okstra 0.186.7 → 0.188.0

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -26,10 +26,10 @@ import uuid
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Callable, Mapping, Sequence
+from typing import Any, Callable, Iterable, Mapping, Sequence
 
 from . import cmux
-from .agent_invocation import (
+from .agent.invocation import (
     AgentInvocationError,
     AgentModelAssignment,
     InvocationMetadataIdentity,
@@ -39,7 +39,11 @@ from .agent_invocation import (
     verify_agent_invocation,
 )
 from .domain.role import RoleCatalogError, role_for_duty
-from .execution_identity import Attempt, Invocation
+from .execution_identity import (  # noqa: F401 — build_dispatch_id 재노출
+    Attempt,
+    Invocation,
+    build_dispatch_id,
+)
 from .execution_manifest import (
     finish_attempt_mutation,
     read_execution_manifest,
@@ -52,6 +56,7 @@ from .worker_prompt_body import REPORT_WRITER_WORKER_ID
 from .worker_prompt_contract import (
     PromptRecord,
     validate_initial_prompt_records,
+    validate_prompt_model_header,
     validate_reverify_prompt,
 )
 from .worker_runner import LIVE, QUIET
@@ -65,6 +70,7 @@ from .wrapper_status import (
 from .write_policy import (
     build_invocation_write_contract,
     planned_paths_from_run_manifest,
+    task_root_from_run_manifest,
     write_policy_from_payload,
 )
 from .convergence_store import write_json_atomic
@@ -188,6 +194,7 @@ class WorkerJob:
     execution_label: str = ""
     duty_id: str = ""
     invocation_ref: str = ""
+    result_aliases: tuple[Path, ...] = ()
     attempt: int = 0
 
     @property
@@ -352,13 +359,6 @@ def resolve_required_path(
     return resolve_project_path(project_root, require_string(manifest, key))
 
 
-def worker_prompt_path(manifest: Mapping[str, Any], worker_id: str) -> str:
-    paths = manifest.get("workerPromptPathByWorkerId")
-    if not isinstance(paths, Mapping):
-        raise DispatchError("run manifest has no workerPromptPathByWorkerId object")
-    return require_string(paths, worker_id)
-
-
 def worktree_path(
     manifest: Mapping[str, Any], active_context: Mapping[str, Any]
 ) -> str:
@@ -505,6 +505,35 @@ _AGENT_ENFORCEMENT_MODES = frozenset({
 })
 
 
+def _require_prompt_model_matches_assignment(
+    metadata_path: Path, assignment: Any
+) -> None:
+    """디스패치 직전, 프롬프트가 이 배정의 모델을 가리키는지 확인한다.
+
+    메타데이터는 프롬프트 옆에 `<prompt>.meta.json` 으로 놓인다. 읽을 수 없으면
+    조용히 통과한다 — 이 검사는 어긋남을 앞당겨 잡는 것이지, 프롬프트를 못 읽는
+    사정을 새 차단 사유로 만드는 것이 아니다. 그 사정은 이미 다른 검사가 본다.
+    """
+    prompt_path = metadata_path.with_name(
+        metadata_path.name.removesuffix(".meta.json")
+    )
+    if prompt_path == metadata_path or not prompt_path.is_file():
+        return
+    expected = str(getattr(assignment, "model_execution_value", "") or "").strip()
+    if not expected:
+        return
+    try:
+        text = prompt_path.read_text(encoding="utf-8")
+    except OSError:
+        return
+    errors = validate_prompt_model_header(text, expected)
+    if errors:
+        raise DispatchError(
+            f"agent dispatch prompt does not name this assignment's model: "
+            + "; ".join(errors)
+        )
+
+
 def record_verified_agent_dispatch(
     *,
     project_root: Path,
@@ -577,6 +606,7 @@ def record_verified_agent_dispatch(
     )
     if errors:
         raise DispatchError("agent invocation verification failed: " + "; ".join(errors))
+    _require_prompt_model_matches_assignment(metadata_path, assignment)
     if (
         enforcement_mode == "host-native-spec-link-gate"
         and assignment.runner != "native-session"
@@ -691,9 +721,6 @@ def record_verified_agent_dispatch(
                 dispatch_kind=dispatch_kind,
                 round=_execution_dispatch_round(dispatch_kind),
                 input_digest=prompt_digest,
-                write_policy=write_policy.to_payload(),
-                write_policy_digest=write_policy.digest,
-                write_enforcement=write_enforcement.to_payload(),
             ),
             Attempt(
                 invocation_ref=execution_identity.invocation_ref,
@@ -705,6 +732,9 @@ def record_verified_agent_dispatch(
                 error_path=None,
                 change_summary={},
                 evidence_seal_ref=None,
+                write_policy=write_policy.to_payload(),
+                write_policy_digest=write_policy.digest,
+                write_enforcement=write_enforcement.to_payload(),
             ),
             task_key=require_string(manifest, "taskKey"),
         )
@@ -833,6 +863,7 @@ def _agent_write_contract(
             project_root=project_root,
             worktree=worktree,
             artifact_paths=artifacts,
+            task_root=task_root_from_run_manifest(project_root, authority),
             maximum_precision=maximum_precision,
             planned_paths=planned[0],
             planned_paths_declared=planned[1],
@@ -954,6 +985,25 @@ def _project_or_absolute(project_root: Path, value: str) -> Path:
     return path if path.is_absolute() else project_root / path
 
