okstra 0.189.3 → 0.190.0

package/runtime/python/okstra_ctl/consumers.py

@@ -19,6 +19,7 @@ from typing import Any, Dict, List, Optional
 from .json_boundary import JsonBoundaryError, load_owned_object
 from .jsonl import append_jsonl
 from .run_context import consumers_mutex
+from .release_gate import release_handoff_allowed
 
 CONSUMERS_FILENAME = "consumers.jsonl"
 
@@ -271,11 +272,18 @@ def _append_row(plan_run_root: Path, record: Dict[str, Any]) -> None:
 
 
 def append_verified(plan_run_root: Path, *, impl_task_key: str, stage: int,
-                    verdict: str, report_path: str) -> None:
+                    verdict: str, report_path: str, head_commit: str = "",
+                    final_verdict: dict | None = None) -> None:
     """단독-stage final-verification 결과 기록. 같은 report_path 재기록은 멱등,
     다른 report_path 는 재검증으로 append 한다 (읽기는 last-wins)."""
     with consumers_mutex(plan_run_root):
-        for row in read_consumers(plan_run_root):
+        rows = read_consumers(plan_run_root)
+        done = latest_done_by_stage(rows).get(stage, {})
+        if head_commit and (done.get("head_commit") != head_commit
+                            or done.get("impl_task_key") != impl_task_key
+                            or last_lifecycle_status_by_stage(rows).get(stage) != "done"):
+            raise ValueError("verification commit no longer matches completed implementation")
+        for row in rows:
             if (row.get("impl_task_key") == impl_task_key
                     and row.get("stage") == stage
                     and row.get("status") == "verified"
@@ -285,6 +293,8 @@ def append_verified(plan_run_root: Path, *, impl_task_key: str, stage: int,
             "impl_task_key": impl_task_key, "stage": stage,
             "status": "verified", "verdict": verdict,
             "report_path": report_path,
+            "head_commit": head_commit,
+            "final_verdict": final_verdict or {},
         })
 
 
@@ -302,12 +312,25 @@ def append_pr(plan_run_root: Path, *, impl_task_key: str, stages: List[int],
 
 
 def verified_accepted_stages(rows: List[Dict[str, Any]]) -> set:
-    """stage → 마지막 verified 행의 verdict 가 accepted 인 stage 집합 (last-wins)."""
-    last: Dict[int, str] = {}
+    """마지막 구현 이후 동일 커밋을 검증한 단계만 승인 후보로 남긴다."""
+    last: Dict[int, dict] = {}
+    done = latest_done_by_stage(rows)
     for r in rows:
-        if r.get("status") == "verified" and isinstance(r.get("stage"), int):
-            last[r["stage"]] = (r.get("verdict") or "").strip().lower()
-    return {n for n, v in last.items() if v == "accepted"}
+        stage = r.get("stage")
+        if not isinstance(stage, int):
+            continue
+        if r.get("status") in STAGE_LIFECYCLE_STATUSES:
+            last.pop(stage, None)
+        elif r.get("status") == "verified":
+            last[stage] = r
+    return {
+        n for n, row in last.items()
+        if row.get("head_commit")
+        and row["head_commit"] == done.get(n, {}).get("head_commit")
+        and row.get("impl_task_key") == done.get(n, {}).get("impl_task_key")
+        and row.get("verdict") == (row.get("final_verdict") or {}).get("verdictToken")
+        and release_handoff_allowed({"finalVerdict": row.get("final_verdict") or {}})
+    }
 
 
 def pr_covered_stages(rows: List[Dict[str, Any]]) -> set:

