okstra 0.198.2 → 0.199.0

package/runtime/python/okstra_ctl/set_work_status.py

@@ -3,8 +3,7 @@
 okstra-inspect status.4 가 Edit 도구로 하던 수동 JSON 편집(키 순서·개행 보존
 규칙을 프롬프트로 강제)을 CLI 로 수렴시킨다. 직렬화는 render._write_json 과
 동일한 json.dumps(indent=2, ensure_ascii=False) + "\n" 이므로 재렌더와 byte
-규칙이 일치한다. discovery/task-catalog.json 은 여기서 재생성하지 않는다 —
-다음 run 렌더가 manifest 를 재투영할 때까지 stale 할 수 있다.
+규칙이 일치한다. 직접 수행 결과는 작업 정본을 저장한 뒤 그룹 기억에 공유한다.
 """
 from __future__ import annotations
 
@@ -15,6 +14,8 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 from okstra_ctl import group_context
+from okstra_ctl.direct_work import find_brief_tasks, publish_direct_work, record_direct_work
+from okstra_ctl.run_context import task_mutex
 from okstra_ctl.ids import slugify_task_segment
 from okstra_ctl.fixed_text import line, scalar
 from okstra_ctl.paths import task_dir, task_manifest_file
@@ -24,6 +25,7 @@ from okstra_project import (
     StateError,
     resolve_project_root,
     resolve_task_reference,
+    project_json_path,
 )
 
 ALLOWED_WORK_STATUSES = ("todo", "in-progress", "blocked", "done")
@@ -40,6 +42,7 @@ def _emit(payload: dict, *, text: bool = False) -> None:
         ("workStatus", "Work status"), ("workStatusUpdatedAt", "Updated at"),
         ("workStatusNote", "Note"), ("taskManifestPath", "Task manifest"),
         ("groupContextPath", "Group context"),
+        ("latestWorkRecordPath", "Direct work record"), ("statusRecorded", "Status recorded"),
     ):
         if key in payload:
             lines.append(line(label, payload.get(key)).rstrip("\n"))
@@ -65,6 +68,7 @@ def _manifest_path(project_root: Path, entry: dict) -> Path:
 
 _CLI_EPILOG = r"""Usage:
   okstra set-work-status <token> <status> [--note <text>] [--task-group <g>]
+                         [--note-file <path>]
                          [--project-root <dir>] [--cwd <dir>] [--json]
 
 <token> is a full task-key (<project-id>:<task-group>:<task-id>) or a bare
@@ -75,6 +79,13 @@ only when --note is passed) using the same JSON serialization as the manifest
 renderer. Output: JSON { ok, taskKey, previousWorkStatus, workStatus, ... };
 ok:false stages: resolve | catalog | not-found | ambiguous (pick from
 matches[]) | manifest-missing | manifest-invalid.
+
+An existing brief can be registered without starting a run. For direct completion,
+provide --note or --note-file describing the work and verification (or why no
+checks were run). Direct records are shared through group-context and inspect.
+No run, phase completion, or cross-verification success is synthesized.
+stage:share with statusRecorded:true means the status was saved but sharing
+failed; repeat the same command to retry without duplicating the result.
 """
 
 
@@ -98,6 +109,7 @@ def _parse_args(argv: list[str] | None):
     parser.add_argument(
         "--task-group", default="", help="scope a bare task-id match to this task-group"
     )
+    parser.add_argument("--note-file", type=Path, help="read the work and verification summary from a UTF-8 file")
     parser.add_argument("--project-root", default="", help="project root for catalog lookup")
     parser.add_argument("--cwd", default=".", help="cwd for project root resolution")
     parser.add_argument("--json", action="store_true", help="emit JSON (always on)")
@@ -115,7 +127,11 @@ def _resolve_entry(args):
     token = args.token
     task_group = args.task_group
     if token.count(":") == 2:
-        _, key_group, key_id = token.split(":")
+        project_id, key_group, key_id = token.split(":")
+        project = load_owned_object(project_json_path(project_root), artifact="project config")
+        if project_id != project.get("projectId"):
+            _emit({"ok": False, "stage": "resolve", "reason": "Task key belongs to another project"}, text=args.text)
+            return None, None, 2
         token = key_id
         task_group = key_group or task_group
 
