okstra 0.186.7 → 0.187.0

package/runtime/python/okstra_ctl/agent/prompt_cli/run_identity.py

@@ -0,0 +1,107 @@
+"""materialize 를 요청한 신원이 이 run 이 발급한 것인지 확인한다.
+
+run manifest 는 어떤 role 이 어떤 assignment 로 실행되는지를 이미 적어 두었다.
+CLI 인자가 그것과 어긋나면 감사 기록이 실행과 달라지므로 거절한다. 이 검사가
+없으면 매니페스트에 없는 role 로 프롬프트를 찍어 낼 수 있다.
+"""
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from ...worker_prompt_policy import (
+    CRITIC_DUTY_BY_ASSIGNMENT_SEGMENT,
+    resolve_prompt_plan_for_manifest,
+)
+from .inputs import AgentPromptCliError
+
+
+def _validate_run_identity(
+    manifest: Mapping[str, Any],
+    *,
+    worker_id: str,
+    dispatch_kind: str,
+    assignment_ref: str,
+    audience: str,
+) -> None:
+    expected: str
+    if assignment_ref == "lead":
+        expected = "lead"
+        if worker_id != "lead":
+            raise AgentPromptCliError("lead assignment requires worker ID 'lead'")
+    elif assignment_ref == "translator":
+        expected = "translator"
+        if worker_id != "translator":
+            raise AgentPromptCliError("translator assignment requires worker ID 'translator'")
+    elif assignment_ref.startswith("critic/"):
+        scope = assignment_ref.split("/", 1)[1]
+        expected = CRITIC_DUTY_BY_ASSIGNMENT_SEGMENT.get(scope, "")
+        if not expected or dispatch_kind != "critic":
+            raise AgentPromptCliError("critic assignment identity is invalid")
+        # provider 대조는 여기 두지 않는다. critic 의 `worker_id` 는 배정 참조의
+        # 마지막 마디(`scope` / `acceptance`)이고 provider 이름이 아니다
+        # (`render.py` 의 로스터 행이 `assignment_ref.rsplit("/", 1)[-1]` 로 만든다).
+        # 종전에 있던 `provider != worker_id` 검사는 두 어휘를 비교해서 늘 참이 되는
+        # 형태였고, 설정을 run manifest 에서 찾다 못 찾아 조용히 건너뛰었기에
+        # 드러나지 않았다. 정본에서 읽게 고치면 모든 critic 디스패치가 거부된다.
+    else:
+        try:
+            expected = resolve_prompt_plan_for_manifest(
+                manifest=manifest,
+                worker_id=worker_id,
+                dispatch_kind=dispatch_kind,
+            ).duty_audience
+        except ValueError as exc:
+            raise AgentPromptCliError(str(exc)) from exc
+        if audience != expected and _manifest_issued_role_execution(
+            manifest, audience=audience, assignment_ref=assignment_ref
+        ):
+            # The prompt plan names a worker's role by worker id, so on an
+            # implementation run the executor's provider resolves to the
+            # executor role no matter which role execution is being targeted.
+            # But the manifest issues one role execution per role, and a
+            # provider serving as both executor and verifier gets two — a
+            # normal roster, since the verifier contract accepts reusing the
+            # executor's model behind its own session. Refusing the second
+            # audience made a role execution okstra had itself issued
+            # undispatchable, which costs the run an independent verifier.
+            expected = audience
+    if audience != expected:
+        raise AgentPromptCliError(
+            f"audience {audience!r} does not match required audience {expected!r}"
+        )
+
+
+def _manifest_issued_role_execution(
+    manifest: Mapping[str, Any],
+    *,
+    audience: str,
+    assignment_ref: str,
+) -> bool:
+    """Whether this run issued a role execution for that audience's role.
+
+    Keyed on the manifest's own rows, not on what the prompt plan infers from
+    a worker id: the question is whether okstra created the execution being
+    targeted, and only the manifest answers that.
+    """
+    from ...domain.role import RoleCatalogError, role_for_duty
+
+    try:
+        role = role_for_duty(audience)
+    except RoleCatalogError:
+        return False
+    assignments = manifest.get("invocationAssignments")
+    assignment = (
+        assignments.get(assignment_ref) if isinstance(assignments, Mapping) else None
+    )
+    provider = (
+        assignment.get("provider") if isinstance(assignment, Mapping) else None
+    )
+    if not provider:
+        return False
+    executions = manifest.get("roleExecutions")
+    return any(
+        isinstance(row, Mapping)
+        and row.get("role") == role
+        and row.get("provider") == provider
+        for row in (executions if isinstance(executions, list) else [])
+    )