 
+def prompt_anchor_values(
+    prompt_path: Path, labels: Iterable[str],
+) -> dict[str, str]:
+    """`**<label>:** <value>` 앵커 줄을 라벨별로 읽는다. 첫 번째 값이 이긴다.
+
+    앵커는 materialize 가 문서 머리에 쓰고, 본문(리드 지시문)이 같은 라벨을
+    예시로 되풀이할 수 있다. `_prompt_write_paths` 는 마지막 값을 취하는데
+    그것은 write-policy 의 허용 집합을 넓힐 뿐이지만, 여기서 읽는 값은 워커가
+    실제로 쓰는 경로의 판정 기준이므로 머리의 것이어야 한다.
+    """
+    values: dict[str, str] = {}
+    for line in prompt_path.read_text(encoding="utf-8").splitlines():
+        for label in labels:
+            prefix = f"**{label}:** "
+            if label not in values and line.startswith(prefix):
+                values[label] = line.removeprefix(prefix).strip()
+    return values
+
+
 def _execution_dispatch_round(dispatch_kind: str) -> int:
     prefix = "reverify-r"
     if not dispatch_kind.startswith(prefix):
@@ -1017,6 +1067,9 @@ def link_agent_dispatch_result(
                 f"agent result link requires exactly one dispatch record: {dispatch_id}"
             )
         dispatch = dispatches[0]
+        _require_recorded_result_path(
+            project_root, dispatch, resolved_result, result_relative
+        )
         link: dict[str, Any] = {
             "dispatchId": dispatch_id,
             "resultPath": result_relative,
@@ -1081,20 +1134,21 @@ def _finish_native_agent_attempt(
     if identity is None:
         return
     execution = read_execution_manifest(manifest_path)
-    invocation = next(
+    attempt = next(
         (
-            row for row in execution.invocations
+            row for row in execution.attempts
             if row.invocation_ref == identity["invocation_ref"]
+            and row.attempt == identity["attempt"]
         ),
         None,
     )
-    if invocation is None:
-        raise DispatchError("agent result has no canonical invocation policy")
-    if dispatch.get("writePolicyDigest") != invocation.write_policy_digest:
+    if attempt is None:
+        raise DispatchError("agent result has no canonical attempt policy")
+    if dispatch.get("writePolicyDigest") != attempt.write_policy_digest:
         raise DispatchError("agent dispatch write policy digest changed")
-    if dispatch.get("writeEnforcement") != invocation.write_enforcement:
+    if dispatch.get("writeEnforcement") != attempt.write_enforcement:
         raise DispatchError("agent dispatch write enforcement changed")
-    policy = write_policy_from_payload(invocation.write_policy)
+    policy = write_policy_from_payload(attempt.write_policy)
     status, summary = _native_mutation_result(
         project_root=project_root,
         dispatch=dispatch,
@@ -1290,6 +1344,127 @@ def reject_agent_dispatch_result(
     return dict(row)
 