@@ -123,6 +139,18 @@ def _resolve_entry(args):
         matches = resolve_task_reference(
             project_root, token, task_group=task_group or None
         )
+        briefs = find_brief_tasks(project_root, token, task_group)
+        by_key = {item["taskKey"].casefold(): item for item in matches}
+        for brief in briefs:
+            key = brief["taskKey"].casefold()
+            if key in by_key:
+                for field, value in brief.items():
+                    by_key[key].setdefault(field, value)
+            else:
+                matches.append(brief)
+    except (OSError, ValueError) as exc:
+        _emit({"ok": False, "stage": "resolve", "reason": str(exc)}, text=args.text)
+        return None, None, 2
     except StateError as exc:
         _emit({"ok": False, "stage": "catalog", "reason": str(exc)}, text=args.text)
         return None, None, 2
@@ -136,14 +164,18 @@ def _resolve_entry(args):
     return project_root, matches[0], 0
 
 
-def _updated_payload(manifest_path: Path, manifest: dict, entry: dict, args) -> dict:
+def _updated_payload(project_root: Path, manifest_path: Path, manifest: dict, entry: dict, args) -> dict:
     previous = manifest.get("workStatus", "")
+    previous_note = manifest.get("workStatusNote", "")
     manifest["workStatus"] = args.status
-    manifest["workStatusUpdatedAt"] = datetime.now(timezone.utc).strftime(
-        "%Y-%m-%dT%H:%M:%SZ"
-    )
+    if previous != args.status or (args.note is not None and args.note != previous_note):
+        manifest["workStatusUpdatedAt"] = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+    manifest.setdefault("workStatusUpdatedAt", datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"))
+    manifest["updatedAt"] = manifest["workStatusUpdatedAt"]
     if args.note is not None:
         manifest["workStatusNote"] = args.note
+    if args.status == "done" and (manifest.get("registrationSource") == "direct" or args.note is not None):
+        record_direct_work(project_root, manifest_path, manifest)
     write_owned_object_atomic(manifest_path, manifest, artifact="task manifest")
     return {
         "ok": True, "taskKey": entry.get("taskKey", ""),
@@ -151,6 +183,7 @@ def _updated_payload(manifest_path: Path, manifest: dict, entry: dict, args) ->
         "workStatusUpdatedAt": manifest["workStatusUpdatedAt"],
         "workStatusNote": manifest.get("workStatusNote", ""),
         "taskManifestPath": str(manifest_path),
+        "latestWorkRecordPath": manifest.get("latestWorkRecordPath", ""),
     }
 
 
@@ -177,44 +210,61 @@ def _refresh_group_queue(project_root: Path, entry: dict) -> str:
     return str(target) if target is not None else ""
 