package/runtime/python/okstra_ctl/analysis_packet.py

@@ -67,7 +67,7 @@ WORKER_PROFILE_SECTIONS_BY_TASK_TYPE = {
         "Brief consumption",
         "Worker planning procedure",
         "Pre-planning context exploration",
-        "Design principles applied when scoring options",
+        "Design principles applied to realization review",
     ),
     "final-verification": (
         "Worker verification procedure",
@@ -102,8 +102,17 @@ def build_analysis_packet(
     fix_history_text: str = "",
     stage_ledger_json: str = "",
     stage_ledger_notice: str = "",
+    prior_planning_summary: str = "",
 ) -> str:
-    """Return the primary compact input for Claude/Codex/Antigravity analysers."""
+    """Return the primary compact input for Claude/Codex/Antigravity analysers.
+
+    `fix_history_text`, `stage_ledger_json` / `stage_ledger_notice`, and
+    `prior_planning_summary` are pre-rendered by their own modules
+    (`fix_cycles`, `stage_ledger`, `prior_planning`) because each is assembled
+    from disk state this file does not own. Each arrives already narrowed, and
+    an empty string means the caller found nothing to carry — the matching
+    block is then omitted rather than rendered saying "none".
+    """
     brief_text = task_brief_path.read_text(encoding="utf-8")
     profile_text = analysis_profile_path.read_text(encoding="utf-8")
     reference_text = _read_optional(reference_expectations_path)
@@ -126,6 +135,7 @@ def build_analysis_packet(
     parts.extend(_fix_history_block(fix_history_text))
     parts.extend(_stage_ledger_block(stage_ledger_json))
     parts.extend(_stage_ledger_unavailable_block(stage_ledger_notice))
+    parts.extend(_prior_planning_block(prior_planning_summary))
     parts.extend(_clarification_block(clarification_text))
     parts.extend(_directive_block(directive))
     body = "\n".join(part.rstrip() for part in parts).rstrip() + "\n"
@@ -334,8 +344,11 @@ def _stage_ledger_block(stage_ledger_json: str) -> list[str]:
         "authority is the latter.",
         "",
         "A `planDivergence` entry means the two plans disagree about a",
-        "completed stage. Treat it as a blocker for any new stage number and",
-        "report it; do not resolve it by choosing one of the two yourself.",
+        "completed stage, or that the plan the completed stages were built",
+        "against could not be read so that comparison never ran. Treat either",
+        "as a blocker for any new stage number and report it; do not resolve",
+        "it by choosing one of the two yourself. Completed stages built",
+        "against an earlier plan are not a divergence.",
         "",
         "```json",
         stage_ledger_json.strip(),
@@ -371,6 +384,36 @@ def _stage_ledger_unavailable_block(notice: str) -> list[str]:
     ]
 
 
+def _prior_planning_block(prior_planning_summary: str) -> list[str]:
+    """직전 계획 run 의 맥락. 직전 run 이 없으면 블록 자체가 없다.
+
+    머리글이 이 블록의 용도를 스스로 말한다. 그러지 않으면 워커는 표에 실린
+    계획을 승인된 것으로 읽고 그대로 옮겨 적는다 — 이 블록이 실리는 run 은
+    직전 계획이 **승인에 도달하지 못해** 다시 도는 run 이므로 그 독해는 틀렸다.
+    """
+    if not prior_planning_summary.strip():
+        return []
+    return [
+        "",
+        "## Prior Planning Run",
+        "",
+        "What this task's previous implementation-planning run recorded. It is",
+        "here so that stages the previous plan already settled stay textually",
+        "stable across the re-run, and so settled analysis is not derived from",
+        "the brief a second time under new `P-*` numbers.",
+        "",
+        "It is NOT an approved plan and NOT an instruction to copy. The",
+        "previous run did not reach approval — that is why this run exists —",
+        "so every line below is still open to revision. Where the brief, the",
+        "directive, or a clarification answer disagrees with it, they win, and",
+        "a stage you are changing is rewritten rather than carried. Read the",
+        "report at the path below for anything this summary leaves out.",
+        "",
+        prior_planning_summary.strip(),
+        "",
+    ]
+
+
 def _clarification_block(clarification_text: str) -> list[str]:
     if not clarification_text.strip():
         return []