 
+def _require_recorded_result_path(
+    project_root: Path,
+    dispatch: Mapping[str, Any],
+    resolved_result: Path,
+    result_relative: str,
+) -> None:
+    """링크되는 결과가 이 디스패치가 실제로 기다린 산출물인가.
+
+    비교 대상을 여기서 다시 계산하지 않는다. `record-dispatch` 가 이미
+    `completionPaths` 로 그 목록을 적어 두었고(리포트 작성자는 narrative 와
+    포인터 기록 둘), 그것이 이 디스패치가 완료로 인정하는 경로의 정본이다.
+
+    이 대조가 없으면 잘못된 경로를 링크해도 그 자리에서는 통과하고, 조립이
+    `required input is missing` 으로 죽을 때에야 드러난다 — 그때는 워커가 이미
+    돌고 난 뒤다. 실측(2026-08-26): 리드가 지어낸 seq(`-002.md`)를 넘겼고
+    매니페스트의 선언은 `-004.md` 였다. 여기서 막으면 워커를 다시 돌릴 필요 없이
+    같은 명령을 옳은 인자로 다시 부르면 된다.
+
+    `completionPaths` 를 기록하지 않은 행은 판정하지 않는다 — 목록이 없으면
+    무엇이 정당한지 알 수 없고, 모르면서 막는 것은 추측이다.
+    """
+    recorded = dispatch.get("completionPaths")
+    if not isinstance(recorded, list) or not recorded:
+        return
+    allowed = {
+        resolve_project_path(project_root, str(value)).resolve()
+        for value in recorded
+        if isinstance(value, str) and value.strip()
+    }
+    if not allowed or resolved_result in allowed:
+        return
+    expected = ", ".join(sorted(_relative_project_path(project_root, path) for path in allowed))
+    raise DispatchError(
+        f"agent result link is not one of this dispatch's completion paths: "
+        f"linked {result_relative}, expected one of {expected}"
+    )
+
+
+def abandon_agent_dispatch_attempt(
+    *,
+    project_root: Path,
+    run_manifest_path: Path,
+    invocation_ref: str,
+    reason: str,
+) -> dict[str, Any]:
+    """Close a started attempt whose worker died without producing a result.
+
+    Every other path that closes an attempt needs something the dead worker
+    never made: `link-result` needs its result file, and
+    `_abandon_unstarted_attempt` only runs when the dispatch itself failed
+    before the process existed. A worker that started and then died — its host
+    killed, its pane closed, an import error before any log — leaves the attempt
+    `started` forever, and `_validate_next_attempt` then refuses every retry with
+    `previous attempt is not terminal`. The run has to be re-rendered from
+    scratch to make progress.
+
+    **Only a `source-readonly` attempt may be abandoned.** The manifest accepts a
+    following attempt only after `failed-no-mutation`, so closing an attempt is
+    also an assertion that nothing was written. For a read-only worker that
+    assertion is true by policy — it never held permission to write — so no
+    guess is involved. For a `project-mutation` attempt it would be a guess, and
+    a wrong one lets the retry run on top of a half-mutated tree, which is the
+    invariant this manifest exists to protect. That case is refused here and
+    belongs to the mutation audit.
+    """
+    if not reason.strip():
+        raise DispatchError(
+            "an abandonment reason is required — the ledger has to say why an "
+            "attempt was closed without a result"
+        )
+    project_root = project_root.resolve()
+    manifest_path = resolve_project_path(
+        project_root, str(run_manifest_path)
+    ).resolve(strict=True)
+    manifest = load_json_object(manifest_path, "run manifest")
+    execution = read_execution_manifest(manifest_path)
+    attempts = [
+        row for row in execution.attempts if row.invocation_ref == invocation_ref
+    ]
+    if not attempts:
+        raise DispatchError(f"no attempt for invocation {invocation_ref}")
+    row = max(attempts, key=lambda item: item.attempt)
+    if row.finished_at is not None:
+        raise DispatchError(
+            f"attempt {invocation_ref} #{row.attempt} is already terminal "
+            f"({row.status})"
+        )
+    mode = _attempt_source_mode(row)
+    if mode != "source-readonly":
+        raise DispatchError(
+            f"attempt {invocation_ref} #{row.attempt} runs under sourcePolicy "
+            f"`{mode}` — only a source-readonly attempt may be abandoned, "
+            "because closing one asserts that nothing was written. Resolve a "
+            "mutating attempt through its mutation audit."
+        )
+    finish_attempt_mutation(
+        manifest_path,
+        invocation_ref=invocation_ref,
+        attempt=row.attempt,
+        finished_at=utc_now(),
+        status="failed-no-mutation",
+        result_path=None,
+        error_path=None,
+        change_summary={"abandonedReason": reason.strip()},
+        task_key=require_string(manifest, "taskKey"),
+    )
+    return {
+        "invocationRef": invocation_ref,
+        "attempt": row.attempt,
+        "status": "failed-no-mutation",
+        "reason": reason.strip(),
+    }
+
+
+def _attempt_source_mode(row: Any) -> str:
+    policy = getattr(row, "write_policy", None)
+    source = policy.get("sourcePolicy") if isinstance(policy, Mapping) else None
+    mode = source.get("mode") if isinstance(source, Mapping) else None
+    return str(mode or "unknown")
+
+
 def _relative_project_path(project_root: Path, path: Path) -> str:
     try:
         return path.resolve(strict=False).relative_to(project_root).as_posix()
@@ -1307,6 +1482,63 @@ def worker_state(team_state: Mapping[str, Any], worker_id: str) -> Mapping[str,
     raise DispatchError(f"team-state has no workerId={worker_id}")
 