 
-def main(argv: list[str] | None = None) -> int:
-    args = _parse_args(argv)
-    project_root, entry, resolution_exit = _resolve_entry(args)
-    if resolution_exit:
-        return resolution_exit
-    assert project_root is not None and entry is not None
+def _write_status(project_root: Path, entry: dict, args) -> dict:
     manifest_path = _manifest_path(project_root, entry)
-    if not manifest_path.exists():
-        _emit(
-            {
-                "ok": False,
-                "stage": "manifest-missing",
-                "taskKey": entry.get("taskKey", ""),
-                "taskManifestPath": str(manifest_path),
-            },
-            text=args.text,
-        )
-        return 1
-    try:
+    manifest_path.resolve().relative_to((project_root / ".okstra" / "tasks").resolve())
+    if manifest_path.exists():
         manifest = load_owned_object(manifest_path, artifact="task manifest")
-    except ValueError as exc:
-        _emit(
-            {
-                "ok": False,
-                "stage": "manifest-invalid",
-                "taskManifestPath": str(manifest_path),
-                "reason": str(exc),
-            },
-            text=args.text,
+    elif entry.get("_briefVerified"):
+        if (manifest_path.parent / "runs").exists() or entry.get("latestRunPath"):
+            raise ValueError("Task manifest is missing for a task with run history")
+        identity_fields = (
+            "schemaVersion", "projectId", "projectRoot", "taskGroup", "taskId", "taskKey",
+            "taskGroupPathSegment", "taskIdPathSegment", "taskBriefPath", "taskRootPath", "taskManifestPath",
         )
-        return 1
-
-    payload = _updated_payload(manifest_path, manifest, entry, args)
-    refreshed = _refresh_group_queue(project_root, entry)
+        manifest = {key: entry[key] for key in identity_fields if key in entry}
+        manifest["registrationSource"] = "direct"
+    else:
+        return {"ok": False, "stage": "manifest-missing", "taskKey": entry["taskKey"]}
+    if str(manifest.get("taskKey", "")).casefold() != entry["taskKey"].casefold():
+        raise ValueError("Task manifest identity does not match the requested task")
+    if manifest.get("registrationSource") == "direct" or args.note is not None:
+        project_id, group, task_id = entry["taskKey"].split(":")
+        for field, value in (("projectId", project_id), ("taskGroup", group), ("taskId", task_id)):
+            manifest.setdefault(field, value)
+    payload = _updated_payload(project_root, manifest_path, manifest, entry, args)
+    if manifest.get("registrationSource") == "direct" or manifest.get("latestWorkRecordPath"):
+        project_id, group, task_id = entry["taskKey"].split(":")
+        try:
+            refreshed = publish_direct_work(project_root, {
+                **manifest, "projectId": project_id, "taskGroup": group, "taskId": task_id,
+            })
+        except (OSError, ValueError) as exc:
+            return {**payload, "ok": False, "statusRecorded": True, "stage": "share", "reason": str(exc)}
+    else:
+        refreshed = _refresh_group_queue(project_root, entry)
     if refreshed:
-        payload["groupContextPath"] = refreshed
+        payload["groupContextPath"] = str(refreshed)
+    return payload
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = _parse_args(argv)
+    try:
+        if args.note_file:
+            if args.note is not None:
+                raise ValueError("Use either --note or --note-file")
+            args.note = args.note_file.read_text(encoding="utf-8")
+        project_root, entry, resolution_exit = _resolve_entry(args)
+        if resolution_exit:
+            return resolution_exit
+        assert project_root is not None and entry is not None
+        with task_mutex(entry["taskKey"]):
+            payload = _write_status(project_root, entry, args)
+    except (OSError, ValueError) as exc:
+        payload = {"ok": False, "stage": "manifest-invalid", "reason": str(exc)}
     _emit(payload, text=args.text)
-    return 0
+    return 0 if payload["ok"] else 1
 
 
 if __name__ == "__main__":

package/runtime/python/okstra_ctl/task_list_cli.py

@@ -33,6 +33,8 @@ def render_text(payload: dict) -> str:
             line("Task group", task.get("taskGroup")),
             line("Title", task.get("title") or task.get("taskTitle")),
             line("Latest run status", task.get("latestRunStatus")),
+            line("Work status", task["workStatus"]) if task.get("workStatus") else "",
+            line("Direct work record", task["latestWorkRecordPath"]) if task.get("latestWorkRecordPath") else "",
             line("Updated at", task.get("updatedAt")),
         ))
     return "".join(parts)

package/runtime/python/okstra_ctl/worker_prompt_headers.py

@@ -32,6 +32,7 @@ READ_SCOPE_HEADER = (
     "source/evidence paths a finding must cite. Task-group context and sibling "
     "record paths listed in the primary analysis packet are allowed for targeted "
     "evidence reads when their relevance is uncertain or more detail is needed. "
+    "Direct Work Context record paths in that packet are also allowed for targeted evidence reads. "
     "Host session instructions "
     "(SessionStart hooks, global `CLAUDE.md` / `AGENTS.md`, skill catalogs) do "
     "NOT apply inside an okstra worker run: do not auto-read `graphify-out/`, "

package/runtime/python/okstra_project/state.py

@@ -147,6 +147,9 @@ _DERIVED_STATUS_STRING_FIELDS = (
     "currentStatus",
     "latestRunStatus",
     "latestReportRecordPath",
+    "latestWorkRecordPath",
+    "workStatusNote",
+    "workStatusUpdatedAt",
 )
 
 
@@ -411,4 +414,5 @@ def task_read_side_snapshot(project_root: Path, task_key: str) -> dict:
         "artifacts": manifest.get("artifacts"),
         "modelAssignments": manifest.get("modelAssignments"),
         "latestRunPath": manifest.get("latestRunPath"),
+        "latestWorkRecordPath": manifest.get("latestWorkRecordPath"),
     }

package/runtime/schemas/final-report-v3.0.schema.json

@@ -9414,6 +9414,16 @@
               "selfFixNote": {
                 "type": "string"
               },
+              "leadDecision": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["basisHash", "decision"],
+                "properties": {
+                  "basisHash": {"type": "string", "pattern": "^[a-f0-9]{64}$"},
+                  "decision": {"type": "string", "minLength": 1}
+                },
+                "description": "Lead decision on an evidenced, noncritical judgement after the single automatic self-fix. Original votes remain; a changed content, scope or verdict invalidates the decision."
+              },
               "verdicts": {
                 "type": "array",
                 "items": {