package/runtime/python/okstra_ctl/approval_decisions.py

@@ -6,12 +6,36 @@ import json
 import re
 import sys
 from copy import deepcopy
+from functools import lru_cache
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 
+from .clarification_items.sidecars import (
+    attached_response_sections,
+    response_source_report,
+)
+from .user_response_values import parse_user_response_entries
 from .convergence_store import write_json_atomic
+from .final_report_schema import load_schema_version
 from .json_boundary import JsonBoundaryError, load_owned_object
+from .report_contract import CURRENT_REPORT_SCHEMA_VERSION
+
+
+@lru_cache(maxsize=None)
+def _schema_enum(definition: str) -> frozenset[str]:
+    """리포트 스키마의 ``$defs`` enum 을 그대로 읽는다.
+
+    이 원장의 행은 그대로 final-report 의 ``clarificationItems`` 가 된다. 값 목록을
+    여기에 다시 타이핑하면 스키마와 따로 흐르므로 정본에서 읽는다.
+    """
+    schema = load_schema_version(CURRENT_REPORT_SCHEMA_VERSION)
+    values = (schema.get("$defs") or {}).get(definition, {}).get("enum")
+    if not isinstance(values, list) or not values:
+        raise ApprovalDecisionError(
+            f"report schema has no enum for {definition!r}"
+        )
+    return frozenset(str(value) for value in values)
 
 
 DISPOSITIONS = frozenset({"select", "accept-risk", "request-revision", "reject"})
@@ -127,6 +151,23 @@ def _validate_option_set(
         )
 
 
+def _reject_off_enum(value: str, field: str, definition: str) -> None:
+    """스키마 밖 값을 원장 진입 지점에서 거절한다.
+
+    종전에는 두 provenance 필드가 비어 있지 않기만 하면 통과했다. 리포트 조립이
+    스키마로 잡아 내기는 하지만 그때는 이미 레코드를 디스크에 쓴 뒤라, 잘못된 값이
+    원장과 리포트 양쪽에 남아 이후의 모든 읽기(`okstra user-response`)를 막았다.
+    """
+    if not value:
+        return
+    allowed = _schema_enum(definition)
+    if value not in allowed:
+        raise ApprovalDecisionError(
+            f"invalid {field}: {value!r}. Allowed values: "
+            + ", ".join(sorted(allowed))
+        )
+
+
 def _decision_row(
     *, clarification_id: str, ticket_id: str, statement: str,
     expected_form: str, classification: str, origin: str,
@@ -135,6 +176,10 @@ def _decision_row(
 ) -> dict[str, Any]:
     if classification not in CLASSIFICATIONS:
         raise ApprovalDecisionError(f"invalid classification: {classification}")
+    _reject_off_enum(origin, "origin", "ClarificationOrigin")
+    _reject_off_enum(
+        user_confirmation, "user_confirmation", "ClarificationUserConfirmation"
+    )
     if recommended_disposition not in DISPOSITIONS:
         raise ApprovalDecisionError(
             f"invalid recommended_disposition: {recommended_disposition}"
@@ -260,8 +305,21 @@ def _add_open_arguments(parser: argparse.ArgumentParser) -> None:
         parser.add_argument(f"--option-{flag}", action="append", default=[])
 
