watcher pane, not a file. If raw compose logs are needed, get `projectName` from `status`, then tell the user they can run `docker compose -p <projectName> logs -f <service>`.
+Show the fixed `Watchers dir` and numbered `Watchers` rows. The live stream is in the tmux watcher pane, not a file. If raw compose logs are needed, get `Project name` from `status`, then tell the user they can run `docker compose -p <projectName> logs -f <service>`.
 
 ## stop-watcher
 
 Run:
 
 ```bash
-okstra container stop-watcher --project-root <projectRoot> --task-key <task-key>
+okstra container stop-watcher --project-root <projectRoot> --task-key <task-key> --text
 ```
 
-Remove only the watcher/tail panes and keep the containers. Summarize the stdout JSON's `reapedPanes` and `note`. If the user actually intends to bring the containers down, route to `down`.
+Remove only the watcher/tail panes and keep the containers. Summarize the fixed `Reaped panes` and `Note` rows. If the user actually intends to bring the containers down, route to `down`.
 
 ## down
 
 Single task:
 
 ```bash
-okstra container down --project-root <projectRoot> --task-key <task-key>
+okstra container down --project-root <projectRoot> --task-key <task-key> --text
 ```
 
 Whole project:
 
 ```bash
-okstra container down --project-root <projectRoot> --all
+okstra container down --project-root <projectRoot> --all --text
 ```
 
 A single-task down is fine to run after resolving the task-key. `--all` takes down every okstra container group in the project, so confirm with the user before running it.
 
-Report the stdout JSON's `downed` and `orphanPanesReaped`. Show each `projectName` and the reaped panes.
+Report the fixed `Downed` and `Orphan panes reaped` rows. Show each project name and the reaped panes.
 
 ## Output rules
 
-- The stdout JSON is the source of truth.
+- The fixed text fields are the source of truth.
 - Do not second-guess it with raw `docker` commands. The only exception is when the CLI failed and the user asked for a manual fallback.
 - Show the resolved task-key in the heading or on the first line.
 - Show CLI failure messages verbatim, including the remediation line.
-- Show container/service state as the JSON values, without normalizing.
+- Show container/service state as the fixed values, without normalizing.
 
 ## Forbidden patterns