okstra 0.190.0 → 0.191.1

package/docs/architecture.md

@@ -937,11 +937,15 @@ Tokens used in each run are collected from lead/worker session transcripts and w
 - Helper CLI: `scripts/okstra-token-usage.py`
 - Collection sources:
   - Claude lead/workers: per-message `message.usage` in `~/.claude/projects/<cwd-as-dashes>/<sessionId>.jsonl` or `~/.claude/projects/<cwd-as-dashes>/<lead-session>/subagents/agent-a<worker-name>-<hash>.jsonl`. Worker names are recovered from nested-subagent filenames, and only the directory for the current run's `team-state.lead.sessionId` is counted.
-  - Codex CLI: final `total_token_usage.total_tokens` in `~/.agent/sessions/Y/M/D/rollout-*.jsonl`
+  - Codex CLI: final `total_token_usage.total_tokens` in `~/.codex/sessions/Y/M/D/rollout-*.jsonl` (`$CODEX_HOME/sessions` first, then `~/.agent/sessions`). An in-session codex lead (`entryMode: current-session`) opened its rollout before the run and keeps it after, so its cumulative snapshot is the whole session; the lead is counted as the sum of `last_token_usage` over the `token_count` events inside the run window (`codex_session_window_total`), and a session that started before the window still qualifies when it wrote inside it (`find_codex_sessions(active_before_start=True)`).
+  - Grok CLI: the sum of the `usage` records in `~/.grok/sessions/<percent-encoded cwd>/<sessionId>/updates.jsonl` — one record is one prompt's usage (`numTurns` model calls, input re-sent each call), not a running total, so the last record alone is only the last prompt. grok (and kimi) run *inside* the stage worktree, so the directory is encoded from the worktree path, not the project root. An in-session grok lead is counted over the records inside the run window (`grok_session_window_total`), and a session that started before the window still qualifies when it wrote inside it (`find_grok_sessions(active_before_start=True)`).
+  - Claude workers on a non-Claude host: the wrapper runs `claude -p --session-id <id>`, and the transcript is `~/.claude/projects/<cwd-as-dashes>/<id>.jsonl`, found by the id `workerDispatches[].sessionId` recorded at dispatch.
+- **Attribution key is the dispatch ledger, not the roster row.** `workers[].promptPath` names one prompt — the first dispatch — and v2 lead events carry no `workerId`. Every re-dispatch (reverify, critic-gap, plan-verify, report-writer re-author) is a new wrapper run with its own prompt, `.status.json`, and transcript, and only `team-state.workerDispatches[]` lists them all (`dispatch_state.worker_dispatch_records`, keyed by `workerId` or the last segment of `assignmentRef`). The collector takes one wrapper window per record, unions the transcripts found under each record's `worktreePath` and the project root, and sums them; wall-clock is the sum of the wrapper windows. Observed before this rule (2026-09-08, a codex-host planning run): codex counted 1 of 5 sessions, grok 0 of 1, claude 0 of 7.
   - Antigravity CLI: the `usage` snapshot in the wrapper `<prompt>.status.json` — the runner records the last `usage` the `agy` stream reported (`result.usage` on a run that closed). The CLI writes no transcript under the home directory, and the worker `.log` is the stream rewritten as readable lines, not stream-json.
 - CLI execution evidence and token attribution are independent. A wrapper `.status.json` proves `not-started`, `started`, `exited`, `timeout`, or `failed` and supplies the worker's collection window; only a matching transcript with a final token snapshot — or, for a provider without a home transcript, the `usage` snapshot the runner wrote into that `.status.json` — proves attributable usage. If a wrapper exited successfully but no attributable transcript exists, the worker remains `source: "unavailable"` with `cliExecutionStatus: "exited"` and a reason instead of becoming zero usage or being described as never invoked.
 - Records billable-equivalent token math and USD cost estimates. It applies Anthropic billing ratios (`cache_creation_5m=1.25x`, `cache_creation_1h=2.0x`, `cache_read=0.1x`, `output=5x`). When the transcript provides separate `usage.cache_creation.ephemeral_5m_input_tokens` / `ephemeral_1h_input_tokens` values, they are counted separately.
-- Pricing is centrally managed in `scripts/okstra_token_usage/pricing.py`. Update it when model prices change. Model IDs that fail price matching are exposed to the user in `usageSummary.unmatchedModels`, preventing silent-zero incidents.
+- Pricing is centrally managed in `scripts/okstra_token_usage/pricing.py` (Claude and Gemini rate tables) and in each provider catalog's `ModelSpec(pricing=...)` (codex, grok, kimi — merged through `catalog_pricing`). Update it when model prices change. Model IDs that fail price matching are exposed to the user in `usageSummary.unmatchedModels`, preventing silent-zero incidents.
+- **Cost is always the public list price, regardless of how the account is billed.** The report answers "how much was consumed", not "what the invoice says": a model served under a ChatGPT/Claude subscription is still priced at its API rate, so every selectable catalog row must carry a price. The one row without a price is `codex-auto-review`, for which no public rate exists.
 - Project-wide historical usage is exposed through the read-only `okstra usage-report` command (`scripts/okstra_ctl/usage_report.py`) and the `okstra-usage` skill. It defaults to the whole current project's last 30 days and returns run coverage, raw and billable-equivalent tokens, known USD cost, CPU-sum milliseconds, and wall-clock milliseconds grouped by task type. Runs without usable Phase 7 usage are excluded from resource totals and reported through unavailable reason counts rather than treated as zero usage; unmatched model names remain visible when their tokens and time are included but their cost is not. Use `okstra-inspect` for one task's elapsed/context detail and `okstra-rollup` for task-group or project status/report digests.
 - **Incremental scan cache (P6)**: To avoid rescanning session jsonl files, a per-file byte cursor and the extracted usage events before windowing are stored in `$OKSTRA_HOME/cache/token-usage/<transcript-dir>/<sessionId>.json` (`scripts/okstra_token_usage/cursor.py`). The run window (since/until) is reevaluated over events on every invocation, so even if a rerun narrows the window, the total matches a full scan. The cache is derived data; identifier mismatch, truncation, or corruption automatically falls back to a full rescan, and `okstra-token-usage.py --no-cache` forces a bypass.
 - **Phase timeline (P0 instrumentation)**: The collector extracts `PROGRESS: phase-*` checkpoint lines (see "Progress reporting" in prompts/lead/okstra-lead-contract.md) from the lead session jsonl scoped to the run window, and records them in team-state as a `phaseTimeline` block (`{source, phases: [{phase, firstAt, lastAt, markerCount, wallMsToNext}]}`) (`scripts/okstra_token_usage/collect.py :: phase_timeline`). This provides measurement points for per-phase wall-clock time within the run and is consumed by the "Per-run phase breakdown" in the `okstra-inspect` time facet. Runs without markers explicitly report that measurement is unavailable with `phases: []`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.190.0",
+  "version": "0.191.1",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.190.0",
-  "builtAt": "2026-09-08T19:21:43.911Z",
+  "package": "0.191.1",
+  "builtAt": "2026-09-08T22:08:39.785Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/bin/okstra-report-translate.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 import argparse
 import hashlib
 import json
+import re
 import os
 import sys
 from pathlib import Path
@@ -199,17 +200,31 @@ def _translation_block(rows: list[str]) -> str:
     return "\n".join(rows).strip().replace("\\`", "`")
 
