okstra 0.199.4 → 0.199.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.199.4",
+  "version": "0.199.5",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.199.4",
-  "builtAt": "2026-09-12T08:39:25.893Z",
+  "package": "0.199.5",
+  "builtAt": "2026-09-12T23:19:40.021Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/launch.template.md

@@ -41,6 +41,18 @@ Relaying a wizard step does not change the option set — relay every `options[]
 
 ## User closeout (BLOCKING)
 
+Progress, remaining work, and recommendation
+
+At each phase or implementation-stage boundary, at task completion, and before a controlled session pause or handoff, give a concise update in the resolved Report Language. Identify the task and the phase or stage, then include these three items (translate the labels):
+
+- Progress: what this boundary actually completed, the result of checks already run, and links to the relevant persisted evidence. Distinguish a completed phase from a completed task; a dispatched worker is still in progress.
+- Remaining work: unfinished work in the current task, open approval or input blockers with their IDs, and any registered follow-up tasks. Say explicitly when none remains in the verified scope; when state is unavailable, say unknown rather than inventing completion or a backlog.
+- Recommendation: the next concrete action and why it comes next. After finalization, use `nextCommand` and `nextRecommendedPhase.rationale` from the result under the routing rules below, including `nextInGroup` when present. Before finalization, use the active run's recorded stage queue and recovery or resume information; do not reuse an earlier run's pointer or invent a resume command.
+
+During an authorized continuous run, put the update beside the existing progress checkpoint and continue to the next queued step without asking for confirmation merely to deliver this update. At a controlled session pause or handoff, distinguish persisted results from in-progress work and include the available resume reference. At task completion, distinguish remaining work in this task from follow-ups or the next task in its group. If there is no recorded next action, say none is recommended. These updates do not replace checkpoints or authorize another task.
+
+Prompt delivery is checked by `tests/contract/test_next_phase_authoring_delivery.py::test_lead_closeout_names_a_command_the_user_can_run`; this is guidance for the lead's prose, not runtime validation of the emitted message.
+
 After Phase 7 persistence, the last user-facing message of this run is the next command. A status dump is not a close. A prohibition (`do not start implementation`) is not a next action. This applies to every task type.
 
 **Read the pointer from the `report-finalize` result — do not re-derive it.** Its top-level `nextRecommendedPhase` object (`phase`, `status`, `rationale`) is the value every row below branches on, and the same three values are repeated on stderr as `next phase status:` / `next phase:` / `next phase rationale:`. You did not write that object and you cannot recompute it: you author your task type's routing field, and Phase 7 projects the pointer from it plus the approval state — for `implementation-planning` there is no routing field at all. If the result carries `nextRecommendedPhaseError`, say in one line that the pointer could not be read, then close on the `validate-run` row below. The same result also carries `nextCommand` — `{command, note}`, the table below already applied to this run. When `command` is non-empty it is the close; when it is empty the `note` says what to do with the `rationale` instead.

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -104,6 +104,8 @@ User-utterance interpretation rule:
 
 ## Progress reporting (BLOCKING)
 
+At each phase or implementation-stage boundary, at task completion, and before a controlled session pause or handoff, follow the launch prompt's "Progress, remaining work, and recommendation" guidance. Include the result and evidence, unfinished work and blockers, and the next action with its reason. During an authorized continuous run, deliver this update beside the checkpoint and continue; do not turn the update into an approval gate. The same guidance applies to the final reply after persistence below.
+
 A single okstra run frequently spans 30–120 minutes with multi-minute silent windows while workers run; without progress signals the user cannot distinguish "still working" from "hung". Lead MUST emit a single short progress line at each checkpoint below — plain user-facing text in a separate brief message (not buried inside a tool call), one line per checkpoint, format: `PROGRESS: <phase-id> <verb-phrase>`. Emit the line raw — the literal `PROGRESS:` token must begin the line. Do NOT wrap it in inline-code backticks (`` `PROGRESS: ...` ``) or a ```` ``` ```` code fence; markdown wrapping is what the post-hoc conformance validator scrapes around, and raw emit keeps the signal unambiguous.
 
 Record each checkpoint with `okstra lead-progress append --project-root <dir> --run-manifest <path> --phase <phase-id>`, then emit the `progressLine` it prints as the user-facing line. The command resolves `leadEventsPath` from the run manifest and writes the checkpoint there — on a host whose adapter declares `sessionAccounting: artifact-only` that ledger is the only place the post-hoc validator can read it, so a conversation line alone leaves no trace and the run is reported as missing the checkpoint. Pass `--worker <role>` on the per-worker checkpoints (it rewrites a phase-specific functional label into the roster role team-state records), `--field NAME=VALUE` for the remaining `key=value` tokens in the order the line carries them, and `--detail <text>` where the line ends in a verb phrase; the wording listed below is the default for the fixed-prose checkpoints.

package/runtime/prompts/lead/plan-body-verification.md

@@ -335,10 +335,20 @@ Every plan-body verification and self-fix instruction passes [okstra-lead-contra
 
 Before each verifier call, write one task-instructions file under the current
 run's `state/` directory and run `okstra agent-prompt materialize` with
-`--audience reverification-worker`,
-`--assignment-ref reverify/<workerId>`, the exact `--worker-id`, and
+`--audience reverification-worker`, the exact `--worker-id`, and
 `--dispatch-kind plan-verify-r<N>`, matching the `<N>` in the result filename of
-step 3. That kind, not `reverify-r<N>`, is what this round takes: the verification
+step 3. For analyser verifiers, use `--assignment-ref reverify/<workerId>`.
+For `critic-worker`, use `--assignment-ref critic/scope` from this run's
+`invocationAssignments`, including a tie round or a later critic correction.
+The verdict worker name `critic-worker` does not create a `reverify/critic-worker`
+assignment. Keep the selected critic's existing model assignment.
+**Enforced:** `okstra_ctl.agent.prompt_cli.run_identity._validate_run_identity`
+accepts the planning critic's verification audience; materialization resolves
+the declared assignment and reports the correct critic reference when the
+invented `reverify/critic-worker` reference is used.
+`tests/run/test_agent_prompt_cli.py` verifies the declared critic's reservation
+and dispatch identity plus this recovery diagnostic.
+That kind, not `reverify-r<N>`, is what this round takes: the verification
 prompt contract requires the renderer signature of the queue's canonical renderer,
 and for plan items that renderer is `okstra plan-items prompt`, not `okstra
 convergence reverify-prompt`. Pass that command's output verbatim as
@@ -355,7 +365,9 @@ source `RoleExecution` row from the run manifest's static role state. Use its
 `RoleExecution` row's `roleExecutionRef`, not that row's
 `sourceRoleExecutionRef` field. Pass `--source-role-execution-ref
 <sourceRoleExecutionRef>`. Do not derive that reference from `workerId`,
-provider, model, or execution-label text. A legacy v1 run omits this flag. Run
+provider, model, or execution-label text. For `critic-worker`, select the static
+`role: critic` row; the runtime reserves its verifier execution under the
+existing critic participant and model. A legacy v1 run omits this flag. Run
 `okstra agent-prompt verify` against the
 returned `metadataPath` before dispatch and use the returned `promptPath`
 without modification. Native-session calls use only `hostModelValue`; before