package/runtime/python/okstra_ctl/convergence.py

@@ -35,6 +35,7 @@ from .convergence_migration import (
 )
 from .convergence_provenance import (
     GROUPS_BASENAME_RE,
+    discarded_worker_errors,
     provenance_errors,
     worker_result_suffix,
 )
@@ -360,9 +361,11 @@ def _parser() -> argparse.ArgumentParser:
     collect.add_argument("--result", action="append", default=[],
                          metavar="<worker>=<path>",
                          help="one worker's reverify result file (repeatable)")
-    collect.add_argument("--dispatch", action="append", default=[], required=True,
-                         metavar="<worker>=<status>:<durationMs>",
-                         help="terminal status per dispatched worker (repeatable)")
+    collect.add_argument("--run-manifest", type=Path, required=True,
+                         help="the current run manifest; each planned worker's "
+                              "terminal outcome and duration are read from its "
+                              "attempts, and a still-`started` attempt refuses "
+                              "the collect until `okstra team await` closes it")
     collect.add_argument("--output", type=Path, required=True)
 
     apply = subparsers.add_parser("apply-round", help="apply structured round results")
@@ -877,6 +880,11 @@ def _seed(args: argparse.Namespace) -> tuple[str, Path]:
         raise ConvergenceContractError(
             "grouping cites source items no worker reported: " + "; ".join(provenance)
         )
+    discarded = discarded_worker_errors(grouped_input, execution_manifest)
+    if discarded:
+        raise ConvergenceContractError(
+            "grouping cites workers whose result was discarded: " + "; ".join(discarded)
+        )
     state = seed_working_state(
         grouped_input,
         execution_manifest=execution_manifest,
@@ -981,27 +989,98 @@ def _split_pair(raw: str, label: str) -> tuple[str, str]:
     return key.strip(), value.strip()
 
 
-def _dispatch_rows(raw_dispatches: list[str]) -> list[dict[str, Any]]:
-    """`dispatches[]`, from what only the lead knows.
+_ATTEMPT_DISPATCH_STATUS = {
+    "ok": "completed",
+    "failed-no-mutation": "error",
+    "contract-failed-unattributed": "error",
+    "mutation-present-unresolved": "error",
+}
 
-    Terminal status and duration are not in the worker's response; they belong
-    to the dispatch. Deriving them from the presence of a result file would call
-    a timed-out worker `completed` whenever it managed to write something.
+
+def _dispatch_rows_from_manifest(
+    plan: Mapping[str, Any],
+    manifest: Any,
+    run_manifest_path: Path,
+) -> list[dict[str, Any]]:
+    """`dispatches[]` 를 execution manifest 의 attempt 원장에서 도출한다.
+
+    종전에는 리드가 `--dispatch <worker>=<status>:<durationMs>` 로 상태와
+    소요시간을 손으로 넘겼다. 실측(2026-09-06, fontsninja-v3-site
+    final-verification 001): 재검증 결과 3건이 라운드 결과에 `completed`,
+    `durationMs: 0` 으로 기록됐는데 같은 attempt 들은 매니페스트에서 `started`
+    로 남아 있었다 — 결과 파일이 있으니 리드가 상태를 적었고, attempt 를 닫는
+    유일한 경로(`team await`)는 돌지 않았다. 원장에서 읽으면 두 기록이 갈릴
+    수 없고, 미종결 attempt 가 있으면 여기서 멈춰 `team await` 를 강제한다.
+
+    상태 대응: `ok` → completed, 그 밖의 terminal 은 error (wrapper 가 timeout
+    으로 닫은 attempt 는 `changeSummary.timeout` 이 참이면 timeout). 이 라운드의
+    invocation 이 없는 워커는 not-run.
     """
+    round_number = plan.get("round")
+    if not isinstance(round_number, int) or round_number < 1:
+        raise ConvergenceContractError("round plan `round` must be a positive integer")
+    kind = f"reverify-r{round_number}"
+    source_roles = {
+        role.role_execution_ref: role.source_role_execution_ref or role.role_execution_ref
+        for role in getattr(manifest, "role_executions", ())
+    }
+    latest: dict[str, Any] = {}
+    for attempt in getattr(manifest, "attempts", ()):
+        current = latest.get(attempt.invocation_ref)
+        if current is None or attempt.attempt > current.attempt:
+            latest[attempt.invocation_ref] = attempt
     rows: list[dict[str, Any]] = []
-    for raw in raw_dispatches:
-        worker, value = _split_pair(raw, "--dispatch")
-        status, _, duration = value.partition(":")
-        if not duration.isdigit():
+    for row in plan.get("dispatches") or []:
+        if not isinstance(row, Mapping):
+            continue
+        worker = str(row.get("worker") or "")
+        role_ref = row.get("sourceRoleExecutionRef")
+        matches = [
+            invocation for invocation in getattr(manifest, "invocations", ())
+            if invocation.dispatch_kind == kind
+            and (
+                source_roles.get(invocation.role_execution_ref) == role_ref
+                if isinstance(role_ref, str) and role_ref
+                else invocation.invocation_ref.endswith(f"-{worker}")
+            )
+        ]
+        attempts = [latest[inv.invocation_ref] for inv in matches if inv.invocation_ref in latest]
+        if not attempts:
+            rows.append({"worker": worker, "status": "not-run", "durationMs": 0})
+            continue
+        attempt = max(attempts, key=lambda item: (item.started_at, item.attempt))
+        if attempt.finished_at is None or attempt.status == "started":
             raise ConvergenceContractError(
-                f"--dispatch for `{worker}` must end in :<durationMs>, got: {value}"
+                f"attempt `{attempt.invocation_ref}#{attempt.attempt}` for `{worker}` "
+                f"is still `started`; run `okstra team await --run-manifest "
+                f"{run_manifest_path}` so the attempt closes before collecting — a "
+                "round result written over an open attempt is a status the ledger "
+                "never recorded"
             )
+        status = _ATTEMPT_DISPATCH_STATUS.get(attempt.status, "error")
+        if status == "error" and bool((attempt.change_summary or {}).get("timeout")):
+            status = "timeout"
         rows.append({
-            "worker": worker, "status": status, "durationMs": int(duration)
+            "worker": worker,
+            "status": status,
+            "durationMs": _duration_ms(attempt.started_at, attempt.finished_at),
         })
     return rows
 