 
+def _task_project_root(team_state_path: Path) -> Path | None:
+    """team-state 경로에서 프로젝트 루트를 되짚는다 (`.okstra` 를 기준점으로).
+
+    stage run 은 `runs/<phase>/stage-N/state/` 로 한 층이 더 깊으므로 부모를
+    세는 방식은 빗나간다. 기준점을 못 찾으면 None — 예상 밖 배치에서 판정을
+    포기하는 쪽이, 실행을 통째로 막는 쪽보다 낫다. 최종 검증이 같은 모순을
+    다시 잡는다.
+    """
+    for parent in team_state_path.resolve().parents:
+        if parent.name == ".okstra":
+            return parent.parent
+    return None
+
+
+class CompletedWithoutResultError(DispatchError):
+    """명부의 `resultPath` 파일 없이 `completed` 로 적으려 했다.
+
+    `_finish_attempt` 가 이 거절을 데이터로 돌려세우기 위해 구분한다 — 디스패치
+    자신의 산출물은 있는데 명부가 가리키는 파일이 다른 경우다.
+    """
+
+
+def _reject_completed_without_result(
+    team_state_path: Path, worker_id: str, worker: Mapping[str, Any]
+) -> None:
+    """산출물이 없는 역할을 완료로 적지 못하게 한다.
+
+    okstra 는 디스패치 결과를 스스로 기록한다. 그 원장이 두 시도 모두 `error`
+    라고 적은 역할이 명부에는 `completed` 로 남을 수 있었다 — 명부 상태가
+    원장에서 파생되지 않기 때문이다. 모순은 phase 끝 `validate-run` 이
+    "completed but worker result file is missing" 으로 잡지만, 그때는 워커를
+    다시 돌릴 수 없어 실행 전체가 막힌다.
+
+    조인 대신 명부 자신의 `resultPath` 를 본다. 그 값이 없는 역할(critic scope
+    등)은 판정 대상이 아니다.
+
+    실측(2026-08-27, `fontsninja-v3-site` `dev-10341`): 명부 5건 중 `resultPath`
+    를 가진 4건에서 3건은 파일이 있었고, grok-planner 만 없었다.
+    """
+    relative = str(worker.get("resultPath") or "").strip()
+    if not relative:
+        return
+    candidate = Path(relative)
+    if not candidate.is_absolute():
+        project_root = _task_project_root(team_state_path)
+        if project_root is None:
+            return
+        candidate = project_root / candidate
+    if candidate.is_file():
+        return
+    raise CompletedWithoutResultError(
+        f"worker {worker_id} cannot be recorded completed: its result "
+        f"{relative} does not exist. Record the terminal status the dispatch "
+        "actually reached (`error` / `timeout` / `not-run`) with a reason."
+    )
+
+
 def transition_worker_status(
     team_state_path: Path,
     worker_id: str,
@@ -1332,6 +1564,10 @@ def transition_worker_status(
             raise DispatchError(f"team-state workers must be an array: {team_state_path}")
         for worker in workers:
             if isinstance(worker, dict) and worker.get("workerId") == worker_id:
+                if status == "completed":
+                    _reject_completed_without_result(
+                        team_state_path, worker_id, worker
+                    )
                 worker["status"] = status
                 worker["reason"] = reason
                 if status == "in-progress":
@@ -1400,25 +1636,6 @@ def _has_recorded_team_create(team_state: Mapping[str, Any]) -> bool:
 