package/runtime/prompts/profiles/implementation-planning.md

@@ -175,7 +175,7 @@ roles:
     - `### Carry-In` — for `depends-on (none)`: task-brief only. Otherwise: each depended-on stage's static exit contract + runtime sidecar path `runs/<impl-key>/carry/stage-<i>.json` placeholder.
     - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the same paths as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary.** `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
     - **The `command` cell runs inside an okstra task worktree, not a bare checkout (BLOCKING).** okstra provisions `.okstra`, the configured sync entries (`.project-docs`, `.claude`, …), and — for `implementation` — a nested `stage-<N>/` worktree into the tree the step executes in. Two consequences bind every command you write:
-      - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step — okstra writes that tag itself when it settles the stage, at the commit the carry evidence records, and a step that tags mid-stage puts it on an earlier commit.
+      - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step. Stage completion records the commit in the consumer ledger without creating or moving git tags.
       - **Never read an `.okstra/` artifact back out of a git object.** `.okstra/**` is gitignored and never committed — the executor aborts a commit that stages an ignored path and the verifier reports a committed `.okstra` path as a branch defect — so `git cat-file -e <tag>:.okstra/…`, `git show <tag>:.okstra/…`, and every variant of that read can never resolve, at any tag, in any stage. A later stage that needs a QA artifact reads it from the working tree or receives it through the carry sidecar / verifier result; do not design a stage contract around one being reachable from a tag. Validator S12 rejects the read.
     - **Per-stage conformance declaration (mandatory one line, in the stage section — same placement freedom as `TDD exemption:`):** the stage MUST carry exactly one of:
       - `Conformance tests: stage-<N> — <task_root>/qa/scripts/stage-<N>.<ext> (requires=[db|io|http|external,...])` — declare that a Tier3 verification script will prove this stage's upstream requirements (brief / requirements-discovery / error-analysis / improvement-discovery → this stage's `Acceptance`) hold against **real** DB rows, real endpoints, or the real external API — NOT mocks. This phase emits the line and the `requires` set only. Do NOT write `<task_root>/qa/scripts/stage-<N>.*` and do NOT add a `runCommand` or `conformance-manifest.json` entry here — the matching `implementation` stage run creates the script file and the manifest `runCommand`. A plan that declares tests with no script file on disk is valid at this gate. The data.json `conformanceTests` value carries only the remainder after the `Conformance tests: stage-<N> — ` prefix — never the `stage-<N> — ` label itself (report assembly strips a leftover label at publication, and the implementation entry gate rejects one).

package/runtime/prompts/wizard/prompts.ko.json

@@ -646,6 +646,7 @@
   },
   "confirmation": {
     "header": "선택 확인:",
+    "provider_data_scope": "\n전달 대상: 위 역할·모델 목록의 제공자(현재 세션 및 선택한 외부 모델 제공자).\n전달 자료: `{project_root}`의 이 작업에 대한 작업 개요, 작업 수행에 필요한 저장소 소스·문서, 선택한 근거 자료 및 실행 중 생성되는 관련 분석·검증 결과.\n진행을 선택하면 위 대상에 해당 자료를 전달하여 선택한 작업을 실행하는 것을 승인합니다. 선택에 없는 제공자나 작업과 무관한 자료는 승인 범위에 포함되지 않습니다. 실행 환경의 권한 검토는 별도로 적용됩니다.",
     "static_role": "  static-role   : {role}#{ordinal} / {model}",
     "dynamic_role": "  dynamic-role  : {role} / reuse selected participant model",
     "workers_implementation_default": "  workers       : (프로필 기본 — executor + verifier 2 + report-writer)",

package/runtime/python/okstra_ctl/adapters/hosts/codex/relay.md

@@ -136,11 +136,11 @@ The `confirm` prompt's `label` is the selection summary (one line per resolved i
 
 ### Runtime-generated selectable screens
 
-`wizard/engine.py` adapts choice screens before returning `next` when the session declares `native_single_select`. `wizard/picker_navigation.py` preserves all original choices while paging long lists, collecting multi-selection through toggle/complete choices, and disambiguating duplicate labels. Oversized or unsupported groups are presented one member at a time. These paths are exercised by `tests/domain/wizard/test_picker_navigation.py` and `test_role_model_selection.py`.
+`wizard/engine.py` adapts choice screens before returning `next` when the session declares `native_single_select`. Lists use same-screen question tabs only when the host supports the complete grouped selection. Otherwise, choices beyond `nativeLimits` and unsupported multi-selections use a complete numbered list. Codex has no native multi-select, so a single choice with more than three options uses `numbered-single`; multi-selection uses `numbered-multi`. Oversized or unsupported groups are presented one member at a time, with every option for that member visible. These paths are exercised by `tests/domain/wizard/test_picker_navigation.py` and `test_role_model_selection.py`.
 
-Render exactly the returned current screen using its `interaction.kind`, including navigation and completion options. Submit their original values through `okstra wizard step` like other options. The runtime keeps navigation and partial selections in the state file and does not submit the underlying workflow decision until selection is complete. Do not reconstruct the full model list, perform pagination yourself, or replace model choices with a request to type `provider/model`. A repeated step ID after navigation or a toggle is the next screen, not a duplicated question; render that newly returned screen once.
+Render the returned screen using its `interaction.kind`. For numbered interactions, show every option label and description in original order in one message, then accept a number, label, or value; multiple choices accept comma-separated input. Submit that reply unchanged through `okstra wizard step`. Do not add a next-page choice, truncate the list, or require the user to remember a model identifier.
 
-If the runtime still returns a numbered interaction when the user requires a selector, preserve the state and check installation and live capabilities. Do not invent a text-input exception. Text steps remain text steps; a direct-input choice is selected through the picker before the runtime asks for the custom value.
+The complete numbered list is the intended fallback when a choice cannot fit the native control or same-screen tabs, including when the user generally prefers a selector. Text steps remain text steps; selecting the direct-input option opens the wizard's custom-value step.
 
 ### Plan decisions and execution permissions
 
@@ -168,7 +168,7 @@ Display the question only through the selected tool. Do not print it or its opti
 |---|---|
 | `read_artifacts` | Read the manifest-provided paths through the current host's file interface. |
 | `write_artifact` | Write only core-authorized `.okstra/` artifacts and preserve their schemas. |
-| `prompt_user` | Use the client-appropriate, mode-available question tool selected above for clarifications that fit `nativeLimits`. Show the question once through that tool and wait for the actual answer. Emit the question as the last thing in that turn: assistant text emitted after the call renders below the question and separates it from the user's answer. Follow the host's separate restrictions for permission requests. Use host text for unsupported interactions only when the user has not required a selectable interface; otherwise preserve the pending step and follow the recovery above. |
+| `prompt_user` | Use the client-appropriate, mode-available question tool selected above for clarifications that fit `nativeLimits`. Show the question once through that tool and wait for the actual answer. Emit the question as the last thing in that turn: assistant text emitted after the call renders below the question and separates it from the user's answer. Follow the host's separate restrictions for permission requests. For lists that cannot fit the native control or same-screen tabs, show the complete numbered list and accept the next message as the answer. |
 | `dispatch_worker` | Verify each materialized invocation first. Dispatch `runner=native-session` with the current Codex host's primitive, the returned `promptPath`, and `hostModelValue`. Pass `runner=cli-wrapper` assignments to `okstra worker-dispatch --project-root <root> --run-manifest <path> --workers <ids>`; use `--dry-run` first when required. **Not in a cmux run:** when `terminalBackend` is `cmux-pane`, the cmux adapter overrides this row. |
 | `await_workers` | Await native host workers through the host primitive and CLI workers through synchronous dispatch, then verify team-state terminal records and Result Paths for both. |
 | `redispatch_worker` | Materialize and verify a fresh invocation, then start a fresh native worker or `okstra worker-dispatch` attempt according to the persisted runner. |
@@ -176,12 +176,26 @@ Display the question only through the selected tool. Do not print it or its opti
 | `record_lead_event` | Append progress and activity records to the manifest-provided `leadEventsPath`. Use `okstra lead-progress append --phase <phase-id>` for a checkpoint and `okstra agent-activity append --kind <kind>` for an activity record; both resolve the ledger path from the run manifest. Emit the matching `PROGRESS:` line — the command prints it as `progressLine` — and, when an activity record is required, the immediately following `ACTIVITY:` line from the same structured fields. |
 | `collect_usage` | Collect artifact/rollout-backed usage through the existing Okstra token-usage path; never read Claude session JSONL as a substitute. |
 