 
+def _duration_ms(started_at: str, finished_at: str) -> int:
+    from datetime import datetime
+
+    def _parse(value: str) -> datetime:
+        return datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+    try:
+        delta = _parse(finished_at) - _parse(started_at)
+    except ValueError:
+        return 0
+    return max(0, int(delta.total_seconds() * 1000))
+
+
 def _planned_finding_ids(plan: dict[str, Any]) -> dict[str, list[str]]:
     dispatches = plan.get("dispatches")
     if not isinstance(dispatches, list):
@@ -1049,15 +1128,25 @@ def _worker_votes(
 def _collect_results(args: argparse.Namespace) -> tuple[str, Path]:
     plan = load_owned_json_object(args.plan)
     planned = _planned_finding_ids(plan)
-    dispatches = _dispatch_rows(args.dispatch)
-    undispatched = sorted(set(planned) - {row["worker"] for row in dispatches})
-    if undispatched:
+    manifest, _authority = read_execution_manifest_view(args.run_manifest)
+    if getattr(manifest, "legacy", False):
         raise ConvergenceContractError(
-            f"the round plan dispatched {undispatched} but no --dispatch status "
-            f"was given for them; a planned worker with no recorded outcome is "
-            f"indistinguishable from one that was never asked"
+            "collect-results reads dispatch outcomes from a v2 execution manifest; "
+            "a legacy v1 roster has no attempt ledger to read"
         )
+    dispatches = _dispatch_rows_from_manifest(plan, manifest, args.run_manifest)
     votes = _worker_votes(args.result, planned, args.mode == "adversarial")
+    returned_without_completion = sorted(
+        worker for worker in votes
+        if next((row["status"] for row in dispatches if row["worker"] == worker), None)
+        != "completed"
+    )
+    if returned_without_completion:
+        raise ConvergenceContractError(
+            f"{returned_without_completion} returned a result but the ledger did not "
+            "close their attempt as ok — a discarded or failed attempt's file is not "
+            "a vote"
+        )
     by_finding: dict[str, dict[str, Any]] = {}
     for worker, parsed in votes.items():
         for finding_id, vote in parsed.items():
@@ -1297,7 +1386,7 @@ def _prepare_groups(args: argparse.Namespace) -> tuple[str, Path]:
                "config": {"enabled": bool(config.get("enabled", True)),
                           "adversarial": bool(config.get("adversarial", False)),
                           "maxRounds": int(config.get("maxRounds", 2)),
-                          "effectiveMaxRounds": int(config.get("effectiveMaxRounds", 2)),
+                          "effectiveMaxRounds": int(config.get("effectiveMaxRounds", config.get("maxRounds", 2))),
                           "verificationMode": str(config.get("verificationMode", "lightweight"))},
                "workers": workers, "groups": groups}
     schema_errors = validate_schema(