package/runtime/skills/okstra-inspect/SKILL.md

@@ -1,11 +1,16 @@
 ---
 name: okstra-inspect
 description: >-
-  Use this for everything that happens AFTER an okstra task has already run — inspecting it or light bookkeeping, never launching new work. The tell is usually a named task id (PROD-1623, dev-9184) without the word "okstra." Reach for it when the user wants one task's: status, current/next phase, blockers, or approval gate; its final report — where it is or whether it passed; its elapsed time or context/read cost; its run history, re-run, or resume; to mark it done / in-progress / blocked / todo; or a failed run's error logs gathered into a report. The recap facet also takes a task-group: which briefs are done / in progress / not started, what is next, each task's latest conclusion. Also builds an anonymized cross-project error zip and audits run health. NOT for starting a run (okstra-run), a group's run/time/error totals (okstra-rollup), schedules (okstra-schedule-gen), a brief (okstra-brief-gen), setup (okstra-setup), or cross-project management (okstra-manager).
+  Inspect okstra tasks and record user-managed status, including direct completion of brief-backed tasks that have never run. The tell is usually a named task id (PROD-1623, dev-9184) without the word "okstra." Reach for it when the user wants one task's: status, current/next phase, blockers, or approval gate; its final report — where it is or whether it passed; its elapsed time or context/read cost; its run history, re-run, or resume; to mark it done / in-progress / blocked / todo; or a failed run's error logs gathered into a report. The recap facet also takes a task-group: which briefs are done / in progress / not started, what is next, each task's latest conclusion. Also builds an anonymized cross-project error zip and audits run health. NOT for starting a run (okstra-run), a group's run/time/error totals (okstra-rollup), schedules (okstra-schedule-gen), a brief (okstra-brief-gen), setup (okstra-setup), or cross-project management (okstra-manager).
 ---
 
 # OKSTRA Inspect
 
+Also handles tasks that have never run: a status mutation can register an existing brief,
+and direct completion records are available to status, recap, group context, and later runs.
+For an explicit status change, dispatch to status.4 before catalog-only task selection.
+An unregistered brief will not appear in that selection yet.
+
 Single read-side entry point for okstra runtime inspection plus the one status mutation that belongs here (`workStatus`) and read-derived artifact rendering (`errors` report). Each sub-command's full procedure lives in a lazily loaded facet file — after dispatch, Read exactly the one facet you need.
 
 | Sub-command | Facet file | What it does |

package/runtime/skills/okstra-inspect/facets/recap.md

@@ -19,13 +19,18 @@ If the user asks for a recap without naming a task or a group (e.g. "summarize t
 
 ### recap.2 — Assemble the before/after summary
 
+When `Direct work record` is present, read that work record and report its summary, evidence,
+limitations, and current `Work status`, including when `Run count` is zero. Direct work records
+are JSON work artifacts, not final reports; do not send them to `render-final-report`. In group
+output, `Memory source: direct` identifies these records even when `Memory run` is empty.
+
 Use the CLI output as the source of truth:
 
 ```bash
 okstra model-io recap-input --project-root <projectRoot> --task-ref <resolved-target>
 ```
 
-Read the fixed-text `Run count` and repeated `Transition` blocks. Narrate each block's `From phase → To phase`, `Status`, `Last completed phase`, `Next phase`, and `Report` in the emitted chronological order. `Status`, `Last completed phase`, and `Next phase` are each run's end state from its own run-manifest, so a `prepared` transition is a run that was prepared and never ran, and it carries no `Report`. If `Run count: 0`, answer only "This task has no recorded runs." and do not claim to have read any file.
+Read the fixed-text `Run count` and repeated `Transition` blocks. Narrate each block's `From phase → To phase`, `Status`, `Last completed phase`, `Next phase`, and `Report` in the emitted chronological order. `Status`, `Last completed phase`, and `Next phase` are each run's end state from its own run-manifest, so a `prepared` transition is a run that was prepared and never ran, and it carries no `Report`. If `Run count: 0` and `Direct work record` is absent, report that the task has no recorded runs alongside its current work status.
 