 
+_T_HEADING_RE = re.compile(r"^#{1,6}\s+T-\d{3}\b")
+
+
 def _translation_blocks(path: Path) -> list[str]:
     text = path.read_text(encoding="utf-8")
     blocks: list[str] = []
     current: list[str] | None = None
-    for row in text.splitlines():
+    for number, row in enumerate(text.splitlines(), start=1):
+        # 헤딩 수준이 다른 `### T-NNN` 은 블록 경계로 안 보여 본문에 묻히고, 그러면
+        # 블록 수 불일치라는 엉뚱한 메시지가 났다(실측 2026-09-08: id 164개 전부
+        # 일치, 틀린 것은 `#` 개수뿐). 경계처럼 생긴 줄은 여기서 이름을 대고 거절한다.
+        if _T_HEADING_RE.match(row) and not row.startswith("## T-"):
+            raise SystemExit(
+                f"error: translation heading must be level 2 — line {number} is "
+                f"{row.split()[0]!r}, expected '## T-NNN' ({path.name})"
+            )
         if row.startswith("## T-"):
             if current is not None:
                 blocks.append(_translation_block(current))
             expected = f"## T-{len(blocks) + 1:03d}"
             if row != expected:
-                raise SystemExit(f"error: expected translation heading {expected}")
+                raise SystemExit(
+                    f"error: expected translation heading {expected} at line {number}, "
+                    f"found {row!r} ({path.name})"
+                )
             current = []
         elif current is not None:
             current.append(row)
@@ -232,8 +247,18 @@ def cmd_write(args: argparse.Namespace) -> int:
     _validate_source_payload(source, expected, args.source_digest)
     sources = expected["strings"]
     translated = _translation_blocks(Path(args.translations))
-    if len(translated) != len(sources) or any(not value for value in translated):
-        raise SystemExit("error: translation blocks must match every T-NNN item")
+    if len(translated) != len(sources):
+        raise SystemExit(
+            f"error: translation blocks must match every T-NNN item — "
+            f"{len(translated)} blocks in {Path(args.translations).name}, "
+            f"{len(sources)} items in the translation source"
+        )
+    empty = [f"T-{index + 1:03d}" for index, value in enumerate(translated) if not value]
+    if empty:
+        raise SystemExit(
+            "error: translation blocks must match every T-NNN item — empty: "
+            + ", ".join(empty[:10])
+        )
     lang = expected["lang"]
     sidecar = translation_sidecar_path(data_path, lang)
     if sidecar.is_symlink():

package/runtime/prompts/lead/convergence.md

@@ -89,7 +89,7 @@ Read the worker result files generated in Phase 4/5 and extract individual findi
   - Same semantics but disjoint ticket sets → separate groups (do NOT over-merge across tickets).
   - Only one worker confirms a finding → one single-source group.
 4. When grouping is ambiguous, prefer splitting over merging (avoid over-merging). Semantic matching, ticket-set equality, and evidence interpretation remain lead judgments; the engine does not perform fuzzy matching or decide whether evidence is credible.
-5. Author the fixed grouping Markdown accepted by `okstra convergence prepare-groups --run-manifest <run-manifest> --input <grouping.md>`, then run that command. Python owns the artifact identifier, target path, schema version, task identity, run-manifest reference, and every participant reference. Each Markdown group records ticket IDs, origin worker and evidence, discovering workers, source worker item IDs, and optional captured evidence. An analysis sidetrack with no ticket uses an empty `Tickets:` value, never a placeholder. Use the ordered functional roster: finding workers have the `analysis` audience, the report author has `report-writer`, and the lead uses `lead`. A lead source never votes. Never infer live evidence or functional scope from wording, provider, model, or execution label.
+5. Author the fixed grouping Markdown accepted by `okstra convergence prepare-groups --run-manifest <run-manifest> --input <grouping.md>`, then run that command. Python owns the artifact identifier, target path, schema version, task identity, run-manifest reference, and every participant reference. Each Markdown group records ticket IDs, origin worker and evidence, discovering workers, source worker item IDs, and optional captured evidence. An analysis sidetrack with no ticket uses an empty `Tickets:` value, never a placeholder. Use the ordered functional roster: finding workers have the `analysis` audience, the report author has `report-writer`, and the lead uses `lead`. A lead source never votes. For `implementation` runs the convergence sources are the verifier-role results only — the executor's result is deliverable evidence, not a convergence source (**Enforced:** `_validate_worker_execution_identity` in `scripts/okstra_ctl/convergence_engine.py` rejects an `implementer` source with `analysis audience source role is not allowed`). Never infer live evidence or functional scope from wording, provider, model, or execution label.
 
    The command sets each worker's paired `participantRef` and `sourceRoleExecutionRef` from the run manifest's canonical role state. It sets `sourceRoleExecutionRef` to the selected source `RoleExecution` row's `roleExecutionRef`, not that row's `sourceRoleExecutionRef` field.
 6. Do not write a queue or classification in this grouped-input artifact. `okstra convergence seed` classifies Round 0 the same way in both modes: a group whose sources are **two or more distinct role executions** becomes `full-consensus` immediately, and only single-source groups enter the working queue. Independent co-derivation is already cross-verification — the adversarial burden of proof targets single-source claims, not a finding two roles reached on their own. A source is counted once per analysis worker, and one analysis worker is exactly one `sourceRoleExecutionRef` — the same identity the reverify roster uses for independence — so two roles held by one provider count as two and no role can count twice. **Enforced:** `_parse_workers` rejects a duplicate `workerId` and `_validate_worker_execution_identity` rejects a duplicate `sourceRoleExecutionRef`, both in `scripts/okstra_ctl/convergence_engine.py`. Semantic grouping merges provenance only; it does not decide a single-source finding is reliable. Section 6 never enters the grouped input.

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -146,7 +146,7 @@ Do NOT replace them with prose ("Now I'm starting Phase 2..."), do NOT skip a ch
 
 `okstra-run` surfaces these lines to the user directly; `okstra lead-progress append` persists them in the selected adapter's declared conformance evidence/event source for post-hoc retrieval.
 
-**Enforcement:** the Phase 7 validator (`validators/validate-run.py` → `validate_session_conformance.py`) reads the selected adapter's declared conformance evidence/event source within the run window and fails the run as `contract-violated` when a required checkpoint is missing — including the per-worker `phase-4-dispatch` / `phase-5-collect` lines (which must name each worker's role) and the `phase-batch-cleanup` lines that MUST precede the first `phase-5.5-convergence` round and the `phase-6-synthesis` report-writer dispatch. When the plan-body state file records two or more rounds, `_check_plan_verify_cleanup_checkpoints` additionally requires a `phase-5.5.9-plan-verify` line per round and a `phase-batch-cleanup` between consecutive rounds. For `implementation`, `_check_progress_checkpoints` additionally requires the `phase-5-stage` announcement once any worker is dispatched, and the `phase-5-stage-complete` line once an implementer worker completed. For activity-contract-v1 planning, `_check_activity_contract` validates the structured worker pairs, verification and self-fix counts, user-decision references, and `A-NNN` ordering. `phase-7-teardown` and `complete` fire after validation and are not checked.
+**Enforcement:** the Phase 7 validator (`validators/validate-run.py` → `validate_session_conformance.py`) reads the selected adapter's declared conformance evidence/event source within the run window and fails the run as `contract-violated` when a required checkpoint is missing — including the per-worker `phase-4-dispatch` / `phase-5-collect` lines (which must name each worker's role) and the `phase-batch-cleanup` lines that MUST precede the first `phase-5.5-convergence` round and the `phase-6-synthesis` report-writer dispatch. When the plan-body state file records two or more rounds, `_check_plan_verify_cleanup_checkpoints` additionally requires a `phase-5.5.9-plan-verify` line per round and a `phase-batch-cleanup` between consecutive rounds. For `implementation`, `_check_progress_checkpoints` additionally requires the `phase-5-stage` announcement once any worker is dispatched, and the `phase-5-stage-complete` line once an implementer worker completed **and** this stage's carry sidecar exists (`_stage_carry_persisted`) — a stage whose carry was withheld (`FAIL` / non-result) is not asked for the line. For activity-contract-v1 planning, `_check_activity_contract` validates the structured worker pairs, verification and self-fix counts, user-decision references, and `A-NNN` ordering. `phase-7-teardown` and `complete` fire after validation and are not checked.
 
 ## Asking the user (BLOCKING)
 

package/runtime/python/okstra_ctl/adapters/hosts/codex/relay.md

@@ -115,11 +115,25 @@ For `request_user_input`, send one to three questions. Each question carries `id
 For a `host-text` mapping, render each numbered item as its option label followed by its description verbatim; preserve every item and its order. The next user message is the raw answer: do not translate a number such as `1`, a CSV reply such as `1, 3`, an option label, or an option value before `okstra wizard step`. For `sequential-group`, collect one raw reply per question in order and build one compact JSON object keyed by the corresponding `questions[].step`; the wizard owns all normalization.
 
 
+### Runtime-generated selectable screens
+
+`wizard/engine.py` adapts choice screens before returning `next` when the session declares `native_single_select`. `wizard/picker_navigation.py` preserves all original choices while paging long lists, collecting multi-selection through toggle/complete choices, and disambiguating duplicate labels. Oversized or unsupported groups are presented one member at a time. These paths are exercised by `tests/domain/wizard/test_picker_navigation.py` and `test_role_model_selection.py`.
+
+Render exactly the returned current screen using its `interaction.kind`, including navigation and completion options. Submit their original values through `okstra wizard step` like other options. The runtime keeps navigation and partial selections in the state file and does not submit the underlying workflow decision until selection is complete. Do not reconstruct the full model list, perform pagination yourself, or replace model choices with a request to type `provider/model`. A repeated step ID after navigation or a toggle is the next screen, not a duplicated question; render that newly returned screen once.
+
+If the runtime still returns a numbered interaction when the user requires a selector, preserve the state and check installation and live capabilities. Do not invent a text-input exception. Text steps remain text steps; a direct-input choice is selected through the picker before the runtime asks for the custom value.
+
+### Plan decisions and execution permissions
+
+Classify the requested action, not the word "approval". The wizard's `approve_plan_confirm` is a workflow decision about adopting the selected plan; it is a `pick` prompt built by `_build_approve_plan_confirm` in `wizard/steps_plan.py`. Render its existing options through the available native selector, just like task type and plan selection. Explain the effect of each option in the question tool and map the selected label back to its original value (`yes`, `no`, or `yes_apply` when offered). Recording that decision in okstra artifacts does not turn the question into a host permission request. Do not ask the user to type an approval word or switch to prose merely because this step is called approval.
+
+Host permission requests concern execution privileges, sandbox escalation, or access to a protected resource. Use the host's permission mechanism for those requests; a wizard answer does not grant those privileges. If a subsequent command requires such permission, handle it separately at that command.
+
 ### Client-aware question tool selection
 
 Before intersecting `semanticFunctions` with live capabilities, prefer `request_user_input` when the current session permits that call. Use its live restrictions rather than assuming it is always Plan-only: Codex CLI can enable it in Default mode with `default_mode_request_user_input`. The JSON mapping above remains the terminal picker contract.
 
-Use `request_user_input_async` only when the current client explicitly supports interactive asynchronous question cards, such as the Codex desktop app, and the synchronous tool is unavailable. Callable does not mean selectable: the Codex terminal (`codex-tui`, session source `cli`) can accept an asynchronous question but render it as a plain bulleted agent message. Do not count that terminal delivery as `native_single_select` or `native_question_group`. For a supported desktop client, replace the `function` of both native entries above with `request_user_input_async` and use the mapping below. Keep the conservative `nativeLimits` and the numbered mapping for multi-selection.
+Use `request_user_input_async` only when the current client explicitly supports interactive asynchronous question cards, such as the Codex desktop app, and the synchronous tool is unavailable. Callable does not mean selectable: the Codex terminal (`codex-tui`, session source `cli`) can accept an asynchronous question but render it as a plain bulleted agent message. Do not count that terminal delivery as `native_single_select` or `native_question_group`. For a supported desktop client, replace the `function` of both native entries above with `request_user_input_async` and use the mapping below. Keep the declared `nativeLimits`; the runtime generates the selectable screens within those limits.
 
 If the user requested a selectable interface in the terminal and `request_user_input` is unavailable, keep the current wizard step pending instead of printing its options. `okstra install` enables `features.default_mode_request_user_input` when a Codex home exists, through `ensureCodexQuestionPicker` in `src/lib/host-config.mts`. Restart or resume the Codex session after installation and reread this relay. Changing the feature does not replace the current session's tool catalog. Preserve the existing wizard state-file path and call `okstra wizard step --state-file <existing-path> --no-submit` after resuming; do not initialize a replacement wizard or submit a guessed answer. If installation reports a configuration shape it cannot safely edit, its recovery command is `codex features enable default_mode_request_user_input`. Apply a configuration change only when authorized by the user, otherwise present the recovery command. The feature's availability is reported by `codex features list`; older clients without it need a client update or a mode in which the synchronous tool is permitted.
 

package/runtime/python/okstra_ctl/adapters/providers/codex/adapter.py

@@ -21,11 +21,17 @@ import okstra_ctl.model_discovery as model_discovery
 # `gpt-5.6` is not a slug that catalog offers at all, so it is gone from here;
 # its rate moved to `_LEGACY_CODEX_PRICING` so past runs still price.
 CODEX = {
-    # ChatGPT-account hosts serve these models without per-token billing.
-    "gpt-6-astra": ModelSpec("gpt-6-astra", "gpt-6-astra", "gpt-6-astra"),
-    "gpt-5.6-sol": ModelSpec("gpt-5.6-sol", "gpt-5.6-sol", "gpt-5.6-sol"),
-    "gpt-5.6-terra": ModelSpec("gpt-5.6-terra", "gpt-5.6-terra", "gpt-5.6-terra"),
-    "gpt-5.6-luna": ModelSpec("gpt-5.6-luna", "gpt-5.6-luna", "gpt-5.6-luna"),
+    # 비용은 계정이 구독이든 API 든 공개 API 단가(입력·캐시 입력·출력 USD/1M)로
+    # 추정한다 — 리포트가 답하는 것은 "얼마나 썼는가" 이지 "청구서에 얼마가
+    # 찍히는가" 가 아니다. 단가를 비우면 그 워커의 비용이 `--` 로 빠지고, 접두어
+    # 폴백(`_LEGACY_CODEX_PRICING`)에 걸리면 terra·luna 가 sol 단가로 과대
+    # 계상된다(실측 2026-09-08). 출처: OpenAI 표준 등급, 2026-09 기준
+    # (morphllm.com/openai-api-pricing, cloudzero.com/blog/openai-pricing,
+    # layer3labs.io/guides/gpt-6-astra-api-pricing).
+    "gpt-6-astra": ModelSpec("gpt-6-astra", "gpt-6-astra", "gpt-6-astra", pricing=(10.0, 1.0, 50.0)),
+    "gpt-5.6-sol": ModelSpec("gpt-5.6-sol", "gpt-5.6-sol", "gpt-5.6-sol", pricing=(5.0, 0.50, 30.0)),
+    "gpt-5.6-terra": ModelSpec("gpt-5.6-terra", "gpt-5.6-terra", "gpt-5.6-terra", pricing=(2.0, 0.20, 12.0)),
+    "gpt-5.6-luna": ModelSpec("gpt-5.6-luna", "gpt-5.6-luna", "gpt-5.6-luna", pricing=(0.20, 0.02, 1.20)),
     # picker 에서는 감춘다. 엔트리는 남긴다 — 과거 run 의 토큰 사용량을
     # 정산할 때 pricing 을 이 표에서 찾는다.
     "gpt-5.4-mini": ModelSpec("gpt-5.4-mini", "gpt-5.4-mini", "gpt-5.4-mini", pricing=(0.75, 0.075, 4.50), selectable=False),

package/runtime/python/okstra_ctl/adapters/providers/kimi/adapter.py

@@ -19,9 +19,12 @@ from okstra_ctl.domain.worker_stream import content_block_events
 KIMI = {
     "kimi-k3": ModelSpec("kimi-k3", "Kimi K3", "kimi-k3", aliases=("kimi k3",), pricing=(3.00, 0.30, 15.00)),
     # picker 에서는 감춘다: kimi-k3 와 표시명·실체가 같아 목록에 두 줄로 뜬다.
-    "k3": ModelSpec("k3", "Kimi K3", "k3", selectable=False),
+    # 단가는 kimi-k3 와 같다 — 같은 모델의 다른 슬러그이고, `_match_pricing` 은
+    # `kimi-k3` 키를 `k3` 관측값에 맞추지 못하므로 행마다 값을 둔다. k3-256k 는
+    # Moonshot 이 별도 단가를 공개하지 않아 K3 단가를 쓴다(2026-09-08 확인).
+    "k3": ModelSpec("k3", "Kimi K3", "k3", pricing=(3.00, 0.30, 15.00), selectable=False),
     # picker 에서는 감춘다(사유는 codex 의 gpt-5.4-mini 와 동일).
-    "k3-256k": ModelSpec("k3-256k", "Kimi K3 256K", "k3-256k", aliases=("kimi k3 256k",), selectable=False),
+    "k3-256k": ModelSpec("k3-256k", "Kimi K3 256K", "k3-256k", aliases=("kimi k3 256k",), pricing=(3.00, 0.30, 15.00), selectable=False),
 }
 
 

package/runtime/python/okstra_ctl/convergence_engine.py

@@ -2420,9 +2420,15 @@ def _validate_worker_execution_identity(
             )
         allowed_roles = _AUDIENCE_SOURCE_ROLES[worker["audience"]]
         if source.role not in allowed_roles:
+            hint = ""
+            if source.role == "implementer":
+                hint = (
+                    " — the executor's result is deliverable evidence, not a "
+                    "convergence source; group the verifier results instead"
+                )
             raise ConvergenceContractError(
                 f"{worker['audience']} audience source role is not allowed: "
-                f"{source.role}"
+                f"{source.role} (allowed: {', '.join(sorted(allowed_roles))}){hint}"
             )
     source_refs = [worker["sourceRoleExecutionRef"] for worker in workers]
     if len(source_refs) != len(set(source_refs)):

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -631,7 +631,17 @@ def _dispatch_cli_wrapper_batch(
             contract is not None and contract[1].mutation_audit == "batch"
             for contract in contracts
         )
-        if needs_batch and baseline_snapshot is None:
+        # 재시도 라운드는 baseline 을 다시 찍는다. 쓰기 계약은 attempt 소유라
+        # (`_persisted_write_contract`) attempt 2 의 정책 digest 는 attempt 1 과
+        # 다른데, 첫 라운드의 baseline 을 그대로 쓰면 마감의
+        # `_validate_snapshot_authority` 가 `policyDigests` 불일치로 죽고 attempt-N
+        # 사이드카는 끝내 안 써진다(실측 2026-09-08, translator attempt 2:
+        # 산출물 완전·exit 0 인데 dispatcher 예외). 앞 라운드에서 완주한 동료의
+        # 변경은 그 attempt 의 감사가 이미 판정했으므로 새 baseline 에 흡수돼도
+        # 맞다 — 재시도는 `failed-no-mutation` 뒤에만 오므로(`retry_allowed`)
+        # 미해결 변경이 baseline 으로 세탁되지는 않는다.
+        retry_round = any(attempt > 1 for _job, attempt in prepared)
+        if needs_batch and (baseline_snapshot is None or retry_round):
             baseline_snapshot = _mutation_snapshot(
                 plan, policies, tuple(job for job, _ in prepared)
             )

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -1692,16 +1692,39 @@ def worker_session_ids(
     here, the same way `add_observed_session` keeps it for the keys it appends to.
     """
     session_ids: list[str] = []
+    for record in worker_dispatch_records(team_state, worker_id):
+        session_id = str(record.get("sessionId") or "").strip()
+        if session_id and session_id not in session_ids:
+            session_ids.append(session_id)
+    return session_ids
+
+
+def worker_dispatch_records(
+    team_state: Mapping[str, Any], worker_id: str | None = None
+) -> list[Mapping[str, Any]]:
+    """한 워커(또는 run 전체)의 `workerDispatches[]` 행을 기록된 순서대로.
+
+    사용량 수집이 워커의 실행 증거를 찾는 열쇠는 이 행들이다 — 프롬프트 경로
+    (status 사이드카 → 래퍼 창), 세션 id(claude 트랜스크립트), 워크트리 경로
+    (grok·kimi 는 그 안에서 돌아 세션 디렉터리가 그 경로로 인코딩된다).
+    `workers[]` 행의 `promptPath` 는 첫 dispatch 하나만 가리키므로 재검증·
+    critic-gap·plan-verify 로 다시 띄운 세션은 거기서 보이지 않는다(실측
+    2026-09-08 jobs implementation-planning r01: codex 5회 dispatch 중 1회만
+    집계, v2 명부 행 `scope` 는 `promptPath` 가 비어 0회).
+
+    v1 행은 `workerId`, v2 행은 `assignmentRef` 마지막 마디로 워커에 묶인다
+    (`_dispatch_worker_key`). 리스트가 아니면 빈 결과 — `worker_session_ids`
+    와 같은 이유로 호출자를 깨지 않는다.
+    """
     dispatches = team_state.get("workerDispatches")
+    records: list[Mapping[str, Any]] = []
     for record in dispatches if isinstance(dispatches, list) else []:
         if not isinstance(record, Mapping):
             continue
         if worker_id is not None and _dispatch_worker_key(record) != worker_id:
             continue
-        session_id = str(record.get("sessionId") or "").strip()
-        if session_id and session_id not in session_ids:
-            session_ids.append(session_id)
-    return session_ids
+        records.append(record)
+    return records
 
 
 def _dispatch_worker_key(record: Mapping[str, Any]) -> str:

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -281,12 +281,25 @@ def _validate_snapshot_authority(
     policies: tuple[WritePolicy, ...],
 ) -> None:
     expected = tuple(policy.digest for policy in policies)
-    if (
-        before.root != after.root
-        or before.artifact_root != after.artifact_root
-        or before.policy_digests != expected
-    ):
-        raise MutationAuditError("mutation snapshot does not match batch policies")
+    mismatches: list[str] = []
+    if before.root != after.root:
+        mismatches.append(f"root {before.root} != {after.root}")
+    if before.artifact_root != after.artifact_root:
+        mismatches.append(
+            f"artifactRoot {before.artifact_root} != {after.artifact_root}"
+        )
+    if before.policy_digests != expected:
+        mismatches.append(
+            "policyDigests snapshot=" + ",".join(before.policy_digests)
+            + " policies=" + ",".join(expected)
+        )
+    if mismatches:
+        # 어느 비교가 어긋났는지 없는 예외는 원인 특정이 불가능했다(실측
+        # 2026-09-08: 배치 안 재시도가 attempt 1 의 스냅샷을 attempt 2 의 계약과
+        # 대조해 죽었는데, 메시지는 "does not match batch policies" 뿐이었다).
+        raise MutationAuditError(
+            "mutation snapshot does not match batch policies: " + "; ".join(mismatches)
+        )
 
 
 def _maximum_precision(policy: WritePolicy) -> str:

package/runtime/python/okstra_ctl/wizard/engine.py

@@ -33,6 +33,7 @@ from .ids import (
 )
 from .state import Prompt, WizardError, WizardState, _is_role_selection_step
 from .prompts import _domain_prompt
+from .picker_navigation import present_picker, accept_picker_answer
 from .roles import _submit_role_prompt, next_role_prompt
 from .steps_identity import _submit_task_pick
 from .steps_analysis import _advance_design_prep_item
@@ -125,11 +126,24 @@ def next_prompt(state: WizardState) -> Prompt:
     for _ in range(len(STEPS)):
         prompt = _next_prompt_screen(state)
         if not _is_lone_free_input_pick(prompt):
-            return prompt
+            return _native_picker_screen(state, prompt)
         _take_free_input_branch(state, prompt)
     return _next_prompt_screen(state)
 
 
+def _native_picker_screen(state: WizardState, prompt: Prompt) -> Prompt:
+    if "native_single_select" not in state.available_functions:
+        return prompt
+    if prompt.kind == "pick_group":
+        if _interaction_plan(state, prompt).kind == "native-group":
+            return prompt
+        prompt = prompt.questions[0]
+    if _interaction_plan(state, prompt).kind == "native-multi":
+        return prompt
+    limit = default_host_registry().resolve(state.host_runtime).interaction().native_option_limit
+    return present_picker(state, prompt, limit=limit)
+
+
 def _next_prompt_screen(state: WizardState) -> Prompt:
     if state.aborted:
         return Prompt(step=S_ABORTED, kind="aborted")
@@ -345,6 +359,13 @@ def submit(state: WizardState, value: str) -> dict[str, Any]:
         return {"echo": "", "next": prompt_payload(state, prompt)}
     plan = _interaction_plan(state, prompt)
     value = _normalize_interaction_answer(state, prompt, plan, value)
+    if plan.kind == "native-single":
+        original = _next_prompt_screen(state)
+        if original.kind == "pick_group":
+            original = next(q for q in original.questions if q.step == prompt.step)
+        value = accept_picker_answer(state, original, value)
+        if value is None:
+            return {"echo": "", "next": prompt_payload(state, next_prompt(state))}
     if prompt.kind == "pick_group":
         return _submit_group(state, prompt, value)
     if _is_role_selection_step(prompt.step):

package/runtime/python/okstra_ctl/wizard/picker_navigation.py

@@ -0,0 +1,75 @@
+"""호스트 선택기 한도 안에서 원래 선택지를 보존하는 화면 변환."""
+from dataclasses import replace
+
+from okstra_ctl.wizard_stage_intent import WHOLE_TASK_STAGE
+
+from .ids import ALL_STAGES, PICK_TYPE_CUSTOM
+from .state import Option, Prompt, WizardError, WizardState
+
+_PAGE_PREFIX = "__okstra_picker_page__:"
+_DONE = "__okstra_picker_done__"
+
+
+def present_picker(state: WizardState, prompt: Prompt, *, limit: int) -> Prompt:
+    if prompt.kind != "pick" or not prompt.options:
+        return prompt
+    selected = state.picker_selected.get(prompt.step, [])
+    labels = [option.label for option in prompt.options]
+    options = [replace(
+        option,
+        label=("✓ " if option.value in selected else "") + option.label
+        + (f" [{option.value}]" if labels.count(option.label) > 1 else ""),
+    ) for option in prompt.options]
+    reserve = 2 if prompt.multi else 1
+    paged = len(options) + int(prompt.multi) > limit
+    size = max(1, limit - reserve) if paged else len(options)
+    offset = state.picker_offsets.get(prompt.step, 0)
+    offset = offset if 0 <= offset < len(options) else 0
+    shown = options[offset:offset + size]
+    label = prompt.label
+    if paged:
+        next_offset = offset + size if offset + size < len(options) else 0
+        shown.append(Option(
+            f"{_PAGE_PREFIX}{next_offset}",
+            "다음 선택지" if next_offset else "처음 선택지로",
+        ))
+        label += f" ({offset + 1}–{min(offset + size, len(options))}/{len(options)})"
+    if prompt.multi:
+        shown.append(Option(_DONE, f"선택 완료 ({len(selected)}개)"))
+        label += " · 항목을 선택하면 선택/해제됩니다. 완료를 누르면 제출합니다."
+    if len(shown) == 1:
+        shown.append(Option(f"{_PAGE_PREFIX}0", "다시 보기"))
+    shown = [o for o in shown if o.value != PICK_TYPE_CUSTOM] + [
+        o for o in shown if o.value == PICK_TYPE_CUSTOM
+    ]
+    return replace(prompt, label=label, options=shown, multi=False)
+
+
+def accept_picker_answer(state: WizardState, prompt: Prompt, value: str) -> str | None:
+    if value.startswith(_PAGE_PREFIX):
+        raw_offset = value.removeprefix(_PAGE_PREFIX)
+        if not raw_offset.isdecimal() or not 0 <= int(raw_offset) < len(prompt.options):
+            raise WizardError("invalid picker page; select a returned navigation option")
+        state.picker_offsets[prompt.step] = int(raw_offset)
+        return None
+    if not prompt.multi:
+        state.picker_offsets.pop(prompt.step, None)
+        return value
+    if value != _DONE and value not in {o.value for o in prompt.options}:
+        raise WizardError("invalid picker choice; select an option from the current screen")
+    if value in {_DONE, PICK_TYPE_CUSTOM}:
+        selected = state.picker_selected.pop(prompt.step, [])
+        state.picker_offsets.pop(prompt.step, None)
+        return (
+            ",".join(o.value for o in prompt.options if o.value in selected)
+            if value == _DONE else value
+        )
+    selected = state.picker_selected.setdefault(prompt.step, [])
+    if value in selected:
+        selected.remove(value)
+    elif value in {ALL_STAGES, WHOLE_TASK_STAGE}:
+        selected[:] = [value]
+    else:
+        selected[:] = [v for v in selected if v not in {ALL_STAGES, WHOLE_TASK_STAGE}]
+        selected.append(value)
+    return None

package/runtime/python/okstra_ctl/wizard/state.py

@@ -42,6 +42,8 @@ class WizardState:
     host_runtime: str = "claude-code"
     host_entry_mode: str = "current-session"
     available_functions: list[str] = field(default_factory=list)
+    picker_offsets: dict[str, int] = field(default_factory=dict)
+    picker_selected: dict[str, list[str]] = field(default_factory=dict)
 
     # task identity
     is_new_task: Optional[bool] = None

package/runtime/python/okstra_token_usage/codex.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import json
 import os
+from datetime import datetime, timezone
 from pathlib import Path
 from .jsonl_io import iter_jsonl
 from .paths import CODEX_SESSIONS, codex_session_roots, ts_in_window
@@ -50,6 +51,67 @@ def codex_session_total(jsonl_path: Path) -> dict:
     }
 
 
+def codex_session_window_total(jsonl_path: Path, since: str, until: str) -> dict:
+    """창 안에서 이 세션이 쓴 토큰 — token_count 이벤트의 `last_token_usage` 합.
+
+    in-session 리드(`entryMode: current-session`)의 rollout 은 run 보다 먼저
+    열려 다른 task 도 돌린 세션이라 마지막 `total_token_usage` 스냅샷은 세션
+    전체다. 누적치는 이벤트마다 `last_token_usage` 만큼 늘고 컨텍스트 압축
+    뒤 되돌아가므로(실측 2026-09-08 jobs 리드 세션: 601 이벤트 중 2회 감소),
+    창 끝·시작 누적치의 차가 아니라 창 안 이벤트의 `last_token_usage` 를
+    더한다. `last_token_usage` 가 없는 옛 기록은 직전 누적치와의 차(0 이상)로
+    센다. 창 안 이벤트가 없으면 `available: False`.
+    """
+    keys = (
+        ("totalTokens", "total_tokens"),
+        ("inputTokens", "input_tokens"),
+        ("cachedInputTokens", "cached_input_tokens"),
+        ("outputTokens", "output_tokens"),
+        ("reasoningOutputTokens", "reasoning_output_tokens"),
+    )
+    sums = {name: 0 for name, _raw in keys}
+    previous: dict = {}
+    model_val: str | None = None
+    cwd_val: str | None = None
+    started: str | None = None
+    first: str | None = None
+    last: str | None = None
+    for rec in iter_jsonl(jsonl_path):
+        kind = rec.get("type")
+        payload = rec.get("payload") or {}
+        if kind == "session_meta":
+            cwd_val = payload.get("cwd")
+            started = payload.get("timestamp")
+        elif kind == "turn_context":
+            if model_val is None and payload.get("model"):
+                model_val = payload["model"]
+        elif kind == "event_msg" and payload.get("type") == "token_count":
+            info = payload.get("info") or {}
+            cumulative = info.get("total_token_usage") or {}
+            turn = info.get("last_token_usage")
+            timestamp = str(rec.get("timestamp") or "")
+            if timestamp and ts_in_window(timestamp, since, until):
+                for name, raw in keys:
+                    if isinstance(turn, dict):
+                        sums[name] += turn.get(raw, 0) or 0
+                    else:
+                        sums[name] += max(
+                            0, (cumulative.get(raw, 0) or 0) - (previous.get(raw, 0) or 0)
+                        )
+                if first is None:
+                    first = timestamp
+                last = timestamp
+            previous = cumulative
+    if first is None:
+        return {"totalTokens": 0, "cwd": cwd_val, "model": model_val, "available": False}
+    # 창 안에서 열린 세션은 세션 시작이 곧 창 안 활동의 시작이다. 창보다 먼저
+    # 열린 세션(in-session 리드)은 창 안 첫 이벤트부터 센다.
+    if started and ts_in_window(started, since, until):
+        first = started
+    return {**sums, "cwd": cwd_val, "model": model_val,
+            "startedAt": first, "endedAt": last, "available": True}
+
+
 def find_codex_session(cwd: Path, started_at: str, ended_at: str) -> Path | None:
     """Find the latest codex rollout jsonl in the requested window."""
     sessions = find_codex_sessions(cwd, started_at, ended_at)
@@ -104,14 +166,32 @@ def codex_session_ids(path: Path) -> set[str]:
     return {item for item in ids if item}
 
 
+def _modified_in_window(path: Path, started_at: str, until: str) -> bool:
+    try:
+        mtime = path.stat().st_mtime
+    except OSError:
+        return False
+    modified = datetime.fromtimestamp(mtime, tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    return ts_in_window(modified, started_at, None)
+
+
 def find_codex_sessions(
     cwd: Path,
     started_at: str,
     ended_at: str,
     *,
     session_roots: tuple[Path, ...] | None = None,
+    active_before_start: bool = False,
 ) -> list[Path]:
-    """Find codex rollout jsonls whose meta.cwd matches the window."""
+    """Find codex rollout jsonls whose meta.cwd matches the window.
+
+    기본은 창 안에서 *시작한* 세션이다 — exec 래퍼 워커는 dispatch 마다 새
+    rollout 을 열므로 그것으로 충분하다. `active_before_start=True` 는 창보다
+    먼저 시작했지만 창 안에서도 기록이 이어진 세션(파일 mtime 이 창 시작 이후)을
+    더한다. in-session 리드가 그 모양이다: 세션은 run 보다 먼저 태어났으니
+    시작 시각으로 거르면 `no host session started in the run window` 로 빠지고,
+    토큰은 `codex_session_window_total` 이 창으로 잘라 센다.
+    """
     if not started_at or not ended_at:
         return []
     if session_roots is None:
@@ -137,7 +217,12 @@ def find_codex_sessions(
             if session_cwd != target_cwd:
                 continue
             if not ts_in_window(ts, started_at, ended_at):
-                continue
+                if not (
+                    active_before_start
+                    and ts_in_window(ts, None, started_at)
+                    and _modified_in_window(p, started_at, ended_at)
+                ):
+                    continue
             candidates.append((ts, p))
     if not candidates:
         return []