+## Codex execution permissions
+
+### Permission before bundle preparation
+
+Before the first `okstra render-bundle` invocation, check the current host's declared filesystem restrictions and approval policy. Bundle preparation writes run artifacts and can create a task or stage worktree with `git worktree add -b`, which writes to the source repository's Git metadata. `--render-only` does not make this command read-only, and writable access to the project directory or `~/.okstra` does not imply writable access to protected `.git` metadata.
+
+When those writes are restricted, use the host's supported execution permission on the original `render-bundle` command (`sandbox_permissions: "require_escalated"` for `exec_command` when available and permitted), preserving every `outcome.renderArgv` token. Explain that the command prepares the selected run and may create its branch and worktree. Do not first run it under restrictions already known to block these writes. Apply the same check to subsequent phase or stage bundle preparations. A wizard confirmation does not grant host privileges; follow the host's approval decision. If escalation is prohibited, report the constraint and retain the invocation instead of changing filesystem permissions or choosing an alternate launcher.
+
+If preparation has already failed with a Git lock creation error or `Operation not permitted`, preserve the exact error and retry the same command only after the host permits the required writes. This is host-call guidance, not a permission grant or a runtime-enforced check.
+
 ## Codex dispatch details
 
 ### Permission at the dispatch boundary
 
 Before a live CLI worker dispatch, check the current host's declared sandbox and approval policy. In a restricted Codex session, request the host's supported execution permission on the dispatch command itself (`sandbox_permissions: "require_escalated"` for `exec_command` when that mechanism is available and permitted). Scope the request to the prepared run and explain that it starts the selected worker processes. Follow the host's approval decision; a wizard confirmation or a successful preflight does not grant this permission.
 
+Carry the user's existing authorization into that request: identify the task, the selected providers/models from the prepared assignments, and the task brief, relevant repository source/documents, selected evidence, and related run results those workers will process. Cite the actual `Proceed` response and the data-transfer scope displayed in that confirmation; `outcome.confirmationText` is the runtime's summary reference, not proof by itself that the user saw or accepted it. Explain this scope in the execution tool's justification rather than describing only process startup. Data-transfer authorization and host execution privileges are separate: preserve the former while requesting the latter.
+
+Do not infer that an older confirmation included the new disclosure, widen the approved recipients or material, or treat model selection alone as blanket data-transfer consent. When the conversation already authorizes the same recipients and scope, use that evidence without asking again. If approval review rejects a dispatch, retain and report its reason; supply omitted existing evidence only through the host's permitted review mechanism. If the stated gap is not covered by the user's actual authorization, ask one focused question naming that gap and wait for the answer. Never bypass the rejection or repeat an unchanged request.
+
 Apply this guidance to both `okstra worker-dispatch` and the cmux override's `okstra team dispatch`, including initial workers, reverify, critic, report-writer, and retries. Read-only previews do not start workers. A session already authorized to execute outside the sandbox does not need another request. When the host prohibits escalation, preserve the pending invocation and report the execution constraint instead of trying an alternate launcher or weakening host controls.
 
 The worker's `--sandbox danger-full-access` flag only selects the child Codex policy; it does not remove restrictions inherited from the parent process. If startup reports `Operation not permitted`, retain the exact error and distinguish initialization failure from a worker verdict. Retry only through the permitted host mechanism after the execution conditions change, within the existing retry limit; do not repeat the same restricted invocation. This is host-call guidance, not a permission grant or a runtime-enforced check.

package/runtime/python/okstra_ctl/agent/prompt_cli/corrections.py

@@ -101,9 +101,12 @@ def run_corrections_check(
 
         def semantic_validator(data: dict[str, Any]) -> list[str]:
             block = data.get(block_key)
-            return validate_implementation_option_selection(
-                block if isinstance(block, Mapping) else {}, original_ids, analysers,
-            )
+            return [
+                f"{block_key}: {error}"
+                for error in validate_implementation_option_selection(
+                    block if isinstance(block, Mapping) else {}, original_ids, analysers,
+                )
+            ]
     elif task_type == "implementation-planning":
 
         def semantic_validator(data: dict[str, Any]) -> list[str]:

package/runtime/python/okstra_ctl/agent/prompt_cli/materialize.py

@@ -34,7 +34,11 @@ from ...assignment_resolver import AssignmentContext, resolve_dispatch_assignmen
 from ...path_hints import hydrate_active_run_context
 from ...worker_prompt_headers import worker_prompt_headers
 from ...worker_prompt_contract import complete_reverify_instruction, validate_reverify_prompt
-from ...worker_prompt_policy import is_verification_dispatch_kind
+from ...worker_prompt_policy import (
+    critic_assignment_ref,
+    is_plan_critic_verification,
+    is_verification_dispatch_kind,
+)
 from ...paths import okstra_home
 from ...final_report_paths import final_report_data_path
 from ...final_report_schema import load_schema_version
@@ -251,10 +255,28 @@ def _materialize_run(
     if args.assignment_ref not in assignments:
         # 유효값은 이 매니페스트 안에만 있고 리드는 그것을 추측할 수 없다.
         # 이름만 거절하면 읽는 쪽이 매니페스트를 직접 열어 키를 세게 된다.
+        critic_ref = critic_assignment_ref(str(manifest.get("taskType", "")))
+        recovery = ""
+        if (
+            args.assignment_ref == "reverify/critic-worker"
+            and critic_ref in assignments
+            and is_plan_critic_verification(
+                task_type=str(manifest.get("taskType", "")),
+                assignment_ref=critic_ref, dispatch_kind=args.dispatch_kind,
+            )
+        ):
+            recovery = (
+                f"; for the rostered plan critic, use --assignment-ref {critic_ref} "
+                "with --worker-id critic-worker and --audience reverification-worker. "
+                "Keep the plan-verify-r<N> dispatch kind and, on v2 runs, the selected "
+                "critic's --source-role-execution-ref. This is a reference correction; "
+                "the existing critic assignment does not need to be added or changed"
+            )
         raise AgentPromptCliError(
             f"assignment reference is missing from run manifest: "
             f"{args.assignment_ref}; this run declares "
             + (", ".join(sorted(assignments)) or "no invocation assignment")
+            + recovery
         )
     assignment_payload = assignments[args.assignment_ref]
     assignment = agent_model_assignment_from_payload(assignment_payload)

package/runtime/python/okstra_ctl/consumers.py

@@ -10,8 +10,6 @@ from __future__ import annotations
 
 import json
 import re
-import subprocess
-import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List, Optional
@@ -149,8 +147,6 @@ def append_consumer(plan_run_root: Path, *, impl_task_key: str, stage: int,
                 **fields,
             }
             _append_row(plan_run_root, record)
-    if status == "done":
-        _tag_stage_exit(plan_run_root, stage, fields.get("head_commit"))
     # 종결 status 는 점유 해제 이벤트이기도 하다 — 중복 append(no-op)에서도 풀어야
     # release 없이 done 만 기록된 과거 run 의 잔존 점유가 다음 호출에서 치유된다.
     if status == "done":
@@ -159,57 +155,6 @@ def append_consumer(plan_run_root: Path, *, impl_task_key: str, stage: int,
         _release_stage_occupancy_keeping_branch(impl_task_key, stage)
 
 
-STAGE_EXIT_TAG = "stage-{stage}-exit"
-
-
-def _repo_root(start: Path) -> Optional[Path]:
-    for candidate in [start, *start.parents]:
-        if (candidate / ".git").exists():
-            return candidate
-    return None
-
-
-def _tag_stage_exit(plan_run_root: Path, stage: int, head_commit: Any) -> None:
-    """Move `stage-<N>-exit` to the commit this ledger row records.
-
-    The tag used to be a plan step, so it was written while the stage was still
-    running — before the carry evidence the ledger reads. A stage then had three
-    exit points that could disagree: the tag, the recorded `head_commit`, and
-    the branch tip. okstra writes the tag at the moment it settles the stage, so
-    the tag and the ledger cannot drift apart.
-
-    Best effort by design: the ledger is the record and a tag is a convenience
-    for the reader. A tree that is not a git repository, or a commit git cannot
-    resolve, leaves the row written and says so on stderr.
-    """
-    if not isinstance(head_commit, str) or not head_commit.strip():
-        return
-    root = _repo_root(Path(plan_run_root).resolve())
-    if root is None:
-        return
-    commit = head_commit.strip()
-    tag = STAGE_EXIT_TAG.format(stage=stage)
-    try:
-        exists = subprocess.run(
-            ["git", "-C", str(root), "cat-file", "-e", f"{commit}^{{commit}}"],
-            capture_output=True,
-        )
-        if exists.returncode != 0:
-            print(
-                f"okstra: stage {stage} done recorded, but {commit[:12]} is not "
-                f"a commit in {root} — `{tag}` not moved",
-                file=sys.stderr,
-            )
-            return
-        subprocess.run(
-            ["git", "-C", str(root), "tag", "-f", tag, commit],
-            capture_output=True,
-            check=True,
-        )
-    except (OSError, subprocess.CalledProcessError) as exc:
-        print(f"okstra: could not move `{tag}` to {commit[:12]}: {exc}", file=sys.stderr)
-
-
 def _equivalent_row_exists(plan_run_root: Path, impl_task_key: str, stage: int,
                            status: str, force_reappend: bool,
                            head_commit: Any) -> bool:

package/runtime/python/okstra_ctl/domain/write_policy.py

@@ -131,8 +131,14 @@ def validate_write_policy_payload(payload: Mapping[str, Any]) -> None:
     _relative_paths(artifact.get("allowedPaths", ()))
     if source.get("mode") not in {"source-readonly", "project-mutation"}:
         raise WritePolicyError("sourcePolicy mode is invalid")
-    if set(source) != {"mode", "allowedRoot", "plannedPaths", "protectedPaths"}:
+    if set(source) - {"plannedPathsDeclared"} != {
+        "mode", "allowedRoot", "plannedPaths", "protectedPaths"
+    }:
         raise WritePolicyError("sourcePolicy is incomplete")
+    if "plannedPathsDeclared" in source and not isinstance(
+        source["plannedPathsDeclared"], bool
+    ):
+        raise WritePolicyError("sourcePolicy.plannedPathsDeclared must be a boolean")
     _absolute_text(source.get("allowedRoot"), "sourcePolicy.allowedRoot")
     _relative_paths(source.get("plannedPaths", ()))
     _relative_paths(source.get("protectedPaths", ()))

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -793,28 +793,17 @@ def _stable_git_projection(snapshot: MutationSnapshot) -> dict[str, Any]:
 
 
 def _path_ledger_is_unenforceable(policy: WritePolicy) -> bool:
-    """이 정책의 경로 장부를 근거로 변경을 거절할 수 있는가.
-
-    승인된 계획서에 `plannedPaths` 컬럼이 있으면 실행기는 그 목록에 묶이고,
-    목록은 반드시 비어 있지 않다(`write_policy._planned_paths_from_report` 는
-    선언된 경우에만 항목을 싣는다). 그 컬럼이 없는 옛 계획서에서는 실을 값이
-    없어 장부가 빈 채로 온다 — 종전에는 산문에서 유도한 문장 조각(`28 rows)`,
-    `captured in Stage 1)`)을 실었고, 그래서 계획이 지시한 파일 전부가 미허가
-    변경으로 읽혔다.
-
-    `project-mutation` 정책에서만 빈 장부가 "물을 수 없음" 을 뜻한다.
-    `source-readonly` 워커는 장부가 원래 비어 있고 그것이 "아무것도 바꾸지
-    말라" 는 뜻이므로, 그쪽 집행은 건드리지 않는다.
-
-    이 판정은 감사의 두 절반이 같은 함수를 읽는다. 종전에는 git 쪽만
-    `plannedPathsDeclared` 를 봤는데 그 키는 `build_write_policy` 가 만드는
-    sourcePolicy 에 아예 실리지 않아(4개 키 고정, `validate_write_policy_payload`
-    가 그 집합을 강제) 어느 쪽에서도 참이 된 적이 없다.
+    """옛 계획의 미선언 목록만 면제하고, 산출물 전용 계획의 빈 소스 목록은 집행한다.
+
+    선언 여부가 저장되기 전 정책은 기존의 빈 목록 해석을 유지한다.
+    새 정책은 경로 분류 후에도 선언 여부를 보존하므로 산출물만 남은 계획이
+    임의의 소스 변경이나 커밋을 허용하지 않는다.
     """
     source = policy.source_policy
     return (
         source.get("mode") == "project-mutation"
         and not source.get("plannedPaths")
+        and not source.get("plannedPathsDeclared", False)
     )
 
 

package/runtime/python/okstra_ctl/final_report_schema.py

@@ -211,26 +211,17 @@ class _Validator:
     def _misplaced_property_hint(
         self, name: str, path: tuple[str | int, ...],
     ) -> str:
-        """이 키가 스키마의 다른 자리에서 정의된 필드면 "옮겨라" 를 덧붙인다.
-
-        `additional property 'X' is not allowed` 만 보면 "스키마에 그런 칸이
-        없다" 로 읽힌다. 실제로는 X 가 다른 객체의 필드이고 작성자가 자리를
-        틀린 경우가 있고, 그때 지우면 다음 라운드에서 `required property 'X'
-        is missing` 이 나온다 — 라운드 하나를 왕복에 쓴다(2026-09-09 실측,
-        dev-10642 implementation-planning: 최상위 필수 `summary` 를
-        `rationale` 안에 써서 지웠다가 되살렸다).
-        """
+        """동명 필수 필드의 위치만 알린다. 이름 일치는 값의 의미를 증명하지 않는다."""
         found = self._required_property_owners(name) - {_format_path(path)}
         if not found:
             return ""
-        # 최상위를 앞에 둔다. 잘못 놓인 키는 대개 최상위 필드가 한 단계 안으로
-        # 들어간 것이고, 나머지 소유자는 같은 이름을 쓰는 다른 행 타입이다.
         owners = (
             ["<root>"] if "<root>" in found else []
         ) + sorted(found - {"<root>"})
         return (
-            f" — '{name}' is a REQUIRED property of {', '.join(owners[:3])}, not "
-            f"of {_format_path(path)}; move it there rather than removing it"
+            f" — '{name}' is also required at {', '.join(owners[:3])}; "
+            "a shared name does not establish where this value belongs. "
+            "Check the target field's schema and meaning before moving any value"
         )
 
     def _required_property_owners(self, name: str) -> set[str]:
@@ -495,14 +486,14 @@ def verdict_token_rule(schema: Mapping[str, Any], task_type: str) -> tuple[str,
 
 
 def task_block_rules(schema: Mapping[str, Any], block_key: str) -> tuple[str, ...]:
-    """이 task type 의 데이터 블록(`properties[block_key]`)이 요구하는 모양을 한
+    """최상위 필드(`properties[block_key]`)가 요구하는 모양을 한
     객체당 한 줄의 저작 계약 문장으로 편다.
 
     리드는 report-writer 지시문을 쓸 때 블록 안쪽의 필수 필드·식별자 패턴·
     정수 필드·고정 길이 배열을 알 길이 프롬프트 경로에 없어 스키마 JSON 을
     손으로 파싱했고, 그래도 놓친 만큼 같은 리포트를 다시 썼다(2026-09-03 실측,
     dev-10626 implementation-option-selection: 네 회차). 여기서 뽑아 합성 묶음의
-    저작 계약에 싣는다. 블록이 없거나 객체가 아니면 빈 튜플이다.
+    저작 계약에 싣는다. 필드가 없으면 빈 튜플이다.
 
     경로는 스키마 키다(`rankedOptions[]` 는 `- Item N` 목록의 각 항목). 같은
     정의(`$ref`)가 두 경로에 나오면 두 번째는 첫 경로를 가리킨다 — 랭킹 옵션과
@@ -514,7 +505,16 @@ def task_block_rules(schema: Mapping[str, Any], block_key: str) -> tuple[str, ..
         return ()
     lines: list[str] = []
     described: dict[str, str] = {}
-    _describe_object(root, block, block_key, lines, described)
+    resolved, _ = _resolved(root, block)
+    if resolved.get("type") == "object" or "properties" in resolved:
+        _describe_object(root, block, block_key, lines, described)
+    else:
+        nested: list[tuple[str, Any]] = []
+        constraint = _describe_property(root, block, block_key, nested)
+        if constraint:
+            lines.append(f"`{block_key}`: {constraint}")
+        for child_path, child in nested:
+            _describe_object(root, child, child_path, lines, described)
     return tuple(lines)
 
 

package/runtime/python/okstra_ctl/plan_items_cli.py

@@ -1935,6 +1935,12 @@ def _state_next_dispatch(args: argparse.Namespace) -> NextDispatch:
     data, current, _audit, _history = _round_inputs(args)
     run_manifest = getattr(args, "run_manifest", None)
     payloads = _prepared_payloads(run_manifest)
+    # 실제 목록에서 제외할 항목을 다음 비평 검증으로 요구하면 빈 큐에서 멈춘다.
+    allowed = set(dispatch_item_ids(
+        [payloads.get(item["id"], item) for item in current],
+        data["planBodyVerification"].get("stageLedger"),
+    ))
+    current = [item for item in current if item["id"] in allowed]
     return next_dispatch(
         current, payloads, critic_rostered=_rostered_critic(run_manifest),
         decision_items=(

package/runtime/python/okstra_ctl/report_assembly.py

@@ -594,7 +594,10 @@ def validate_plan_draft(
         *task_narrative_errors(
             draft, load_schema_version("3.0"), str(manifest.get("taskType", "")),
         ),
-        *selected_direction_plan_errors(draft, project_root, manifest),
+        *[
+            f"implementationPlanning: {error}"
+            for error in selected_direction_plan_errors(draft, project_root, manifest)
+        ],
     ]
 
 

package/runtime/python/okstra_ctl/report_corrections.py

@@ -20,7 +20,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Callable, Mapping, Sequence
 
-from .final_report_schema import validate
+from .final_report_schema import task_block_rules, validate
 from .json_boundary import JsonBoundaryError, load_owned_object
 from .report_markdown import humanise
 from .report_narrative import (
@@ -29,6 +29,7 @@ from .report_narrative import (
     render_narrative,
     validate_writer_owned,
     writer_owned_path_defect,
+    writer_owned_schema,
 )
 
 
@@ -204,7 +205,7 @@ def check_corrections(
     3. 경로 해소와 `current` 일치. `rewrite` 는 배열의 `[len]` 추가 위치를 허용한다.
     4. 작성자 소유 경로인가.
     5. replace·remove 를 적용한 사본을 작성자 소유 값 스키마와 task 의미 검증기로
-       대조한다. rewrite 경로 아래의 스키마 결함은 뺀다(작성자가 다시 쓸 자리다).
+       대조한다. rewrite 경로 아래로 특정된 결함은 뺀다(작성자가 다시 쓸 자리다).
     6. rewrite 마다 그 경로의 스키마 제약 문장을 붙인다.
     """
     ledger_dict = dict(ledger)
@@ -279,7 +280,7 @@ def check_corrections(
             continue
         if kind == "rewrite":
             rewrite_paths.append(path)
-            constraints[correction_id] = _constraints_for(path, block_rules)
+            constraints[correction_id] = _constraints_for(path, block_rules, schema)
 
     replacements = [c for c in corrections if c.get("kind") == "replace" and str(c.get("id")) in parsed]
     removals = [c for c in corrections if c.get("kind") == "remove" and str(c.get("id")) in parsed]
@@ -305,15 +306,16 @@ def check_corrections(
     # 회차에 전건을 보게 하려는 것이 이 모듈의 이유다. 결함인 교정은 적용하지
     # 않았으므로 그 자리는 기준 서사의 값 그대로다.
     if scratch is not None:
-        for error in validate_writer_owned(scratch, schema):
-            location = error.split(": ", 1)[0]
+        errors = validate_writer_owned(scratch, schema)
+        if semantic_validator is not None:
+            errors.extend(semantic_validator(scratch))
+        for error in errors:
+            location, separator, _ = error.partition(": ")
+            location = location if separator else "-"
             if any(location == rp or location.startswith(f"{rp}.") or location.startswith(f"{rp}[")
                    for rp in rewrite_paths):
                 continue
             defects.append(_defect("applied", location, error))
-        if semantic_validator is not None:
-            for error in semantic_validator(scratch):
-                defects.append(_defect("applied", "-", str(error)))
 
     mechanical = not defects and not rewrite_paths
     return CorrectionsCheck(
@@ -321,16 +323,22 @@ def check_corrections(
     )
 
 
-def _constraints_for(path: str, block_rules: Sequence[str]) -> tuple[str, ...]:
-    """이 경로(또는 가장 가까운 상위 객체)의 `task_block_rules` 줄."""
+def _constraints_for(
+    path: str, block_rules: Sequence[str], schema: Mapping[str, Any],
+) -> tuple[str, ...]:
+    """가장 가까운 필드의 제약. 공통 필드도 검증에 쓰는 스키마에서 추출한다."""
     normalised = normalise_field_path(path)
+    root_key = str(parse_field_path(path)[0])
+    rules = block_rules
+    if not any(rule.startswith(f"`{root_key}`: ") for rule in rules):
+        rules = task_block_rules(writer_owned_schema(schema), root_key)
     candidates = [normalised]
     while "." in candidates[-1]:
         candidates.append(candidates[-1].rsplit(".", 1)[0])
     for candidate in candidates:
         lines = tuple(
-            rule for rule in block_rules
-            if rule.startswith(f"`{candidate}`: ")
+            rule for rule in rules
+            if rule.startswith(f"`{candidate}`: ") or rule.startswith(f"`{candidate}[]")
         )
         if lines:
             return lines
@@ -423,9 +431,10 @@ def render_corrections_section(
         lines.extend(["", "### Context", "", context.strip()])
     lines.extend([
         "",
-        "Change nothing else: not a sentence, not a score, not an evidence path, not a "
-        "verdict, not the `Human Summary`, and not the blockquote indentation where each "
-        "value line sits two spaces deeper than its own `- **Label**` line.",
+        "Outside the correction paths, preserve every sentence, score, evidence path, "
+        "and verdict. Follow the schema constraints when a correction describes an "
+        "incompatible shape. Preserve the blockquote indentation: each value line "
+        "sits two spaces deeper than its own `- **Label**` line.",
     ])
     return lines
 

package/runtime/python/okstra_ctl/report_finalize.py

@@ -1088,7 +1088,7 @@ def _parser() -> argparse.ArgumentParser:
         "--only",
         action="append",
         default=[],
-        choices=list(STEP_ORDER),
+        choices=list(dict.fromkeys((*STEP_ORDER, *V3_STEP_ORDER))),
         help=(
             "run only these steps (repeatable, contractual order preserved). "
             "Use `--only validate-run` to retry the step that usually fails "

package/runtime/python/okstra_ctl/report_narrative.py

@@ -118,8 +118,8 @@ _MACHINE_OWNED_NESTED = frozenset(
 )
 
 
-def _without_machine_owned_required(node: Any, *, negated: bool = False) -> Any:
-    """`required` 목록에서 기계 소유 필드 이름만 뺀 스키마 사본.
+def _without_machine_owned_fields(node: Any, *, negated: bool = False) -> Any:
+    """기계 소유 필드의 정의와 필수 조건을 뺀 작성자용 스키마 사본.
 
     `not` 아래는 건드리지 않는다. 거기서 `required: [designPreparation]` 은
     "이 필드가 있으면 안 된다" 는 뜻이고 서사에는 원래 없으니 이미 만족한다.
@@ -128,7 +128,7 @@ def _without_machine_owned_required(node: Any, *, negated: bool = False) -> Any:
     뒤집는다. 실제로 `direction-invalidated` 계획 분기가 그렇게 죽었다.
     """
     if isinstance(node, list):
-        return [_without_machine_owned_required(item, negated=negated) for item in node]
+        return [_without_machine_owned_fields(item, negated=negated) for item in node]
     if not isinstance(node, dict):
         return node
     result: dict[str, Any] = {}
@@ -137,8 +137,13 @@ def _without_machine_owned_required(node: Any, *, negated: bool = False) -> Any:
             result[key] = [
                 name for name in value if name not in _MACHINE_OWNED_NESTED
             ]
+        elif key == "properties" and isinstance(value, dict) and not negated:
+            result[key] = {
+                name: _without_machine_owned_fields(field)
+                for name, field in value.items() if name not in _MACHINE_OWNED_NESTED
+            }
         else:
-            result[key] = _without_machine_owned_required(
+            result[key] = _without_machine_owned_fields(
                 value, negated=negated or key == "not"
             )
     return result
@@ -169,8 +174,8 @@ def writer_owned_schema(schema: Mapping[str, Any]) -> dict[str, Any]:
     return {
         "type": "object",
         "additionalProperties": False,
-        "properties": _without_machine_owned_required(properties),
-        "$defs": _without_machine_owned_required(schema.get("$defs", {})),
+        "properties": _without_machine_owned_fields(properties),
+        "$defs": _without_machine_owned_fields(schema.get("$defs", {})),
     }
 
 

package/runtime/python/okstra_ctl/report_synthesis_packet.py

@@ -811,7 +811,7 @@ def _schema_authoring_rules(
         if isinstance(key, str) and key in allowed
     )
     block_key = TASK_TYPE_DATA_PROPERTY.get(task_type, "")
-    block_rules = task_block_rules(schema, block_key) if block_key else ()
+    block_rules = task_block_rules(writer_owned_schema(schema), block_key) if block_key else ()
     return (
         required_top_level,
         verdict_token_rule(schema, task_type),

package/runtime/python/okstra_ctl/wizard/confirmation.py

@@ -340,4 +340,8 @@ def confirmation_block(state: WizardState) -> str:
         lines.append(f"  pr-template   : {state.pr_template_path} ({state.pr_template_scope or 'once'})")
     if state.fix_cycle:
         lines.append(f"  fix-cycle     : {state.fix_cycle}")
+    lines.append(_msg(
+        state.workspace_root, "confirmation", "provider_data_scope",
+        project_root=state.project_root,
+    ))
     return "\n".join(lines)

package/runtime/python/okstra_ctl/wizard/engine.py

@@ -35,7 +35,6 @@ from .ids import (
 from .state import Prompt, WizardError, WizardState, _is_role_selection_step
 from .prompts import _domain_prompt
 from .picker_navigation import (
-    accept_picker_answer,
     is_split_picker,
     merge_split_picker_answer,
     present_picker,
@@ -150,11 +149,8 @@ def _native_picker_screen(state: WizardState, prompt: Prompt) -> Prompt:
     때마다 턴이 하나씩 들었다(실측 2026-09-09, 후보 13개인 critic 화면).
 
     묶음에 못 실리면(옵션 16개 초과, 라벨 중복, 질문 묶음이 없는 세션)
-    단일 선택은 종전대로 쪽으로 나누고(`present_picker`), 체크박스는
-    `CapabilityInteractionPort.plan` 이 `numbered-multi` 로 내려 전체 목록을
-    한 번에 보인다. 체크박스는 쪽으로 나누지 않는다 — 쪽 사본이 추천 표시를
-    단 채 단일 선택이 돼 `Prompt` 의 추천 불변식(단일 선택은 추천 정확히
-    하나)에 걸려 화면이 열리지 않았다(실측 2026-09-09, verifier 전체 후보 화면).
+    `CapabilityInteractionPort.plan` 이 단일 선택은 `numbered-single`,
+    체크박스는 `numbered-multi` 로 내려 전체 목록을 한 번에 보인다.
     """
     if "native_single_select" not in state.available_functions:
         return prompt
@@ -172,7 +168,7 @@ def _native_picker_screen(state: WizardState, prompt: Prompt) -> Prompt:
         return split
     if prompt.multi:
         return prompt
-    return present_picker(state, prompt, limit=port.native_option_limit)
+    return present_picker(prompt)
 
 
 def _next_prompt_screen(state: WizardState) -> Prompt:
@@ -404,13 +400,6 @@ def submit(state: WizardState, value: str) -> dict[str, Any]:
         return {"echo": "", "next": prompt_payload(state, prompt)}
     plan = _interaction_plan(state, prompt)
     value = _normalize_interaction_answer(state, prompt, plan, value)
-    if plan.kind == "native-single":
-        original = _next_prompt_screen(state)
-        if original.kind == "pick_group":
-            original = next(q for q in original.questions if q.step == prompt.step)
-        value = accept_picker_answer(state, original, value)
-        if value is None:
-            return {"echo": "", "next": prompt_payload(state, next_prompt(state))}
     if is_split_picker(prompt):
         # 질문 묶음으로 잘린 픽 — 탭별 CSV 를 한 줄로 합쳐 원본 step 의 제출
         # 경로로 보낸다. 원본의 선택지로 검증한다.
@@ -419,8 +408,7 @@ def submit(state: WizardState, value: str) -> dict[str, Any]:
     elif prompt.kind == "pick_group":
         return _submit_group(state, prompt, value)
     if _is_role_selection_step(prompt.step):
-        # 고정 단일 역할의 화면은 호스트 한도에 맞춰 쪽으로 잘린 사본일 수
-        # 있다(`present_picker`). 답은 잘리지 않은 원본의 선택지로 검증한다.
+        # 화면의 중복 라벨을 구분했어도 답은 원본 선택지의 값으로 검증한다.
         original = next_role_prompt(state)
         if original is not None and original.step == prompt.step:
             prompt = original

package/runtime/python/okstra_ctl/wizard/picker_navigation.py

@@ -6,20 +6,16 @@
 원래 step 의 제출 경로로 간다. 단일 선택(예: critic 처럼 최대 1개인 역할)도
 같은 방식으로 자르되 통틀어 하나만 고른 답이어야 한다.
 
-그 크기도 넘거나 질문 묶음이 없는 세션이면, 단일 선택은 쪽으로 나누고
-(`present_picker`) 체크박스는 `numbered-multi` 로 전체 목록을 한 번에 보인다
-(`engine._native_picker_screen`). 체크박스를 쪽으로 나누던 경로는 쪽 사본이
-추천 표시를 단 채 단일 선택이 돼 `Prompt` 의 추천 불변식에 걸리므로
-2026-09-09 에 뺐다.
+그 크기도 넘거나 질문 묶음이 없는 세션이면 전체 번호 목록을 한 번에 보인다.
+`present_picker` 는 중복 라벨만 구분하고 선택지 순서와 값을 보존한다.
 """
 import json
 import math
 from dataclasses import replace
 
 from .ids import PICK_TYPE_CUSTOM
-from .state import Option, Prompt, WizardError, WizardState
+from .state import Prompt, WizardError
 
-_PAGE_PREFIX = "__okstra_picker_page__:"
 _SPLIT_SEPARATOR = "#"
 
 
@@ -113,7 +109,7 @@ def merge_split_picker_answer(prompt: Prompt, value: str) -> str:
     return ",".join(chosen)
 
 
-def present_picker(state: WizardState, prompt: Prompt, *, limit: int) -> Prompt:
+def present_picker(prompt: Prompt) -> Prompt:
     if prompt.kind != "pick" or not prompt.options:
         return prompt
     labels = [option.label for option in prompt.options]
@@ -121,33 +117,7 @@ def present_picker(state: WizardState, prompt: Prompt, *, limit: int) -> Prompt:
         option,
         label=option.label + (f" [{option.value}]" if labels.count(option.label) > 1 else ""),
     ) for option in prompt.options]
-    paged = len(options) > limit
-    size = max(1, limit - 1) if paged else len(options)
-    offset = state.picker_offsets.get(prompt.step, 0)
-    offset = offset if 0 <= offset < len(options) else 0
-    shown = options[offset:offset + size]
-    label = prompt.label
-    if paged:
-        next_offset = offset + size if offset + size < len(options) else 0
-        shown.append(Option(
-            f"{_PAGE_PREFIX}{next_offset}",
-            "다음 선택지" if next_offset else "처음 선택지로",
-        ))
-        label += f" ({offset + 1}–{min(offset + size, len(options))}/{len(options)})"
-    if len(shown) == 1:
-        shown.append(Option(f"{_PAGE_PREFIX}0", "다시 보기"))
-    shown = [o for o in shown if o.value != PICK_TYPE_CUSTOM] + [
-        o for o in shown if o.value == PICK_TYPE_CUSTOM
+    options = [o for o in options if o.value != PICK_TYPE_CUSTOM] + [
+        o for o in options if o.value == PICK_TYPE_CUSTOM
     ]
-    return replace(prompt, label=label, options=shown)
-
-
-def accept_picker_answer(state: WizardState, prompt: Prompt, value: str) -> str | None:
-    if value.startswith(_PAGE_PREFIX):
-        raw_offset = value.removeprefix(_PAGE_PREFIX)
-        if not raw_offset.isdecimal() or not 0 <= int(raw_offset) < len(prompt.options):
-            raise WizardError("invalid picker page; select a returned navigation option")
-        state.picker_offsets[prompt.step] = int(raw_offset)
-        return None
-    state.picker_offsets.pop(prompt.step, None)
-    return value
+    return replace(prompt, options=options)

package/runtime/python/okstra_ctl/worktree_status_cli.py

@@ -19,9 +19,8 @@ and stage-integration steps use.
 Use it as the assertion in a plan step:
   okstra worktree-status --check-clean
 
-Do not chain a `git tag stage-<N>-exit` onto it. okstra writes that tag when it
-settles the stage, at the commit the carry evidence records; a step that tags
-while the stage is still running puts it on an earlier commit.
+Do not chain a `git tag stage-<N>-exit` onto it. Stage completion records the
+commit in the consumer ledger without creating or moving git tags.
 
 Output: JSON { ok, path, clean, entries, excluded }. `entries` holds the
 `git status --short` rows that made it dirty; `excluded` lists the paths left

package/runtime/python/okstra_ctl/write_policy.py

@@ -51,6 +51,8 @@ def build_write_policy(
             _relative_paths(invocation.get("protectedPaths", (".okstra", ".git")))
         ),
     }
+    if "plannedPathsDeclared" in invocation:
+        source_policy["plannedPathsDeclared"] = invocation["plannedPathsDeclared"]
     git_policy = _git_policy(invocation, source_root, source_mode)
     external_roots = _validated_auxiliary_roots(invocation, assignment)
     auxiliary_policy = {
@@ -144,18 +146,21 @@ def build_invocation_write_contract(
             )
         )
     )
+    source_root = worktree.resolve() if worktree is not None else root
+    source_paths = _planned_source_paths(
+        planned_paths, root, source_root, relative_artifacts
+    )
     invocation: dict[str, Any] = {
         "role": role,
         "projectRoot": str(root),
         "artifactPaths": list(relative_artifacts),
-        "plannedPaths": list(planned_paths),
+        "plannedPaths": list(source_paths),
         "plannedPathsDeclared": planned_paths_declared,
         "protectedPaths": [".okstra", ".git"],
         "generatedPaths": list(generated_paths),
         "scratchRoots": [str(path) for path in scratch_roots],
         "auxiliaryRoots": [str(path) for path in auxiliary_roots],
     }
-    source_root = worktree.resolve() if worktree is not None else root
     if role == "implementer":
         invocation.update({
             "expectedBaseCommit": _git_output(source_root, "rev-parse", "HEAD"),
@@ -173,6 +178,47 @@ def build_invocation_write_contract(
     return policy, derive_write_enforcement(policy, maximum_precision, role=role)
 
 
+def _planned_source_paths(
+    paths: Sequence[str],
+    project_root: Path,
+    source_root: Path,
+    artifact_paths: Sequence[str],
+) -> tuple[str, ...]:
+    """산출물 권한은 프로젝트에, 소스 변경 목록은 배정 작업 디렉터리에 결속한다."""
+    sources: set[str] = set()
+    for value in paths:
+        candidate = Path(value)
+        if candidate.is_absolute():
+            root = (
+                source_root if candidate.is_relative_to(source_root) else project_root
+            )
+            relative = _relative_to_root(candidate, root, "planned")
+        else:
+            relative = _relative_paths((value,))[0]
+            root = (
+                project_root
+                if PurePosixPath(relative).parts[0] == ".okstra"
+                else source_root
+            )
+            _relative_to_root(root / relative, root, "planned")
+        relative = _relative_paths((relative,))[0]
+        path = PurePosixPath(relative)
+        if path.parts[0] == ".okstra":
+            if root != project_root or not any(
+                path.is_relative_to(allowed) for allowed in artifact_paths
+            ):
+                raise WritePolicyError(
+                    f"planned artifact path exceeds this worker's artifact permissions: {value}"
+                )
+        else:
+            if path.parts[0] == ".git":
+                raise WritePolicyError(f"planned source path is protected: {value}")
+            # 원래 체크아웃의 절대 소스 경로도 실제 쓰기는 배정 작업 디렉터리에 한정된다.
+            _relative_to_root(source_root / relative, source_root, "planned source")
+            sources.add(relative)
+    return tuple(sorted(sources))
+
+
 def task_root_from_run_manifest(
     project_root: Path, manifest: Mapping[str, Any]
 ) -> Path | None:
@@ -191,7 +237,7 @@ def task_root_from_run_manifest(
 
 def planned_paths_from_run_manifest(
     project_root: Path, manifest: Mapping[str, Any]
-) -> tuple[str, ...]:
+) -> tuple[tuple[str, ...], bool]:
     active_value = manifest.get("activeRunContextPath")
     if not isinstance(active_value, str) or not active_value:
         raise WritePolicyError("implementer write policy has no active run context")
@@ -421,7 +467,8 @@ def _planned_paths_from_report(
         if isinstance(path, str) and path.strip()
     }
     if paths:
-        return _relative_paths(tuple(sorted(paths))), True
+        # 경로 분류는 산출물 권한과 배정 작업 디렉터리를 함께 아는 정책 생성기가 맡는다.
+        return tuple(sorted(paths)), True
     # A plan approved before `plannedPaths` existed carries its paths only in
     # the prose `files` cell. That prose does not survive being split into
     # paths — it mis-splits globs and parentheticals — so the ledger stays

package/runtime/schemas/execution-manifest-v2.schema.json

@@ -148,6 +148,7 @@
             "mode": {"enum": ["source-readonly", "project-mutation"]},
             "allowedRoot": {"type": "string", "pattern": "^/"},
             "plannedPaths": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "uniqueItems": true},
+            "plannedPathsDeclared": {"type": "boolean"},
             "protectedPaths": {"type": "array", "items": {"type": "string", "pattern": "\\S"}, "uniqueItems": true}
           },
           "additionalProperties": false

package/runtime/schemas/final-report-v2.0.schema.json

@@ -8651,7 +8651,7 @@
           "minLength": 1
         },
         "plannedPaths": {
-          "description": "Repository-relative paths this step may write, one per entry. `files` is prose for a human reader and cannot serve as a path ledger — it carries globs, exclusions and counts — so the implementer write policy reads this list instead.",
+          "description": "Paths this step may write, one per entry. Source paths are relative to the assigned worktree; absolute paths under that worktree or the project checkout identify the same repository-relative source. `.okstra` artifact paths are anchored at the original project root and may be absolute. The write-policy builder checks artifact paths against the worker's existing artifact permissions and keeps them out of the source ledger. Keep absolute artifact paths in executable commands. `files` is human-readable prose, not a path ledger.",
           "type": "array",
           "minItems": 1,
           "items": {

package/runtime/schemas/final-report-v3.0.schema.json

@@ -8796,7 +8796,7 @@
           "minLength": 1
         },
         "plannedPaths": {
-          "description": "Repository-relative paths this step may write, one per entry. `files` is prose for a human reader and cannot serve as a path ledger — it carries globs, exclusions and counts — so the implementer write policy reads this list instead.",
+          "description": "Paths this step may write, one per entry. Source paths are relative to the assigned worktree; absolute paths under that worktree or the project checkout identify the same repository-relative source. `.okstra` artifact paths are anchored at the original project root and may be absolute. The write-policy builder checks artifact paths against the worker's existing artifact permissions and keeps them out of the source ledger. Keep absolute artifact paths in executable commands. `files` is human-readable prose, not a path ledger.",
           "type": "array",
           "minItems": 1,
           "items": {

package/runtime/skills/okstra-run/SKILL.md

@@ -53,7 +53,7 @@ The wizard tells you which relay operation to use via `next.interaction.kind`. S
 - `kind: "done"` → input collection finished; move to Step 5.
 - `kind: "aborted"` → the user picked abort; the wizard is terminally cancelled. Tell the user on one short line that the run setup was aborted, delete the state file (`rm` with the literal path), and stop this skill — do NOT call `render-args` or `render-bundle` (the wizard rejects `render-args` on an aborted state).
 
-When native single selection is available, the runtime divides long lists and unsupported multi-selections into selectable screens. Render the returned screen without rebuilding the full list. This applies to plan confirmation, stages, role counts, and provider/model lists. Submit navigation and completion option values normally; the runtime retains the current step until its answer is complete. A ban on textual choice lists does not authorize asking the user to type a model identifier. If a required selector is unavailable, preserve state and follow the relay's `recovery` object. Genuine text steps still collect text.
+When native selection is available, the runtime keeps choices in that control or in same-screen question tabs when the complete selection fits. Otherwise, it returns a complete numbered list: show all labels and descriptions in one message and accept a number, label, or value (comma-separated for multiple choices). This applies to plan confirmation, stages, role counts, and provider/model lists. Do not paginate choices or add a next-page option. Follow the returned `interaction.kind`, including numbered interactions when the user generally prefers a selector. If the declared selector itself fails, follow the relay's `recovery` object. Genuine text steps still collect text.
 
 Submit the answer shape required by `interaction.answerProtocol`; do not add normalization beyond the registered relay's explicit mapping. Invalid, out-of-range, or ambiguous answers return `ok: false` and must re-render the same complete interaction.
 
@@ -228,6 +228,8 @@ When `next.step == "confirm"`, the prompt's `label` already carries the full sel
 
 `okstra wizard confirmation --state-file <path>` returns the same block as `{ok: true, text: ...}` for a text-only host or when the user asks to see the summary again; it is not a substitute for the label.
 
+Keep the provider data-transfer disclosure in that label alongside the selected roles/models and task inputs. The user's actual `Proceed` response authorizes the displayed recipients and task-material scope; it does not grant host execution privileges. When dispatching, follow the host relay's guidance to carry that response and scope into the execution-permission request. A freshly generated `confirmationText` does not retroactively add disclosure to an older user response.
+
 ## Step 5: Render the task bundle
 
 When `next.kind == "done"`, fetch the public wizard outcome:
@@ -261,6 +263,8 @@ Before you ask the user for any approval, clarification, or decision after worke
 
 Build the `okstra render-bundle` invocation from `outcome.renderArgv`, passing every token verbatim and in order (including empty strings — they are intentional `use phase default` markers).
 
+Before invoking it, follow the active host relay's execution-permission guidance. For Codex, read "Permission before bundle preparation" in the relay already selected at preflight: bundle preparation can write protected Git metadata while creating a branch and worktree, even with `--render-only`. Apply this guidance to the first invocation and each subsequent phase or stage preparation.
+
 Analysis sidetracks therefore forward wizard-owned tokens such as `--analysis-target "<value>"` and `--evidence-inputs "<value>"` when they are present. These are examples of the verbatim token rule, not a separate hard-coded argument list.
 
 Step 3's empty-answer and escaping rules apply verbatim: every flag in `renderArgv` whose following value is the empty string MUST still be passed explicitly (e.g. `--workers ""`, `--directive ""`) — `render-bundle` distinguishes "flag absent" from "flag present with empty value", and the wizard's intent is always the latter.
@@ -460,6 +464,10 @@ Do not read the wizard state file directly. `okstra wizard outcome` exposes any
 - Each wizard run owns its own state file (one per `okstra wizard new-state-file`); two parallel skill invocations do not collide.
 - The skill must NOT call `okstra.sh` (or any other bash entrypoint) that would re-implement the orchestration. The wizard + `render-bundle` is the single authority.
 
+## Boundary updates
+
+Follow the rendered launch prompt's "Progress, remaining work, and recommendation" guidance at each phase or implementation-stage boundary, at task completion, and before a controlled session pause or handoff. Include results, remaining work, and the recommended action with its reason. During an authorized continuous run, report the boundary and continue the queue; when the lead returns, relay its closeout without repeating an already delivered update.
+
 ## Failure Modes
 
 | Symptom | Cause | Fix |