 # --- job facts ----------------------------------------------------------------
 
-def build_dispatch_id(invocation_id: str, attempt: int) -> str:
-    """The only place Python assembles a dispatch id.
-
-    Two generators drifted: this module pinned the attempt to 1 while
-    `dispatch_core` used the real one, so a re-dispatch took the first attempt's
-    id, team-state kept the same row twice, and `validate-run` failed that run
-    with `agent dispatch ID is duplicated`.
-
-    Prose mirrors of this shape live outside Python, where no guard reaches
-    them: `prompts/lead/convergence.md`, `prompts/lead/report-writer.md`,
-    `prompts/lead/plan-body-verification.md` and the five
-    `adapters/hosts/*/relay.md` each spell an `--dispatch-id` argument out for
-    the lead. They agree with this function only because
-    `record_verified_agent_dispatch` records the first attempt and no other;
-    changing that convention has to change them too.
-    """
-    return f"{invocation_id}:attempt-{attempt}"
-
-
 def dispatch_mode(jobs: Sequence[WorkerJob]) -> str:
     backends = {job.backend for job in jobs}
     if len(backends) == 1:
@@ -1427,7 +1644,18 @@ def dispatch_mode(jobs: Sequence[WorkerJob]) -> str:
 
 
 def missing_completion_paths(job: WorkerJob) -> tuple[Path, ...]:
-    return tuple(path for path in job.completion_paths if not path.is_file())
+    missing: list[Path] = []
+    for path in job.completion_paths:
+        if path.is_file():
+            continue
+        # reports seq 와 workerResults seq 가 갈라지면 워커는 다른 쪽
+        # 파일명으로 쓴다. 둘 중 하나가 있으면 산출물은 있는 것이다.
+        if path in {job.result_path, job.worker_result_path} and any(
+            alias.is_file() for alias in job.result_aliases
+        ):
+            continue
+        missing.append(path)
+    return tuple(missing)
 
 
 def dispatch_session_id(provider: str) -> str:
@@ -1475,7 +1703,7 @@ def worker_session_ids(
     for record in dispatches if isinstance(dispatches, list) else []:
         if not isinstance(record, Mapping):
             continue
-        if worker_id is not None and record.get("workerId") != worker_id:
+        if worker_id is not None and _dispatch_worker_key(record) != worker_id:
             continue
         session_id = str(record.get("sessionId") or "").strip()
         if session_id and session_id not in session_ids:
@@ -1483,6 +1711,27 @@ def worker_session_ids(
     return session_ids
 