 
+_CLI_EPILOG = r"""Usage:
+  okstra approval-decision open --ledger <path> [decision fields]
+  okstra approval-decision resolve --ledger <path> --clarification-id <C-NNN> [resolution fields]
+  okstra approval-decision carry --ledger <path> --from-responses <clarification-response.md> --clarification-id <C-NNN> [--clarification-id <C-NNN> ...]
+  okstra approval-decision carry --ledger <path> --source-ledger <path> --source-run-ref <ref> --clarification-id <C-NNN>
+"""
+_CLI_DESCRIPTION = "Record lead-owned approval inputs."
+
+
 def _parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(prog="okstra approval-decision")
+    parser = argparse.ArgumentParser(
+        description=_CLI_DESCRIPTION,
+        epilog=_CLI_EPILOG,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        prog="okstra approval-decision")
     commands = parser.add_subparsers(dest="command", required=True)
     opened = commands.add_parser("open")
     opened.add_argument("--ledger", type=Path, required=True)
@@ -275,9 +333,38 @@ def _parser() -> argparse.ArgumentParser:
     resolved.add_argument("--check-ref", action="append", default=[])
     carried = commands.add_parser("carry")
     carried.add_argument("--ledger", type=Path, required=True)
-    carried.add_argument("--source-ledger", type=Path, required=True)
-    carried.add_argument("--source-run-ref", required=True)
-    carried.add_argument("--clarification-id", required=True)
+    source = carried.add_mutually_exclusive_group(required=True)
+    source.add_argument(
+        "--from-responses",
+        type=Path,
+        help=(
+            "attached user-responses bundle (`instruction-set/"
+            "clarification-response.md`). It is the source of truth for the "
+            "answer; the question's own fields come from the report each "
+            "response section names. Task-level and cumulative, so no prior "
+            "run seq has to be located."
+        ),
+    )
+    source.add_argument(
+        "--source-ledger",
+        type=Path,
+        help="a prior run's approval ledger, when it is still on disk",
+    )
+    carried.add_argument(
+        "--source-run-ref",
+        default="",
+        help=(
+            "provenance recorded on the carried row. Required with "
+            "--source-ledger; with --from-responses it defaults to the "
+            "response section the answer came from."
+        ),
+    )
+    carried.add_argument(
+        "--clarification-id",
+        action="append",
+        required=True,
+        help="repeat to carry several ids in one call",
+    )
     return parser
 
 
@@ -291,13 +378,174 @@ def _open_from_args(args: argparse.Namespace) -> None:
     open_decision(**values, options=_options_from_args(args))
 
 
+# `kind: decision` 인 행은 스키마가 옵션 메뉴를 요구하므로 함께 가져온다.
+# `resolution` 은 가져오지 않는다 — 그 `checkRefs` 는 답을 기록한 run 의 활동
+# 행이고, 이월 행은 `answered` 로 실린다.
+_QUESTION_FIELDS = (
+    "id", "ticketId", "kind", "statement", "expectedForm", "blocks", "origin",
+    "options",
+)
+
+
+def _responses_index(path: Path) -> dict[str, tuple[Any, str, str, str]]:
+    """묶음 파일의 답을 ``{id: (entry, 구간 이름, 리포트 기록 이름, task-type)}`` 로.
+
+    같은 id 를 여러 run 이 답했으면 뒤 구간이 이긴다 — 묶음은 시간순으로 쌓이고
+    최신 답이 정본이다.
+    """
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError as exc:
+        raise ApprovalDecisionError(f"cannot read {path}: {exc}") from exc
+    sections = attached_response_sections(text)
+    if not sections:
+        raise ApprovalDecisionError(
+            f"not an attached user-responses bundle (no `## user-response-*.md` "
+            f"section): {path}"
+        )
+    index: dict[str, tuple[Any, str, str, str]] = {}
+    for name, body in sections:
+        report = response_source_report(body)
+        task_type = _frontmatter_task_type(body)
+        for entry in parse_user_response_entries(body):
+            index[entry.response_id] = (entry, name, report, task_type)
+    return index
+
+
+def _frontmatter_task_type(section_body: str) -> str:
+    match = re.search(r"^task-type:\s*(\S.*?)\s*$", section_body, re.MULTILINE)
+    return match.group(1) if match else ""
+
+
+def _prior_question_row(
+    responses_path: Path, clarification_id: str, report_name: str, task_type: str,
+) -> dict[str, Any]:
+    """질문 메타데이터의 출처는 그 질문을 낸 리포트다.
+
+    묶음 파일은 답만 담는다. `ticketId`·`statement`·`expectedForm` 은 스키마가
+    요구하는데 묶음에 없으므로, 지어내는 대신 구간 frontmatter 가 지목한
+    리포트에서 읽는다. 그 리드가 seq 를 찾아 헤매지 않게 하는 것이 이 경로의
+    요점이다.
+    """
+    if not report_name or not task_type:
+        raise ApprovalDecisionError(
+            f"{clarification_id}: its response section names no source report; "
+            "carry it with --source-ledger instead"
+        )
+    task_root = responses_path.resolve().parent.parent
+    report_path = (
+        task_root / "runs" / task_type / "reports" / Path(report_name).name
+    )
+    if not report_path.is_file():
+        raise ApprovalDecisionError(
+            f"{clarification_id}: source report not found: {report_path}"
+        )
+    try:
+        data = load_owned_object(report_path, artifact="prior final report")
+    except (JsonBoundaryError, OSError) as exc:
+        raise ApprovalDecisionError(f"cannot read {report_path}: {exc}") from exc
+    rows = data.get("clarificationItems") if isinstance(data, Mapping) else None
+    match = next(
+        (
+            row for row in (rows or [])
+            if isinstance(row, Mapping) and row.get("id") == clarification_id
+        ),
+        None,
+    )
+    if match is None:
+        raise ApprovalDecisionError(
+            f"{clarification_id}: not defined in {report_path.name}"
+        )
+    row = {key: match[key] for key in _QUESTION_FIELDS if key in match}
+    if isinstance(row.get("options"), list):
+        row["options"] = [
+            _contract_v3_option(option, clarification_id)
+            for option in row["options"]
+            if isinstance(option, Mapping)
+        ]
+    if "approvalContext" in match:
+        row["approval"] = match["approvalContext"]
+    return row
+
+
+_REACH_TOKENS = ("in-repo", "cross-repo")
+
+
+def _contract_v3_option(option: Mapping[str, Any], clarification_id: str) -> dict[str, Any]:
+    """계약 2.0 의 `scopeImpact` 를 3.0 의 `reach` + `scopeEffects` 로 되돌린다.
+
+    두 열거는 정확히 분할 관계다 — 2.0 의 토큰 집합
+    `{in-repo, cross-repo, new-schema, deferrable}` 이 3.0 에서 `reach`
+    (`in-repo|cross-repo`, 정확히 하나)와 `scopeEffects`(나머지)로 갈렸다.
+    그래서 이 변환은 값을 지어내지 않는다. 이미 3.0 모양이면 그대로 둔다.
+    """
+    row = dict(option)
+    if "reach" in row:
+        row.pop("scopeImpact", None)
+        return row
+    tokens = row.pop("scopeImpact", None)
+    if not isinstance(tokens, list):
+        raise ApprovalDecisionError(
+            f"{clarification_id}: an option states neither `reach` nor "
+            "`scopeImpact`; carry it with --source-ledger instead"
+        )
+    reach = [token for token in tokens if token in _REACH_TOKENS]
+    if len(reach) != 1:
+        raise ApprovalDecisionError(
+            f"{clarification_id}: an option's `scopeImpact` names {len(reach)} "
+            "reach token(s); exactly one is needed to state `reach`"
+        )
+    row["reach"] = reach[0]
+    effects = [token for token in tokens if token not in _REACH_TOKENS]
+    if effects:
+        row["scopeEffects"] = effects
+    return row
+
+
+def _carry_from_responses(args: argparse.Namespace) -> None:
+    index = _responses_index(args.from_responses)
+    for clarification_id in args.clarification_id:
+        found = index.get(clarification_id)
+        if found is None:
+            raise ApprovalDecisionError(
+                f"clarification not answered in {args.from_responses}: "
+                f"{clarification_id}"
+            )
+        entry, section, report_name, task_type = found
+        if not entry.value.strip():
+            raise ApprovalDecisionError(
+                f"{clarification_id}: its answer in {section} has no Value"
+            )
+        decision = _prior_question_row(
+            args.from_responses, clarification_id, report_name, task_type
+        )
+        # 답이 정본인 자리는 여기다. `resolutionInput` 은 쓰지 않는다 —
+        # 그 모양은 `checkRefs` 로 이번 run 의 활동 행을 요구하는데, 이월된
+        # 답에는 이번 run 의 활동이 없다(`report_assembly` 의 이월 분기).
+        decision["userConfirmation"] = "asked-and-answered"
+        decision["userInput"] = entry.value
+        carry_decision(
+            args.ledger,
+            source_run_ref=args.source_run_ref or section,
+            decision=decision,
+        )
+
+
 def _carry_from_args(args: argparse.Namespace) -> None:
     source = _read_ledger(args.source_ledger)
     rows = source.get("activeClarifications") or []
-    matches = [row for row in rows if isinstance(row, dict) and row.get("id") == args.clarification_id]
-    if len(matches) != 1:
-        raise ApprovalDecisionError(f"source clarification not found: {args.clarification_id}")
-    carry_decision(args.ledger, source_run_ref=args.source_run_ref, decision=matches[0])
+    for clarification_id in args.clarification_id:
+        matches = [
+            row for row in rows
+            if isinstance(row, dict) and row.get("id") == clarification_id
+        ]
+        if len(matches) != 1:
+            raise ApprovalDecisionError(
+                f"source clarification not found: {clarification_id}"
+            )
+        carry_decision(
+            args.ledger, source_run_ref=args.source_run_ref, decision=matches[0]
+        )
 
 
 def _run(args: argparse.Namespace) -> None:
@@ -309,7 +557,11 @@ def _run(args: argparse.Namespace) -> None:
             user_text=args.user_text, user_response_ref=args.user_response_ref,
             check_refs=args.check_ref,
         )
+    elif args.from_responses:
+        _carry_from_responses(args)
     else:
+        if not args.source_run_ref:
+            raise ApprovalDecisionError("--source-ledger requires --source-run-ref")
         _carry_from_args(args)
 
 

package/runtime/python/okstra_ctl/assignment_resolver.py

@@ -91,18 +91,6 @@ class AssignmentContext:
     environment: AssignmentEnvironment
 
 
-@dataclass(frozen=True)
-class RoleCountSelection:
-    role: str
-    count: int
-
-
-@dataclass(frozen=True)
-class RoleModelSelection:
-    role: str
-    model_refs: tuple[str, ...]
-
-
 @dataclass(frozen=True)
 class RoleInstance:
     role: str

package/runtime/python/okstra_ctl/attempt_evidence.py

@@ -3,13 +3,17 @@ from __future__ import annotations
 
 import hashlib
 import json
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 
 from .domain.worker_stream import host_event_row
-from .execution_identity import Attempt, ExecutionManifestError
+from .execution_identity import (
+    Attempt,
+    ExecutionManifestError,
+    MutationRecoveryDecision,
+)
 from .execution_manifest import read_execution_manifest
 from .execution_manifest import _replace_manifest, _write_manifest_over_existing
 from .jsonl import append_jsonl
@@ -221,15 +225,10 @@ def finalize_attempt(
             raise AttemptEvidenceError("attempt to seal is unknown")
         existing = manifest.attempts[index]
         if terminal.interrupted_before_record:
-            closed = Attempt(
-                invocation_ref=existing.invocation_ref,
-                attempt=existing.attempt,
-                started_at=existing.started_at,
+            closed = replace(
+                existing,
                 finished_at=_utc_now(),
                 status="evidence-unsealed",
-                result_path=existing.result_path,
-                error_path=existing.error_path,
-                change_summary=dict(existing.change_summary),
                 evidence_seal_ref=None,
             )
             attempts = list(manifest.attempts)
@@ -252,15 +251,10 @@ def finalize_attempt(
             if not _same_observation(existing_seal, terminal):
                 raise AttemptEvidenceError("attempt already sealed with different observation")
             return existing_seal
-        closed = Attempt(
-            invocation_ref=existing.invocation_ref,
-            attempt=existing.attempt,
-            started_at=existing.started_at,
+        closed = replace(
+            existing,
             finished_at=existing.finished_at or _utc_now(),
             status=terminal.status,
-            result_path=existing.result_path,
-            error_path=existing.error_path,
-            change_summary=dict(existing.change_summary),
             evidence_seal_ref=seal.seal_ref,
         )
         attempts = list(manifest.attempts)
@@ -285,7 +279,6 @@ def reject_unsealed_attempt(
     task_key: str,
 ):
     """Close an unsealed attempt and record a cleanup-only reject."""
-    from .mutation_recovery import MutationRecoveryDecision
 
     invocation_ref, attempt_number = _split_attempt_ref(attempt_ref)
     with task_mutex(task_key):
@@ -301,15 +294,10 @@ def reject_unsealed_attempt(
         if index is None:
             raise AttemptEvidenceError("attempt to reject is unknown")
         existing = manifest.attempts[index]
-        closed = Attempt(
-            invocation_ref=existing.invocation_ref,
-            attempt=existing.attempt,
-            started_at=existing.started_at,
+        closed = replace(
+            existing,
             finished_at=existing.finished_at or _utc_now(),
             status="evidence-unsealed",
-            result_path=existing.result_path,
-            error_path=existing.error_path,
-            change_summary=dict(existing.change_summary),
             evidence_seal_ref=None,
         )
         decision = MutationRecoveryDecision(