package/runtime/python/okstra_ctl/convergence_provenance.py

@@ -233,3 +233,86 @@ def run_dir_provenance_errors(run_dir: Path) -> list[str]:
             )
         )
     return errors
+
+
+# 변이 감사가 결과를 폐기하고 재시도까지 막는 terminal 상태. 이 상태의 결과 파일은
+# 디스크에 남아 있어 파일 존재만 보는 provenance 검사는 통과시킨다.
+DISCARDED_ATTEMPT_STATUSES = frozenset(
+    {"contract-failed-unattributed", "mutation-present-unresolved"}
+)
+
+
+def discarded_workers(document: object, execution_manifest: object) -> dict[str, str]:
+    """``{workerId: "<invocationRef>#<attempt> <status>"}`` — 초기 attempt 가 전부
+    폐기돼 채택할 결과가 없는 분석 워커.
+
+    한 워커의 초기 invocation 이 둘 이상이면(교정 디스패치는 새 invocation 이다)
+    그중 하나라도 마지막 attempt 가 ``ok`` 면 채택 가능한 결과가 있는 것이므로
+    폐기로 보지 않는다. legacy 매니페스트나 v1 roster 는 판정하지 않는다.
+    """
+    if not isinstance(document, dict) or not isinstance(document.get("workers"), list):
+        return {}
+    if execution_manifest is None or getattr(execution_manifest, "legacy", False):
+        return {}
+    initial_refs: dict[str, set[str]] = {}
+    for invocation in getattr(execution_manifest, "invocations", ()):
+        if invocation.dispatch_kind == "initial":
+            initial_refs.setdefault(invocation.role_execution_ref, set()).add(
+                invocation.invocation_ref
+            )
+    latest: dict[str, object] = {}
+    for attempt in getattr(execution_manifest, "attempts", ()):
+        current = latest.get(attempt.invocation_ref)
+        if current is None or attempt.attempt > current.attempt:
+            latest[attempt.invocation_ref] = attempt
+    result: dict[str, str] = {}
+    for row in document["workers"]:
+        if not isinstance(row, dict):
+            continue
+        worker = row.get("workerId")
+        role_ref = row.get("sourceRoleExecutionRef")
+        if not _nonempty_string(worker) or not _nonempty_string(role_ref):
+            continue
+        rows = [latest[ref] for ref in sorted(initial_refs.get(role_ref, ())) if ref in latest]
+        if not rows or any(item.status == "ok" for item in rows):
+            continue
+        discarded = [item for item in rows if item.status in DISCARDED_ATTEMPT_STATUSES]
+        if discarded:
+            item = discarded[-1]
+            result[worker] = f"{item.invocation_ref}#{item.attempt} {item.status}"
+    return result
+
+
+def discarded_worker_errors(document: object, execution_manifest: object) -> list[str]:
+    """Groups that cite a worker whose only initial attempts were discarded.
+
+    The mutation audit discards a result by setting the attempt terminal status
+    and clearing ``resultPath``; the file itself stays in ``worker-results/``, so
+    ``provenance_errors`` (which reads the file) still passes. Observed 2026-09-06
+    (`fontsninja-v3-site` final-verification 001): the claude verifier's initial
+    attempt was ``contract-failed-unattributed`` yet 9 of 10 groups cited it and
+    3 named it ``originWorker`` — the ledger said "discarded" while convergence
+    said "adopted".
+    """
+    discarded = discarded_workers(document, execution_manifest)
+    if not discarded or not isinstance(document, dict):
+        return []
+    errors: list[str] = []
+    for group in document.get("groups") or []:
+        if not isinstance(group, dict):
+            continue
+        cited: set[str] = set()
+        origin = group.get("originWorker")
+        if isinstance(origin, str) and origin in discarded:
+            cited.add(origin)
+        discovered_by = group.get("discoveredBy")
+        if isinstance(discovered_by, dict):
+            cited.update(worker for worker in discovered_by if worker in discarded)
+        for worker in sorted(cited):
+            errors.append(
+                f"group {group.get('findingId')} cites `{worker}`, whose initial "
+                f"attempt {discarded[worker]} was discarded by the mutation audit — "
+                "a discarded result may not seed convergence; re-dispatch the worker "
+                "as a new invocation and cite that result"
+            )
+    return errors

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -11,6 +11,8 @@ import os
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 
+from .dispatch_state import abandon_agent_dispatch_attempt
+from .agent.invocation import invocation_input_digest
 from .dispatch_state import (
     CompletedWithoutResultError,
     BACKEND_CLI_WRAPPER,
@@ -896,9 +898,17 @@ def _select_workers(
     *,
     team_state: Mapping[str, Any] | None = None,
 ) -> list[str]:
-    recommended = _string_list(manifest.get("recommendedWorkers"))
-    if not recommended:
-        raise DispatchError("run manifest has no recommendedWorkers entries")
+    # 번역자 디스패치는 roster 를 읽지 않는다 — 근거는 prepare 가 심는 canonical
+    # translator role execution 이다. 그래서 빈 roster 검사보다 앞에 둔다.
+    # 종전에는 뒤에 있어서, roster 가 비는 phase 에서 이 분기에 닿을 수 없었다:
+    # `release-handoff` 는 의도적으로 single-lead 라 `_resolve_roster` 가 빈
+    # 목록을 강제하는데(`run.py`), `reportLanguage` 가 en 이 아니면 render-views 는
+    # 번역 사이드카를 요구한다. 두 요구가 겹치면 예약 경로는 "run manifest has no
+    # recommendedWorkers entries" 로, jobs-file 경로는 "jobs file translator must
+    # use canonical reservation dispatch" 로 막혀 번역자를 띄울 방법이 없었다
+    # (실측 2026-09-07, fontsninja-v3-site dev-10626 release-handoff 001 — 리드가
+    # `okstra report-translate write` 로 우회했고, 그 run 의 매니페스트에는
+    # translator role execution 과 invocationAssignments.translator 가 둘 다 있다).
     if tuple(requested_workers) == ("translator",):
         provider = _canonical_translator_provider(manifest)
         if provider is None:
@@ -911,6 +921,9 @@ def _select_workers(
                 f"{provider}"
             )
         return ["translator"]
+    recommended = _string_list(manifest.get("recommendedWorkers"))
+    if not recommended:
+        raise DispatchError("run manifest has no recommendedWorkers entries")
     if options.cli_wrapper_assignments_only:
         return _select_cli_wrapper_assignments(
             recommended,
@@ -1365,6 +1378,36 @@ def _invocation_job_fields(
     return fields
 
 
+def _initial_prompt_delivery_mode(
+    manifest: Mapping[str, Any],
+) -> PromptDeliveryMode:
+    """이 run 의 어댑터가 선언한 초기 프롬프트 배송 방식.
+
+    선언은 `leadAdapter.initialPromptDeliveryMode` 에 있고, 그 값은 render 가
+    호스트 descriptor(어댑터가 워커 디스패치를 가져갔으면 그 어댑터)에서
+    옮겨 적은 것이다. 선언이 없는 매니페스트는 이 필드가 생기기 전에 준비된
+    run 이므로 그때의 동작인 `eager-include` 로 간다. 아는 값이 아니면 멈춘다 —
+    프롬프트를 발행하고 나면 그 프롬프트는 불변이라, 잘못 고른 배송 방식은
+    나중에 고칠 수 없다.
+    """
+    adapter = manifest.get("leadAdapter")
+    declared = (
+        _string_value(adapter.get("initialPromptDeliveryMode"))
+        if isinstance(adapter, Mapping)
+        else ""
+    )
+    if not declared:
+        return PromptDeliveryMode.EAGER_INCLUDE
+    try:
+        return PromptDeliveryMode(declared)
+    except ValueError:
+        allowed = ", ".join(mode.value for mode in PromptDeliveryMode)
+        raise DispatchError(
+            "leadAdapter.initialPromptDeliveryMode is not a delivery mode: "
+            f"{declared!r} (allowed: {allowed})"
+        ) from None
+
+
 def _materialize_roster_prompts(
     project_root: Path,
     workspace_root: Path,
@@ -1384,7 +1427,7 @@ def _materialize_roster_prompts(
                 project_root=project_root,
                 run_manifest_path=manifest_path,
                 runtime_root=workspace_root,
-                delivery_mode=PromptDeliveryMode.EAGER_INCLUDE,
+                delivery_mode=_initial_prompt_delivery_mode(manifest),
                 workers=tuple(
                     InitialPromptWorkerRequest(fact.worker_id, fact.model)
                     for fact in worker_facts
@@ -1640,7 +1683,9 @@ def _record_execution_attempt(plan: DispatchPlan, job: WorkerJob) -> None:
             duty_id=job.duty_id,
             dispatch_kind=job.dispatch_kind,
             round=_dispatch_round(job.dispatch_kind),
-            input_digest=job.prompt_digest,
+            input_digest=invocation_input_digest(
+                _load_json_object(job.prompt_metadata_path, "agent metadata"), plan.project_root,
+            ),
         ),
         Attempt(
             invocation_ref=job.invocation_ref,
@@ -1763,12 +1808,15 @@ def _job_for_attempt(job: WorkerJob, attempt: int) -> WorkerJob:
         raise DispatchError(f"cannot materialize retry invocation: {exc}") from exc
     if retry.invocation_ref != job.invocation_ref:
         raise DispatchError("retry invocation reference changed")
+    metadata = _load_json_object(retry.metadata_path, "retry agent metadata")
     return replace(
         job,
         prompt_path=retry.prompt_path,
         prompt_metadata_path=retry.metadata_path,
         invocation_id=retry.invocation_id,
         attempt=retry.attempt,
+        instruction_digest=metadata["digests"]["instructionDigest"],
+        prompt_digest=metadata["digests"]["promptDigest"],
     )
 
 
@@ -1932,6 +1980,8 @@ def _advance_running_dispatches(plan: DispatchPlan, records: Sequence[Mapping[st
         status_path = _optional_path(record.get("statusSidecarPath"))
         status = read_wrapper_status(status_path) if status_path else None
         if status is None or not status.is_terminal:
+            if status is not None and _wrapper_process_is_gone(status):
+                _settle_dead_dispatch(plan, record, status)
             continue
         outcome = _outcome_from_status(record, status)
         retry_allowed = _finish_record(plan, record, outcome)
@@ -1942,6 +1992,78 @@ def _advance_running_dispatches(plan: DispatchPlan, records: Sequence[Mapping[st
             _retry_from_record(plan, record, outcome)
 
 
+def _wrapper_process_is_gone(status) -> bool:
+    """wrapper 가 terminal 상태를 쓰기 전에 죽었는가.
+
+    cmux-pane·cli-wrapper 의 liveness 는 status 사이드카 하나다(`_liveness_mode`).
+    wrapper 는 종료 트랩에서 `stage: exited` 를 쓰므로, 프로세스는 없는데 상태가
+    `started` 면 트랩이 돌지 못한 죽음이다 — pane 이 닫혔거나 호스트가 죽였거나
+    import 오류로 로그 한 줄 못 남긴 경우. 실측(2026-09-06, fontsninja-v3-site
+    final-verification 001): critic wrapper 로그가 시작 110초 뒤 끊겼는데 attempt
+    는 32분 뒤 리드가 손으로 abandon 할 때까지 `started` 였다.
+
+    pid 가 사라진 뒤 상태를 한 번 더 읽는다 — 트랩이 상태를 쓰고 프로세스가
+    빠져나가는 그 사이에 첫 읽기가 끼었을 수 있다. 그때는 다음 폴링이 terminal
+    을 읽으므로 여기서 죽음으로 보지 않는다.
+    """
+    pid = status.pid
+    if pid is None or pid <= 0:
+        return False
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        # expected-miss: 프로세스 부재가 이 함수가 묻는 답이다 — 예외가 곧 "죽었다"
+        # 는 결과이고, 그 판정을 아래 재읽기가 확인한다.
+        process_gone = True
+    except PermissionError:
+        # 다른 사용자의 살아 있는 프로세스. 시그널 0 은 거부돼도 존재는 확인된다.
+        process_gone = False
+    else:
+        process_gone = False
+    if not process_gone:
+        return False
+    refreshed = read_wrapper_status(status.path)
+    return refreshed is not None and not refreshed.is_terminal
+
+
+def _settle_dead_dispatch(plan: DispatchPlan, record: Mapping[str, Any], status) -> None:
+    """죽은 wrapper 의 dispatch 를 원장에 맞게 닫는다.
+
+    `source-readonly` attempt 는 `abandon_agent_dispatch_attempt` 로 닫는다 — 그
+    정책은 아무것도 쓰지 않았다는 단언이 정책상 참이라 추측이 없다. `project-mutation`
+    attempt 는 열어 둔 채 dispatch 행만 `error` 로 바꾼다 — 반쯤 바뀐 트리 위에서
+    다시 돌지 않게 하려면 변이 감사가 그 attempt 를 판정해야 한다. 어느 쪽도 자동
+    재시도는 하지 않는다: pane 이 죽은 뒤의 재실행은 아무도 보고 있지 않은 작업이다.
+    """
+    attempt = int(record.get("attempt", 1))
+    job = _job_from_record(plan.project_root, record)
+    reason = (
+        f"wrapper pid {status.pid} exited without writing a terminal status "
+        f"(stage `{status.stage}`)"
+    )
+    contract = _persisted_write_contract(plan, job)
+    mode = contract[0].source_mode if contract is not None else "unknown"
+    closed = None
+    if mode == "source-readonly" and job.invocation_id:
+        closed = abandon_agent_dispatch_attempt(
+            project_root=plan.project_root,
+            run_manifest_path=plan.manifest_path,
+            invocation_ref=job.invocation_id,
+            reason=reason,
+        )
+    else:
+        reason += "; attempt left open for the mutation audit"
+    _update_dispatch_status(plan.team_state_path, job, attempt, "error", reason)
+    details = _event_execution_identity(job, attempt)
+    details.update({
+        "pid": status.pid,
+        "sourceMode": mode,
+        "attemptClosed": closed is not None,
+        "reason": reason,
+    })
+    _append_event(plan, "worker-dead-detected", details)
+
+
 def _retry_from_record(
     plan: DispatchPlan, record: Mapping[str, Any], outcome: WorkerOutcome
 ) -> None:

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -35,6 +35,7 @@ from .agent.invocation import (
     InvocationMetadataIdentity,
     agent_model_assignment_from_payload,
     invocation_metadata_identity,
+    invocation_input_digest,
     v2_role_assignment_authority_errors,
     verify_agent_invocation,
 )
@@ -113,11 +114,6 @@ LIVENESS_WRAPPER_STATUS = "wrapper-status"
 # so the string lives here rather than in whichever module wrote it first.
 TEARDOWN_BEFORE_TERMINAL_REASON = "teardown before terminal status"
 
-# The worktree argument grants the wrapper `--add-dir` write access outside
-# project-root. Only the phases whose workers mutate a stage worktree get it;
-# analysis phases write their artifacts under project-root (see the contract in
-# scripts/okstra-codex-exec.sh).
-WORKTREE_TASK_TYPES = frozenset({"implementation", "final-verification"})
 WORKER_STATUSES = frozenset(
     {"in-progress", "completed", "timeout", "error", "not-run"}
 )
@@ -362,8 +358,6 @@ def resolve_required_path(
 def worktree_path(
     manifest: Mapping[str, Any], active_context: Mapping[str, Any]
 ) -> str:
-    if manifest.get("taskType") not in WORKTREE_TASK_TYPES:
-        return ""
     worktree = active_context.get("executorWorktree")
     if not isinstance(worktree, Mapping):
         return ""
@@ -706,7 +700,6 @@ def record_verified_agent_dispatch(
         return record
     if execution_identity is not None:
         dispatch_kind = require_string(metadata, "dispatchKind")
-        prompt_digest = require_string(digests, "promptDigest")
         if write_policy is None or write_enforcement is None:
             raise DispatchError("agent write contract was not prepared")
         record_invocation_attempt(
@@ -720,7 +713,7 @@ def record_verified_agent_dispatch(
                 duty_id=execution_identity.duty_id,
                 dispatch_kind=dispatch_kind,
                 round=_execution_dispatch_round(dispatch_kind),
-                input_digest=prompt_digest,
+                input_digest=invocation_input_digest(metadata, project_root),
             ),
             Attempt(
                 invocation_ref=execution_identity.invocation_ref,
@@ -2149,6 +2142,21 @@ def worker_jobs_from_file(
         resolve_project_path(project_root, str(jobs_file)),
         "jobs file",
     )
+    return worker_jobs_from_payload(
+        project_root, payload, manifest=manifest, active_context=active_context,
+        backend=backend, idle_timeout_seconds=idle_timeout_seconds,
+        default_dispatch_kind=default_dispatch_kind, resolve_wrapper=resolve_wrapper,
+        default_provider=default_provider,
+    )
+
+
+def worker_jobs_from_payload(
+    project_root: Path, payload: Mapping[str, Any], *,
+    manifest: Mapping[str, Any], active_context: Mapping[str, Any] | None = None,
+    backend: str, idle_timeout_seconds: int | None, default_dispatch_kind: str,
+    resolve_wrapper: Callable[[str], Path], default_provider: Callable[[str], str],
+) -> list[WorkerJob]:
+    """파일 소비자와 생성기가 동일한 배치 계약을 검사한다."""
     dispatch_kind = string_value(payload.get("dispatchKind")) or default_dispatch_kind
     workers = payload.get("workers")
     if not isinstance(workers, list):

package/runtime/python/okstra_ctl/domain/host.py

@@ -51,6 +51,11 @@ class HostDescriptor:
     session_accounting: str
     has_claude_session: bool
     relay_contract: str
+    # 이 호스트가 초기 워커 프롬프트를 어떻게 싣겠다고 선언하는가. 값은
+    # `relay.md` 의 `initialPromptDeliveryMode` 행과 같아야 한다 — 그 표를
+    # 읽고 dispatch 를 판단하는 것은 리드이고, 실제로 프롬프트를 만드는 것은
+    # 이 값을 받는 `initial_prompt_materialization` 이다.
+    initial_prompt_delivery_mode: str = "eager-include"
 
 
 @dataclass(frozen=True)

package/runtime/python/okstra_ctl/domain/wizard/interaction.py

@@ -11,6 +11,7 @@ class WizardOption:
     value: str
     label: str
     description: str = ""
+    recommended: bool = False
 
 
 @dataclass(frozen=True)