 
+def _dispatch_worker_key(record: Mapping[str, Any]) -> str:
+    """The `workers[]` row a dispatch record belongs to.
+
+    A v1 record names it as `workerId`. A v2 record carries execution identity
+    instead and no `workerId` (`_dispatch_record`), so its row is the one the
+    roster keys off the assignment ref's last segment — `critic/scope` is the
+    row `scope`, `initial/claude-analyser` the row `claude-analyser` — the same
+    projection `v2_worker_state_key` makes for the jobs file. Matching on
+    `workerId` alone found no v2 record, so a pane worker's session id was never
+    read and every v2 pane worker stayed `unavailable` (observed 2026-09-02,
+    dev-10626 r04: the critic's session was on disk with 79 usage records).
+    """
+    worker_id = str(record.get("workerId") or "").strip()
+    if worker_id:
+        return worker_id
+    assignment_ref = record.get("assignmentRef")
+    if not isinstance(assignment_ref, str):
+        return ""
+    return assignment_ref.rsplit("/", 1)[-1].strip()
+
+
 def dispatch_result_path(
     worker_id: str,
     worker_result_path: Path,
@@ -1534,6 +1783,32 @@ def dispatch_completion_paths(
     return (data_json, worker_result_path)
 
 
+def _plan_verify_result_aliases(
+    worker_result_path: Path, manifest: Mapping[str, Any],
+) -> tuple[Path, ...]:
+    """reports seq 파일의 workerResults seq 짝.
+
+    plan-verify 결과 파일명만 해당한다. 다른 산출물의 seq 를 바꾸면 안 된다.
+    """
+    if "-plan-verify-r" not in worker_result_path.name:
+        return ()
+    sequences = manifest.get("runSequencesByCategory")
+    if not isinstance(sequences, Mapping):
+        return ()
+    reports = str(sequences.get("reports") or "").strip()
+    workers = str(sequences.get("workerResults") or "").strip()
+    if not reports or not workers or reports == workers:
+        return ()
+    name = worker_result_path.name
+    if name.endswith(f"-{reports}.md"):
+        other = name[: -len(f"-{reports}.md")] + f"-{workers}.md"
+    elif name.endswith(f"-{workers}.md"):
+        other = name[: -len(f"-{workers}.md")] + f"-{reports}.md"
+    else:
+        return ()
+    return (worker_result_path.with_name(other),)
+
+
 def validate_initial_prompts(
     manifest: Mapping[str, Any], jobs: Sequence[WorkerJob]
 ) -> None:
@@ -1893,10 +2168,82 @@ def worker_jobs_from_file(
         for item in workers
         if isinstance(item, Mapping)
     ]
+    _validate_jobs_file_prompt_anchors(jobs)
     _validate_v2_jobs_file_authority(manifest, jobs)
     return jobs
 