 `Next phase` is already a fixed scalar projection. Narrate it when non-empty, and otherwise use `Next phase status`: `pending` means that run did not settle the route, `blocked` means it stopped on something outside the run, and `terminal` means the lifecycle ended there.
 

package/runtime/skills/okstra-inspect/facets/status.md

@@ -108,6 +108,18 @@ Branches 5–7 are decided by `workflow.nextRecommendedPhase.status` when `await
 
 Recognize requests to change a task's `workStatus` and update the corresponding `task-manifest.json`.
 
+This includes briefs whose tasks have never run. Call this command directly with the named
+token; do not require a catalog match or a prior `okstra-run`. The command resolves the brief
+and registers it when needed. For "do this small task directly and record completion", perform
+the authorized work, then record `done` with `--note` or `--note-file` containing the changes,
+verification results or reasons checks were not run, and remaining limitations. These inputs
+are checked by `set-work-status` and covered by `test_okstra_set_work_status.py`.
+
+Read `Direct work record` alongside `Work status`. A direct result is user-recorded work,
+not a passed cross-verification run. The command shares the result in group context and
+later run inputs. `Stage: share` with `Status recorded: True` means the status was saved
+but sharing failed; report both facts and retry the same command. Do not report full success.
+
 **Trigger patterns** (recognize both):
 
 Natural language: "change DEV-6827 to done", "mark PROD-1623 as blocked", "set DEV-9047 in progress", "Mark DEV-6827 as done".

package/runtime/templates/reports/html/assets/base.css

@@ -15,6 +15,10 @@ body { margin: 0; background: Canvas; color: CanvasText; }
 main { display: grid; gap: 1rem; padding-bottom: 3rem; }
 section { padding: 1.4rem; border: 1px solid color-mix(in srgb, CanvasText 14%, transparent); border-radius: 16px; background: color-mix(in srgb, Canvas 94%, CanvasText 6%); }
 h2 { margin-top: 0; font-size: 1.45rem; }
+.report-section-toggle > summary { cursor: pointer; }
+.report-section-toggle > summary > h2 { display: inline; margin: 0; }
+.report-section-toggle[open] > summary { margin-bottom: 1rem; }
+.report-section-toggle > summary:focus-visible { outline: 2px solid Highlight; outline-offset: 4px; }
 h3 { margin-bottom: .35rem; }
 /* The report opens with what it holds. It scrolls away with the rest rather
    than sticking: on a phone a pinned index of a dozen sections is the page. */

package/runtime/templates/reports/html/assets/base.js

@@ -2,4 +2,34 @@
   "use strict";
 
   document.documentElement.classList.add("js-enabled");
+
+  for (const section of document.querySelectorAll("section")) {
+    const heading = section.querySelector(":scope > h2");
+    if (!heading) continue;
+    const details = document.createElement("details");
+    details.className = "report-section-toggle";
+    const summary = document.createElement("summary");
+    summary.append(heading);
+    details.append(summary);
+    while (section.firstChild) details.append(section.firstChild);
+    section.append(details);
+  }
+
+  function revealTarget(hash) {
+    const target = document.getElementById(hash.slice(1));
+    if (!target) return;
+    const sectionDetails = target.querySelector(":scope > details.report-section-toggle");
+    if (sectionDetails) sectionDetails.open = true;
+    for (let parent = target.parentElement; parent; parent = parent.parentElement) {
+      if (parent.tagName === "DETAILS") parent.open = true;
+    }
+    target.scrollIntoView({ block: "start" });
+  }
+
+  document.addEventListener("click", (event) => {
+    const link = event.target.closest("a[href^='#']");
+    if (link) revealTarget(link.getAttribute("href"));
+  });
+  window.addEventListener("hashchange", () => revealTarget(window.location.hash));
+  revealTarget(window.location.hash);
 })();

package/runtime/validators/validate-run.py

@@ -89,6 +89,8 @@ from okstra_ctl.plan_items import (  # noqa: E402
     advisory_plan_body_gating,
     analyser_key as _analyser_key,
     is_critic_worker,
+    lead_decision_basis,
+    self_fix_rounds,
     stage_scope_bucket as _item_stage_scope_bucket,
     voting_analyser_keys,
 )
@@ -3987,17 +3989,48 @@ def _resolved_noncritical_dissent_ids(data: dict) -> set[str]:
     return _user_accepted_plan_item_ids(data)
 
 
+def _plan_item_decision_authority(item: dict, pbv: dict) -> str | None:
+    """자동 수정 이후의 설계 판단만 리드가 결정하며 사실·사용자 권한은 남긴다."""
+    classification = _classify_plan_item_gate(item)
+    votes = [row for row in item.get("verdicts", []) if isinstance(row, dict)]
+    non_result = any(row.get("verdict") not in {"AGREE", "SUPPLEMENT", "DISAGREE"} for row in votes)
+    if classification not in {"majority-disagree", "needs-reverify", "all-non-result"} and not non_result:
+        return None
+    if _stage_scope_bucket(item, pbv) != "in-scope" or item.get("block") == "record":
+        return None
+    disagrees = [row for row in votes if row.get("verdict") == "DISAGREE"]
+    verified = item.get("contentHash")
+    if (
+        not self_fix_rounds(pbv) or pbv.get("gating") is False
+        or not verified or item.get("verifiedContentHash") != verified
+        or _is_correctness_critical(item) or not disagrees
+        or len(voting_analyser_keys([item])) < 2
+        or non_result
+        or any(row.get("claimKind") not in {None, "judgement"}
+               or row.get("fixability") != "planner-fixable"
+               or row.get("breakageKind") not in {"b", "c", "e"} for row in disagrees)
+    ):
+        return "user"
+    return "lead"
+
+
+def _lead_decision_applies(item: dict, pbv: dict) -> bool:
+    decision = item.get("leadDecision")
+    return (
+        isinstance(decision, dict)
+        and bool(str(decision.get("decision") or "").strip())
+        and decision.get("basisHash") == lead_decision_basis(item)
+        and _plan_item_decision_authority(item, pbv) == "lead"
+    )
+
+
 def _is_dissent_downgraded(
     item: dict,
     pbv: dict,
     accepted_item_ids: set[str],
 ) -> bool:
-    """Whether a surviving `majority-disagree` item stops blocking approval.
-
-    사용자 진행 처분(`accept-risk` / `select` / `answer`)이 있으면 표는 남기고
-    게이트만 `has-dissent` 로 내린다. 분류와 자가수정 소진 여부는 보지 않는다.
-    """
-    return (
+    """유효한 리드 결정 또는 사용자 진행 처분은 반대 표를 보존하며 차단을 해소한다."""
+    return _lead_decision_applies(item, pbv) or (
         _classify_plan_item_gate(item) == "majority-disagree"
         and str(item.get("id") or "") in accepted_item_ids
     )
@@ -5025,6 +5058,11 @@ def _validate_self_fix_grouping(data: dict, failures: list[str]) -> None:
         return
 
     rounds = [g.get("round") for g in groups if isinstance(g.get("round"), int)]
+    if len(set(rounds)) > 1:
+        failures.append(
+            "final-report data.json: automatic self-fix is limited to one rewrite; "
+            "resolve remaining items through lead decisions or user confirmation."
+        )
     if rounds and max(rounds) != rounds_applied:
         failures.append(
             "final-report data.json: planBodyVerification "
@@ -6089,6 +6127,7 @@ def _validate_unresolved_tie_was_reverified(
         if isinstance(item, dict)
         and not item.get("carriedForwardFromSeq")
         and str(item.get("id") or "").strip() not in decided
+        and not _lead_decision_applies(item, pbv)
         and _stage_scope_bucket(item, pbv) == "in-scope"
         and _is_unsettled_tie(item)
     })
@@ -7291,6 +7330,8 @@ def _gate_summary_item(
         "classification": classification,
         "stateClassification": _state_classification(item, classification),
         "correctnessCritical": _is_correctness_critical(item),
+        "decisionAuthority": _plan_item_decision_authority(item, pbv),
+        "leadDecisionApplied": _lead_decision_applies(item, pbv),
         # 왜 안 막는지가 기록에 남아야 한다. 이 값이 없으면 범위 밖 강등과
         # 실제 합의가 산출물에서 같은 모양으로 읽힌다.
         "stageScope": _stage_scope_bucket(item, pbv),

package/runtime/validators/validate_session_conformance.py

@@ -1270,6 +1270,11 @@ def _check_activity_round_counts(
             f"recorded={recorded_verifications}."
         )
     recorded_self_fixes = len(indexed.get("self-fix-applied", []))
+    if recorded_self_fixes > 1:
+        errors.append(
+            "activity contract: automatic self-fix is limited to one rewrite; "
+            "resolve remaining items through lead decisions or user confirmation."
+        )
     expected_self_fixes = _self_fix_event_expectation(
         run_dir, suffix, self_fix_rounds,
     )