 
+def _normalized_path(path: Path) -> Path:
+    return Path(os.path.normpath(path))
+
+
+def _validate_jobs_file_prompt_anchors(jobs: Sequence[WorkerJob]) -> None:
+    """jobs-file 의 결과 경로가 프롬프트 앵커와 같은 파일인지 본다.
+
+    워커는 프롬프트의 `**Result Path:**` 에 쓰고(포인터를 가진 report-writer 는
+    `**Worker Result Path:**` 에 포인터를), 수집기는 jobs-file 의
+    `workerResultPath` 를 기다린다. 두 값은 리드가 따로 적으므로 어긋날 수 있고,
+    어긋나면 워커가 결과를 다 써도 `required worker artifact was not produced`
+    로 끝나 같은 프롬프트가 한 번 더 돈다. 실측(2026-09-02, fontsninja-v3-site
+    dev-10626-1 error-analysis r04): 검증 디스패치 9건 중 8건이 이 형태였고
+    재시도 6건이 같은 이유로 실패했다.
+
+    report-writer 는 한 가지를 더 본다 — 프롬프트의 `**Result Path:**`(서술문)가
+    `dispatch_result_path` 가 정한 조립 입력과 같은가. 다르면 서술문은 써지지만
+    `report-finalize` 가 읽는 자리에는 아무것도 없다.
+
+    프롬프트 파일이 아직 없는 잡은 건너뛴다. 실제 디스패치는 같은 파일을
+    write-policy 검사(`_prompt_write_paths`)가 반드시 읽으므로 빠져나갈 자리가
+    없고, 단위 테스트의 빈 경로만 여기서 면제된다.
+    """
+    errors: list[str] = []
+    for job in jobs:
+        if not job.prompt_path.is_file():
+            continue
+        anchors = prompt_anchor_values(
+            job.prompt_path, ("Result Path", "Worker Result Path"),
+        )
+        label = (
+            "Worker Result Path"
+            if anchors.get("Worker Result Path")
+            else "Result Path"
+        )
+        declared = anchors.get(label)
+        if not declared:
+            continue
+        declared_path = _normalized_path(
+            _project_or_absolute(job.project_root, declared)
+        )
+        accepted = {
+            _normalized_path(path)
+            for path in (job.worker_result_path, *job.result_aliases)
+        }
+        if declared_path not in accepted:
+            errors.append(
+                f"{job.worker_id}: workerResultPath {job.worker_result_path} "
+                f"differs from the prompt's **{label}:** {declared_path}"
+            )
+        narrative = anchors.get("Result Path")
+        if (
+            label == "Worker Result Path"
+            and narrative
+            and _normalized_path(job.result_path)
+            != _normalized_path(job.worker_result_path)
+            and _normalized_path(_project_or_absolute(job.project_root, narrative))
+            != _normalized_path(job.result_path)
+        ):
+            errors.append(
+                f"{job.worker_id}: the prompt's **Result Path:** {narrative} is "
+                f"not the result this run assembles from ({job.result_path})"
+            )
+    if errors:
+        raise DispatchError(
+            "jobs file result paths differ from the prompt anchors — the worker "
+            "writes where the prompt says, so the jobs file must name that path: "
+            + "; ".join(errors)
+        )
+
+
 def _worker_job_from_file(
     project_root: Path,
     item: Mapping[str, Any],
@@ -1909,6 +2256,14 @@ def _worker_job_from_file(
     resolve_wrapper: Callable[[str], Path],
     default_provider: Callable[[str], str],
 ) -> WorkerJob:
+    # 빠진 필드를 한꺼번에 댄다. 하나씩 거절하던 동안 세 워커짜리 파일 하나를
+    # 통과시키는 데 dry-run 세 번이 들었다(2026-09-02 실측).
+    missing = _missing_required_strings(item)
+    if missing:
+        raise DispatchError(
+            "jobs file worker is missing required string fields: "
+            + ", ".join(missing)
+        )
     identity = worker_execution_identity(item)
     worker_id = (
         require_string(item, "workerId")
@@ -1937,6 +2292,7 @@ def _worker_job_from_file(
     completion_paths = dispatch_completion_paths(
         worker_id, worker_result_path, manifest, project_root
     )
+    result_aliases = _plan_verify_result_aliases(worker_result_path, manifest)
     digests = item.get("digests")
     digest_values = digests if isinstance(digests, Mapping) else {}
     host_model_value = item.get("hostModelValue")
@@ -1985,10 +2341,30 @@ def _worker_job_from_file(
         prompt_digest=string_value(digest_values.get("promptDigest")),
         host_model_value=host_model_value,
         enforcement_mode=string_value(item.get("enforcementMode")),
+        result_aliases=result_aliases,
         **(identity or {}),
     )
 
 
+_V1_JOB_REQUIRED_STRINGS = (
+    "workerId", "promptPath", "workerResultPath", "modelExecutionValue", "role",
+)
+_V2_JOB_REQUIRED_STRINGS = (
+    "provider", "assignmentRef", "participantRef", "roleExecutionRef",
+    "executionLabel", "dutyId", "invocationRef", "promptPath",
+    "workerResultPath", "modelExecutionValue", "role",
+)
+
+
+def _missing_required_strings(item: Mapping[str, Any]) -> list[str]:
+    keys = (
+        _V2_JOB_REQUIRED_STRINGS
+        if item.get("schemaVersion") == "2.0"
+        else _V1_JOB_REQUIRED_STRINGS
+    )
+    return [key for key in keys if not string_value(item.get(key))]
+
+
 def worker_execution_identity(
     item: Mapping[str, Any],
 ) -> dict[str, Any] | None: