okstra 0.199.4 → 0.200.0

package/README.md

@@ -37,6 +37,7 @@ Role assignments are persisted separately from the host runtime, but the lead pr
 | Antigravity | Antigravity CLI | `okstra-antigravity-exec.sh` | leader, analyser, critic, implementer, verifier |
 | Grok | Grok CLI | `okstra-grok-exec.sh` | leader, read-only analyser, and critic |
 | Kimi | Kimi CLI | `okstra-kimi-exec.sh` | leader, read-only analyser, and critic |
+| Z.ai GLM | — | `okstra-zai-exec.sh` (Claude Code) | analyser, critic, designer, planner, implementer, verifier, report-writer, translator |
 
 Canonical role names are `leader`, `analyser`, `critic`, `designer`, `planner`, `implementer`, `verifier`, `report-writer`, and `translator`. `lead` is a compatibility alias for `leader`. `executor` is a compatibility alias for `implementer`. New records write only the canonical names.
 
@@ -46,7 +47,9 @@ Grok and Kimi can now lead through their registered host adapters. Their worker
 
 `okstra run <host-id-or-alias>` resolves the requested adapter from the host registry and checks its `spawn-process` readiness before starting it. The installed `okstra-run` skill instead uses `current-session`: it declares only the semantic functions the live harness can actually perform (`plain_text_input`, plus any available native single-select, multi-select, or grouped-question function) and reuses the current lead session. User-installed adapters are discovered only from `~/.okstra/adapters/hosts/<id>/` and `~/.okstra/adapters/providers/<id>/`; project-local executable adapter code is ignored.
 
-The next direct-CLI candidates are Mistral Vibe and Qwen Code. DeepSeek V4, GLM-5.2, and MiniMax M2.7 remain API-adapter candidates because their current official coding-agent execution surfaces do not fit Okstra's wrapper contract as directly. Newly published provider models are exposed only after the corresponding local CLI reports them; this keeps model discovery separate from marketing availability.
+Z.ai GLM workers reuse the installed Claude Code executable with process-local Z.ai connection settings. Set `ZAI_API_KEY` in the environment that launches Okstra, then select `zai/glm-5.3` or `zai/glm-5.3-flash` for a worker role. Claude configuration files remain unchanged. See [GLM worker setup](docs/cli.md#zai-glm-workers) for isolation and accounting details.
+
+The next direct-CLI candidates are Mistral Vibe and Qwen Code. DeepSeek V4 and MiniMax M2.7 remain API-adapter candidates because their current official coding-agent execution surfaces do not fit Okstra's wrapper contract as directly. Model catalog entries and account availability are distinct; GLM authorization is checked when its CLI process calls Z.ai.
 
 okstra is **not** a one-shot code review tool. It is for work that **spans multiple phases, needs input from multiple agents, and feeds each phase's output into the next phase**.
 

package/dist/lib/runtime-payload.mjs

@@ -15,6 +15,7 @@ export const RUNTIME_BIN_FILES = Object.freeze([
     { name: "okstra-antigravity-exec.sh" },
     { name: "okstra-grok-exec.sh" },
     { name: "okstra-kimi-exec.sh" },
+    { name: "okstra-zai-exec.sh" },
     { name: "okstra-provider-exec.py" },
     // 진입 스크립트들이 import 하는 경로 부트스트랩. 이들과 같은
     // 디렉터리에 있어야 `sys.path` 를 고치기 전에 import 된다.

package/dist/lib/runtime-payload.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-payload.mjs","sourceRoot":"","sources":["../../src/lib/runtime-payload.mts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,EAAE;AACF,oCAAoC;AACpC,0DAA0D;AAC1D,iEAAiE;AACjE,gEAAgE;AAChE,kDAAkD;AAClD,EAAE;AACF,kCAAkC;AAalC,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAA8B,MAAM,CAAC,MAAM,CAAC;IACxE,EAAE,IAAI,EAAE,WAAW,EAAE;IACrB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACjC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACnC,uCAAuC;IACvC,2CAA2C;IAC3C,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAClC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACpC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE;IACpD,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,IAAI,EAAE;IACnD,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE;CAChD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,gBAAgB;IAChB,YAAY;IACZ,oBAAoB;IACpB,eAAe;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2C,MAAM,CAAC,MAAM,CAAC;IACrF,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;IACxC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACZ,CAAC,CAAC;AAEZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAClE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7C,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CACjE,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7E,CAAC"}
+{"version":3,"file":"runtime-payload.mjs","sourceRoot":"","sources":["../../src/lib/runtime-payload.mts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,EAAE;AACF,oCAAoC;AACpC,0DAA0D;AAC1D,iEAAiE;AACjE,gEAAgE;AAChE,kDAAkD;AAClD,EAAE;AACF,kCAAkC;AAalC,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAA8B,MAAM,CAAC,MAAM,CAAC;IACxE,EAAE,IAAI,EAAE,WAAW,EAAE;IACrB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACjC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC9B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACnC,uCAAuC;IACvC,2CAA2C;IAC3C,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAClC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACpC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE;IACpD,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,IAAI,EAAE;IACnD,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE;CAChD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,gBAAgB;IAChB,YAAY;IACZ,oBAAoB;IACpB,eAAe;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2C,MAAM,CAAC,MAAM,CAAC;IACrF,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;IACxC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACZ,CAAC,CAAC;AAEZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAClE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7C,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CACjE,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7E,CAAC"}

package/docs/cli.md

@@ -781,6 +781,16 @@ It then displays `Continue? [y/yes]:`. Any response other than `y` or `yes` exit
 
 ---
 
+## Z.ai GLM workers
+
+Z.ai is a worker provider (`zai`) that uses the existing `claude` executable. Install Claude Code, provide `ZAI_API_KEY` in the environment inherited by Okstra, and select `zai/glm-5.3` or `zai/glm-5.3-flash` in a role-model step. For explicit launch arguments, use `--role-model analyser=zai/glm-5.3`. These models support worker roles; this integration does not provide a Z.ai lead host.
+
+Each GLM child process uses `https://api.z.ai/api/anthropic` and its own model/authentication environment. Okstra does not edit `~/.claude/settings.json`. GLM runs with `--setting-sources ""` so user, project, and local settings cannot override those connection values; settings-based hooks and integrations are consequently not inherited for GLM workers. The regular Claude provider keeps its existing settings behavior.
+
+The runtime rejects a missing `ZAI_API_KEY` before starting the worker. Catalog visibility does not verify the account's model entitlement or remaining quota. The installed Claude Code version and Z.ai account must support the selected model. See [Z.ai's Claude Code setup](https://docs.z.ai/devpack/tool/claude) and [Coding Plan usage policy](https://docs.z.ai/devpack/usage-policy) for provider requirements.
+
+GLM response model identities are recorded as `zai/<model>`; a startup model label alone is not treated as proof of the served model. The final Claude Code usage event supplies input, output, cache-creation, and cache-read counters. Repeated dispatches are summed by their status files. Missing usage stays unavailable, and billing-cost estimates are omitted rather than using Anthropic prices or treating subscription usage as metered API spend.
+
 ## `okstra` Node CLI — introspection subcommands
 
 The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and introspection commands used by skills and agents. It goes through the Node wrapper instead of invoking the Python runtime directly, so `src/lib/python-helper.mts` wires `PYTHONPATH`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.199.4",
+  "version": "0.200.0",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.199.4",
-  "builtAt": "2026-09-12T08:39:25.893Z",
+  "package": "0.200.0",
+  "builtAt": "2026-09-12T23:30:51.348Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/bin/okstra-provider-exec.py

@@ -405,7 +405,7 @@ def _check_command(strategy: ExecutionStrategy, request: WorkerExecRequest) -> N
     """Refuse a missing CLI before the run leaves any artifact behind.
 
     Building the command is the only truthful way to learn which binary this
-    provider runs, and it is a pure call. The check stays out of the runner so a
+    provider runs and validates its configuration. The check stays out of the runner so a
     refused dispatch leaves no `started` status sidecar for the liveness probe to
     read as a worker that launched.
     """

package/runtime/bin/okstra-zai-exec.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec python3 "$script_dir/okstra-provider-exec.py" zai "$@"

package/runtime/prompts/launch.template.md

@@ -41,6 +41,18 @@ Relaying a wizard step does not change the option set — relay every `options[]
 
 ## User closeout (BLOCKING)
 
+Progress, remaining work, and recommendation
+
+At each phase or implementation-stage boundary, at task completion, and before a controlled session pause or handoff, give a concise update in the resolved Report Language. Identify the task and the phase or stage, then include these three items (translate the labels):
+
+- Progress: what this boundary actually completed, the result of checks already run, and links to the relevant persisted evidence. Distinguish a completed phase from a completed task; a dispatched worker is still in progress.
+- Remaining work: unfinished work in the current task, open approval or input blockers with their IDs, and any registered follow-up tasks. Say explicitly when none remains in the verified scope; when state is unavailable, say unknown rather than inventing completion or a backlog.
+- Recommendation: the next concrete action and why it comes next. After finalization, use `nextCommand` and `nextRecommendedPhase.rationale` from the result under the routing rules below, including `nextInGroup` when present. Before finalization, use the active run's recorded stage queue and recovery or resume information; do not reuse an earlier run's pointer or invent a resume command.
+
+During an authorized continuous run, put the update beside the existing progress checkpoint and continue to the next queued step without asking for confirmation merely to deliver this update. At a controlled session pause or handoff, distinguish persisted results from in-progress work and include the available resume reference. At task completion, distinguish remaining work in this task from follow-ups or the next task in its group. If there is no recorded next action, say none is recommended. These updates do not replace checkpoints or authorize another task.
+
+Prompt delivery is checked by `tests/contract/test_next_phase_authoring_delivery.py::test_lead_closeout_names_a_command_the_user_can_run`; this is guidance for the lead's prose, not runtime validation of the emitted message.
+
 After Phase 7 persistence, the last user-facing message of this run is the next command. A status dump is not a close. A prohibition (`do not start implementation`) is not a next action. This applies to every task type.
 
 **Read the pointer from the `report-finalize` result — do not re-derive it.** Its top-level `nextRecommendedPhase` object (`phase`, `status`, `rationale`) is the value every row below branches on, and the same three values are repeated on stderr as `next phase status:` / `next phase:` / `next phase rationale:`. You did not write that object and you cannot recompute it: you author your task type's routing field, and Phase 7 projects the pointer from it plus the approval state — for `implementation-planning` there is no routing field at all. If the result carries `nextRecommendedPhaseError`, say in one line that the pointer could not be read, then close on the `validate-run` row below. The same result also carries `nextCommand` — `{command, note}`, the table below already applied to this run. When `command` is non-empty it is the close; when it is empty the `note` says what to do with the `rationale` instead.

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -104,6 +104,8 @@ User-utterance interpretation rule:
 
 ## Progress reporting (BLOCKING)
 
+At each phase or implementation-stage boundary, at task completion, and before a controlled session pause or handoff, follow the launch prompt's "Progress, remaining work, and recommendation" guidance. Include the result and evidence, unfinished work and blockers, and the next action with its reason. During an authorized continuous run, deliver this update beside the checkpoint and continue; do not turn the update into an approval gate. The same guidance applies to the final reply after persistence below.
+
 A single okstra run frequently spans 30–120 minutes with multi-minute silent windows while workers run; without progress signals the user cannot distinguish "still working" from "hung". Lead MUST emit a single short progress line at each checkpoint below — plain user-facing text in a separate brief message (not buried inside a tool call), one line per checkpoint, format: `PROGRESS: <phase-id> <verb-phrase>`. Emit the line raw — the literal `PROGRESS:` token must begin the line. Do NOT wrap it in inline-code backticks (`` `PROGRESS: ...` ``) or a ```` ``` ```` code fence; markdown wrapping is what the post-hoc conformance validator scrapes around, and raw emit keeps the signal unambiguous.
 
 Record each checkpoint with `okstra lead-progress append --project-root <dir> --run-manifest <path> --phase <phase-id>`, then emit the `progressLine` it prints as the user-facing line. The command resolves `leadEventsPath` from the run manifest and writes the checkpoint there — on a host whose adapter declares `sessionAccounting: artifact-only` that ledger is the only place the post-hoc validator can read it, so a conversation line alone leaves no trace and the run is reported as missing the checkpoint. Pass `--worker <role>` on the per-worker checkpoints (it rewrites a phase-specific functional label into the roster role team-state records), `--field NAME=VALUE` for the remaining `key=value` tokens in the order the line carries them, and `--detail <text>` where the line ends in a verb phrase; the wording listed below is the default for the fixed-prose checkpoints.
@@ -355,7 +357,7 @@ After each worker terminates, BEFORE classifying its terminal status, verify the
 
 `--agent`, `--agent-role`, and `--error-type` are **closed enums**, not free-form labels — the role names used elsewhere in these contracts (`Codex worker`, `Claude worker`) are rejected. Use exactly:
 
-- `--agent` — `claude-worker` | `codex-worker` | `antigravity-worker` | `grok-worker` | `kimi-worker` | `report-writer`
+- `--agent` — `claude-worker` | `codex-worker` | `antigravity-worker` | `grok-worker` | `kimi-worker` | `zai-worker` | `report-writer`
 - `--agent-role` — `lead` | `worker` | `report-writer`
 - `--error-type` — `cli-failure` | `contract-violation` | `tool-failure`
 

package/runtime/prompts/lead/plan-body-verification.md

@@ -335,10 +335,20 @@ Every plan-body verification and self-fix instruction passes [okstra-lead-contra
 
 Before each verifier call, write one task-instructions file under the current
 run's `state/` directory and run `okstra agent-prompt materialize` with
-`--audience reverification-worker`,
-`--assignment-ref reverify/<workerId>`, the exact `--worker-id`, and
+`--audience reverification-worker`, the exact `--worker-id`, and
 `--dispatch-kind plan-verify-r<N>`, matching the `<N>` in the result filename of
-step 3. That kind, not `reverify-r<N>`, is what this round takes: the verification
+step 3. For analyser verifiers, use `--assignment-ref reverify/<workerId>`.
+For `critic-worker`, use `--assignment-ref critic/scope` from this run's
+`invocationAssignments`, including a tie round or a later critic correction.
+The verdict worker name `critic-worker` does not create a `reverify/critic-worker`
+assignment. Keep the selected critic's existing model assignment.
+**Enforced:** `okstra_ctl.agent.prompt_cli.run_identity._validate_run_identity`
+accepts the planning critic's verification audience; materialization resolves
+the declared assignment and reports the correct critic reference when the
+invented `reverify/critic-worker` reference is used.
+`tests/run/test_agent_prompt_cli.py` verifies the declared critic's reservation
+and dispatch identity plus this recovery diagnostic.
+That kind, not `reverify-r<N>`, is what this round takes: the verification
 prompt contract requires the renderer signature of the queue's canonical renderer,
 and for plan items that renderer is `okstra plan-items prompt`, not `okstra
 convergence reverify-prompt`. Pass that command's output verbatim as
@@ -355,7 +365,9 @@ source `RoleExecution` row from the run manifest's static role state. Use its
 `RoleExecution` row's `roleExecutionRef`, not that row's
 `sourceRoleExecutionRef` field. Pass `--source-role-execution-ref
 <sourceRoleExecutionRef>`. Do not derive that reference from `workerId`,
-provider, model, or execution-label text. A legacy v1 run omits this flag. Run
+provider, model, or execution-label text. For `critic-worker`, select the static
+`role: critic` row; the runtime reserves its verifier execution under the
+existing critic participant and model. A legacy v1 run omits this flag. Run
 `okstra agent-prompt verify` against the
 returned `metadataPath` before dispatch and use the returned `promptPath`
 without modification. Native-session calls use only `hostModelValue`; before

package/runtime/prompts/profiles/implementation-planning.md

@@ -175,7 +175,7 @@ roles:
     - `### Carry-In` — for `depends-on (none)`: task-brief only. Otherwise: each depended-on stage's static exit contract + runtime sidecar path `runs/<impl-key>/carry/stage-<i>.json` placeholder.
     - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the same paths as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary.** `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
     - **The `command` cell runs inside an okstra task worktree, not a bare checkout (BLOCKING).** okstra provisions `.okstra`, the configured sync entries (`.project-docs`, `.claude`, …), and — for `implementation` — a nested `stage-<N>/` worktree into the tree the step executes in. Two consequences bind every command you write:
-      - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step — okstra writes that tag itself when it settles the stage, at the commit the carry evidence records, and a step that tags mid-stage puts it on an earlier commit.
+      - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step. Stage completion records the commit in the consumer ledger without creating or moving git tags.
       - **Never read an `.okstra/` artifact back out of a git object.** `.okstra/**` is gitignored and never committed — the executor aborts a commit that stages an ignored path and the verifier reports a committed `.okstra` path as a branch defect — so `git cat-file -e <tag>:.okstra/…`, `git show <tag>:.okstra/…`, and every variant of that read can never resolve, at any tag, in any stage. A later stage that needs a QA artifact reads it from the working tree or receives it through the carry sidecar / verifier result; do not design a stage contract around one being reachable from a tag. Validator S12 rejects the read.
     - **Per-stage conformance declaration (mandatory one line, in the stage section — same placement freedom as `TDD exemption:`):** the stage MUST carry exactly one of:
       - `Conformance tests: stage-<N> — <task_root>/qa/scripts/stage-<N>.<ext> (requires=[db|io|http|external,...])` — declare that a Tier3 verification script will prove this stage's upstream requirements (brief / requirements-discovery / error-analysis / improvement-discovery → this stage's `Acceptance`) hold against **real** DB rows, real endpoints, or the real external API — NOT mocks. This phase emits the line and the `requires` set only. Do NOT write `<task_root>/qa/scripts/stage-<N>.*` and do NOT add a `runCommand` or `conformance-manifest.json` entry here — the matching `implementation` stage run creates the script file and the manifest `runCommand`. A plan that declares tests with no script file on disk is valid at this gate. The data.json `conformanceTests` value carries only the remainder after the `Conformance tests: stage-<N> — ` prefix — never the `stage-<N> — ` label itself (report assembly strips a leftover label at publication, and the implementation entry gate rejects one).

package/runtime/prompts/wizard/prompts.ko.json

@@ -646,6 +646,7 @@
   },
   "confirmation": {
     "header": "선택 확인:",
+    "provider_data_scope": "\n전달 대상: 위 역할·모델 목록의 제공자(현재 세션 및 선택한 외부 모델 제공자).\n전달 자료: `{project_root}`의 이 작업에 대한 작업 개요, 작업 수행에 필요한 저장소 소스·문서, 선택한 근거 자료 및 실행 중 생성되는 관련 분석·검증 결과.\n진행을 선택하면 위 대상에 해당 자료를 전달하여 선택한 작업을 실행하는 것을 승인합니다. 선택에 없는 제공자나 작업과 무관한 자료는 승인 범위에 포함되지 않습니다. 실행 환경의 권한 검토는 별도로 적용됩니다.",
     "static_role": "  static-role   : {role}#{ordinal} / {model}",
     "dynamic_role": "  dynamic-role  : {role} / reuse selected participant model",
     "workers_implementation_default": "  workers       : (프로필 기본 — executor + verifier 2 + report-writer)",

package/runtime/python/okstra_ctl/adapters/hosts/codex/relay.md

@@ -136,11 +136,11 @@ The `confirm` prompt's `label` is the selection summary (one line per resolved i
 
 ### Runtime-generated selectable screens
 
-`wizard/engine.py` adapts choice screens before returning `next` when the session declares `native_single_select`. `wizard/picker_navigation.py` preserves all original choices while paging long lists, collecting multi-selection through toggle/complete choices, and disambiguating duplicate labels. Oversized or unsupported groups are presented one member at a time. These paths are exercised by `tests/domain/wizard/test_picker_navigation.py` and `test_role_model_selection.py`.
+`wizard/engine.py` adapts choice screens before returning `next` when the session declares `native_single_select`. Lists use same-screen question tabs only when the host supports the complete grouped selection. Otherwise, choices beyond `nativeLimits` and unsupported multi-selections use a complete numbered list. Codex has no native multi-select, so a single choice with more than three options uses `numbered-single`; multi-selection uses `numbered-multi`. Oversized or unsupported groups are presented one member at a time, with every option for that member visible. These paths are exercised by `tests/domain/wizard/test_picker_navigation.py` and `test_role_model_selection.py`.
 
-Render exactly the returned current screen using its `interaction.kind`, including navigation and completion options. Submit their original values through `okstra wizard step` like other options. The runtime keeps navigation and partial selections in the state file and does not submit the underlying workflow decision until selection is complete. Do not reconstruct the full model list, perform pagination yourself, or replace model choices with a request to type `provider/model`. A repeated step ID after navigation or a toggle is the next screen, not a duplicated question; render that newly returned screen once.
+Render the returned screen using its `interaction.kind`. For numbered interactions, show every option label and description in original order in one message, then accept a number, label, or value; multiple choices accept comma-separated input. Submit that reply unchanged through `okstra wizard step`. Do not add a next-page choice, truncate the list, or require the user to remember a model identifier.
 
-If the runtime still returns a numbered interaction when the user requires a selector, preserve the state and check installation and live capabilities. Do not invent a text-input exception. Text steps remain text steps; a direct-input choice is selected through the picker before the runtime asks for the custom value.
+The complete numbered list is the intended fallback when a choice cannot fit the native control or same-screen tabs, including when the user generally prefers a selector. Text steps remain text steps; selecting the direct-input option opens the wizard's custom-value step.
 
 ### Plan decisions and execution permissions
 
@@ -168,7 +168,7 @@ Display the question only through the selected tool. Do not print it or its opti
 |---|---|
 | `read_artifacts` | Read the manifest-provided paths through the current host's file interface. |
 | `write_artifact` | Write only core-authorized `.okstra/` artifacts and preserve their schemas. |
-| `prompt_user` | Use the client-appropriate, mode-available question tool selected above for clarifications that fit `nativeLimits`. Show the question once through that tool and wait for the actual answer. Emit the question as the last thing in that turn: assistant text emitted after the call renders below the question and separates it from the user's answer. Follow the host's separate restrictions for permission requests. Use host text for unsupported interactions only when the user has not required a selectable interface; otherwise preserve the pending step and follow the recovery above. |
+| `prompt_user` | Use the client-appropriate, mode-available question tool selected above for clarifications that fit `nativeLimits`. Show the question once through that tool and wait for the actual answer. Emit the question as the last thing in that turn: assistant text emitted after the call renders below the question and separates it from the user's answer. Follow the host's separate restrictions for permission requests. For lists that cannot fit the native control or same-screen tabs, show the complete numbered list and accept the next message as the answer. |
 | `dispatch_worker` | Verify each materialized invocation first. Dispatch `runner=native-session` with the current Codex host's primitive, the returned `promptPath`, and `hostModelValue`. Pass `runner=cli-wrapper` assignments to `okstra worker-dispatch --project-root <root> --run-manifest <path> --workers <ids>`; use `--dry-run` first when required. **Not in a cmux run:** when `terminalBackend` is `cmux-pane`, the cmux adapter overrides this row. |
 | `await_workers` | Await native host workers through the host primitive and CLI workers through synchronous dispatch, then verify team-state terminal records and Result Paths for both. |
 | `redispatch_worker` | Materialize and verify a fresh invocation, then start a fresh native worker or `okstra worker-dispatch` attempt according to the persisted runner. |
@@ -176,12 +176,26 @@ Display the question only through the selected tool. Do not print it or its opti
 | `record_lead_event` | Append progress and activity records to the manifest-provided `leadEventsPath`. Use `okstra lead-progress append --phase <phase-id>` for a checkpoint and `okstra agent-activity append --kind <kind>` for an activity record; both resolve the ledger path from the run manifest. Emit the matching `PROGRESS:` line — the command prints it as `progressLine` — and, when an activity record is required, the immediately following `ACTIVITY:` line from the same structured fields. |
 | `collect_usage` | Collect artifact/rollout-backed usage through the existing Okstra token-usage path; never read Claude session JSONL as a substitute. |
 
+## Codex execution permissions
+
+### Permission before bundle preparation
+
+Before the first `okstra render-bundle` invocation, check the current host's declared filesystem restrictions and approval policy. Bundle preparation writes run artifacts and can create a task or stage worktree with `git worktree add -b`, which writes to the source repository's Git metadata. `--render-only` does not make this command read-only, and writable access to the project directory or `~/.okstra` does not imply writable access to protected `.git` metadata.
+
+When those writes are restricted, use the host's supported execution permission on the original `render-bundle` command (`sandbox_permissions: "require_escalated"` for `exec_command` when available and permitted), preserving every `outcome.renderArgv` token. Explain that the command prepares the selected run and may create its branch and worktree. Do not first run it under restrictions already known to block these writes. Apply the same check to subsequent phase or stage bundle preparations. A wizard confirmation does not grant host privileges; follow the host's approval decision. If escalation is prohibited, report the constraint and retain the invocation instead of changing filesystem permissions or choosing an alternate launcher.
+
+If preparation has already failed with a Git lock creation error or `Operation not permitted`, preserve the exact error and retry the same command only after the host permits the required writes. This is host-call guidance, not a permission grant or a runtime-enforced check.
+
 ## Codex dispatch details
 
 ### Permission at the dispatch boundary
 
 Before a live CLI worker dispatch, check the current host's declared sandbox and approval policy. In a restricted Codex session, request the host's supported execution permission on the dispatch command itself (`sandbox_permissions: "require_escalated"` for `exec_command` when that mechanism is available and permitted). Scope the request to the prepared run and explain that it starts the selected worker processes. Follow the host's approval decision; a wizard confirmation or a successful preflight does not grant this permission.
 
+Carry the user's existing authorization into that request: identify the task, the selected providers/models from the prepared assignments, and the task brief, relevant repository source/documents, selected evidence, and related run results those workers will process. Cite the actual `Proceed` response and the data-transfer scope displayed in that confirmation; `outcome.confirmationText` is the runtime's summary reference, not proof by itself that the user saw or accepted it. Explain this scope in the execution tool's justification rather than describing only process startup. Data-transfer authorization and host execution privileges are separate: preserve the former while requesting the latter.
+
+Do not infer that an older confirmation included the new disclosure, widen the approved recipients or material, or treat model selection alone as blanket data-transfer consent. When the conversation already authorizes the same recipients and scope, use that evidence without asking again. If approval review rejects a dispatch, retain and report its reason; supply omitted existing evidence only through the host's permitted review mechanism. If the stated gap is not covered by the user's actual authorization, ask one focused question naming that gap and wait for the answer. Never bypass the rejection or repeat an unchanged request.
+
 Apply this guidance to both `okstra worker-dispatch` and the cmux override's `okstra team dispatch`, including initial workers, reverify, critic, report-writer, and retries. Read-only previews do not start workers. A session already authorized to execute outside the sandbox does not need another request. When the host prohibits escalation, preserve the pending invocation and report the execution constraint instead of trying an alternate launcher or weakening host controls.
 
 The worker's `--sandbox danger-full-access` flag only selects the child Codex policy; it does not remove restrictions inherited from the parent process. If startup reports `Operation not permitted`, retain the exact error and distinguish initialization failure from a worker verdict. Retry only through the permitted host mechanism after the execution conditions change, within the existing retry limit; do not repeat the same restricted invocation. This is host-call guidance, not a permission grant or a runtime-enforced check.

package/runtime/python/okstra_ctl/adapters/providers/zai/adapter.py

@@ -0,0 +1,96 @@
+"""Claude Code 실행기를 사용하는 Z.ai GLM 작업자."""
+import os
+from dataclasses import replace
+from typing import Any, Mapping
+
+from okstra_ctl.adapters.providers.claude.adapter import ClaudeExecution
+from okstra_ctl.domain.provider import ModelSpec, ProviderSpec, ServedModelAttestation
+from okstra_ctl.domain.role import ROLE_DEFINITIONS
+from okstra_ctl.domain.worker_exec import ExecCommand, PolicySupport, WorkerExecRequest
+from okstra_ctl.domain.worker_presentation import JsonEvents
+from okstra_ctl.domain.worker_stream import content_block_events
+
+
+ZAI_MODELS = {
+    name: ModelSpec(name, label, name)
+    for name, label in (
+        ("glm-5.3", "GLM-5.3"),
+        ("glm-5.3-flash", "GLM-5.3 Flash"),
+    )
+}
+
+
+def normalise_served_model(raw_model: str | None) -> ServedModelAttestation:
+    if not raw_model or not raw_model.strip():
+        return ServedModelAttestation.unknown()
+    return ServedModelAttestation(
+        raw_model, f"zai/{raw_model.strip().lower()}", "exact", "provider-output"
+    )
+
+
+def observe_served_model(event: Mapping[str, Any]) -> str | None:
+    # init.model 은 실행기가 요청한 값이다. 응답 message.model 만 관측으로 인정한다.
+    message = event.get("message")
+    model = message.get("model") if isinstance(message, Mapping) else None
+    return model if isinstance(model, str) and model.strip() else None
+
+
+def observe_usage(event: Mapping[str, Any]) -> Mapping[str, Any] | None:
+    # assistant.usage 는 턴별 값이므로 최종 누적 result.usage 와 섞어 더하지 않는다.
+    usage = event.get("usage") if event.get("type") == "result" else None
+    return usage if isinstance(usage, Mapping) and usage else None
+
+
+class ZaiExecution:
+    def build_command(self, request: WorkerExecRequest) -> ExecCommand:
+        api_key = os.environ.get("ZAI_API_KEY", "").strip()
+        if not api_key:
+            raise OSError("ZAI_API_KEY is required for Z.ai GLM workers")
+        command = ClaudeExecution().build_command(request)
+        return replace(
+            command,
+            # 설정 파일의 env 가 자식 환경을 다시 덮어쓰지 않게 한다.
+            argv=(*command.argv, "--setting-sources", ""),
+            environment={
+                "ANTHROPIC_BASE_URL": "https://api.z.ai/api/anthropic",
+                "ANTHROPIC_AUTH_TOKEN": api_key,
+                "ANTHROPIC_API_KEY": None,
+                "CLAUDE_CODE_OAUTH_TOKEN": None,
+                "CLAUDE_CODE_USE_BEDROCK": None,
+                "CLAUDE_CODE_USE_VERTEX": None,
+                "CLAUDE_CODE_USE_FOUNDRY": None,
+                "CLAUDECODE": None,
+                "ANTHROPIC_MODEL": request.model,
+                "ANTHROPIC_DEFAULT_OPUS_MODEL": request.model,
+                "ANTHROPIC_DEFAULT_SONNET_MODEL": request.model,
+                "ANTHROPIC_DEFAULT_HAIKU_MODEL": request.model,
+                "CLAUDE_CODE_SUBAGENT_MODEL": request.model,
+                "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
+            },
+            presentation=JsonEvents(
+                normalise=content_block_events,
+                observe=observe_served_model,
+                observe_usage=observe_usage,
+            ),
+        )
+
+    def policy_support(self) -> PolicySupport:
+        return ClaudeExecution().policy_support()
+
+
+def create_provider() -> ProviderSpec:
+    roles = frozenset(role.id for role in ROLE_DEFINITIONS if role.id != "leader")
+    return ProviderSpec(
+        provider="zai",
+        display_label="Z.ai GLM",
+        models=ZAI_MODELS,
+        default_models={role: "glm-5.3" for role in roles},
+        wrapper="okstra-zai-exec.sh",
+        supported_roles=roles,
+        execution_capabilities=frozenset({
+            "worker-artifact-io", "source-readonly",
+            "extended-artifact-authoring", "project-mutation",
+        }),
+        exec_strategy=ZaiExecution(),
+        served_model_normalizer=normalise_served_model,
+    )

package/runtime/python/okstra_ctl/adapters/providers/zai/manifest.json

@@ -0,0 +1,5 @@
+{
+  "schemaVersion": 1,
+  "id": "zai",
+  "factory": "adapter.py:create_provider"
+}

package/runtime/python/okstra_ctl/agent/prompt_cli/corrections.py

@@ -101,9 +101,12 @@ def run_corrections_check(
 
         def semantic_validator(data: dict[str, Any]) -> list[str]:
             block = data.get(block_key)
-            return validate_implementation_option_selection(
-                block if isinstance(block, Mapping) else {}, original_ids, analysers,
-            )
+            return [
+                f"{block_key}: {error}"
+                for error in validate_implementation_option_selection(
+                    block if isinstance(block, Mapping) else {}, original_ids, analysers,
+                )
+            ]
     elif task_type == "implementation-planning":
 
         def semantic_validator(data: dict[str, Any]) -> list[str]:

package/runtime/python/okstra_ctl/agent/prompt_cli/materialize.py

@@ -34,7 +34,11 @@ from ...assignment_resolver import AssignmentContext, resolve_dispatch_assignmen
 from ...path_hints import hydrate_active_run_context
 from ...worker_prompt_headers import worker_prompt_headers
 from ...worker_prompt_contract import complete_reverify_instruction, validate_reverify_prompt
-from ...worker_prompt_policy import is_verification_dispatch_kind
+from ...worker_prompt_policy import (
+    critic_assignment_ref,
+    is_plan_critic_verification,
+    is_verification_dispatch_kind,
+)
 from ...paths import okstra_home
 from ...final_report_paths import final_report_data_path
 from ...final_report_schema import load_schema_version
@@ -251,10 +255,28 @@ def _materialize_run(
     if args.assignment_ref not in assignments:
         # 유효값은 이 매니페스트 안에만 있고 리드는 그것을 추측할 수 없다.
         # 이름만 거절하면 읽는 쪽이 매니페스트를 직접 열어 키를 세게 된다.
+        critic_ref = critic_assignment_ref(str(manifest.get("taskType", "")))
+        recovery = ""
+        if (
+            args.assignment_ref == "reverify/critic-worker"
+            and critic_ref in assignments
+            and is_plan_critic_verification(
+                task_type=str(manifest.get("taskType", "")),
+                assignment_ref=critic_ref, dispatch_kind=args.dispatch_kind,
+            )
+        ):
+            recovery = (
+                f"; for the rostered plan critic, use --assignment-ref {critic_ref} "
+                "with --worker-id critic-worker and --audience reverification-worker. "
+                "Keep the plan-verify-r<N> dispatch kind and, on v2 runs, the selected "
+                "critic's --source-role-execution-ref. This is a reference correction; "
+                "the existing critic assignment does not need to be added or changed"
+            )
         raise AgentPromptCliError(
             f"assignment reference is missing from run manifest: "
             f"{args.assignment_ref}; this run declares "
             + (", ".join(sorted(assignments)) or "no invocation assignment")
+            + recovery
         )
     assignment_payload = assignments[args.assignment_ref]
     assignment = agent_model_assignment_from_payload(assignment_payload)

package/runtime/python/okstra_ctl/consumers.py

@@ -10,8 +10,6 @@ from __future__ import annotations
 
 import json
 import re
-import subprocess
-import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Dict, List, Optional
@@ -149,8 +147,6 @@ def append_consumer(plan_run_root: Path, *, impl_task_key: str, stage: int,
                 **fields,
             }
             _append_row(plan_run_root, record)
-    if status == "done":
-        _tag_stage_exit(plan_run_root, stage, fields.get("head_commit"))
     # 종결 status 는 점유 해제 이벤트이기도 하다 — 중복 append(no-op)에서도 풀어야
     # release 없이 done 만 기록된 과거 run 의 잔존 점유가 다음 호출에서 치유된다.
     if status == "done":
@@ -159,57 +155,6 @@ def append_consumer(plan_run_root: Path, *, impl_task_key: str, stage: int,
         _release_stage_occupancy_keeping_branch(impl_task_key, stage)
 
 
-STAGE_EXIT_TAG = "stage-{stage}-exit"
-
-
-def _repo_root(start: Path) -> Optional[Path]:
-    for candidate in [start, *start.parents]:
-        if (candidate / ".git").exists():
-            return candidate
-    return None
-
-
-def _tag_stage_exit(plan_run_root: Path, stage: int, head_commit: Any) -> None:
-    """Move `stage-<N>-exit` to the commit this ledger row records.
-
-    The tag used to be a plan step, so it was written while the stage was still
-    running — before the carry evidence the ledger reads. A stage then had three
-    exit points that could disagree: the tag, the recorded `head_commit`, and
-    the branch tip. okstra writes the tag at the moment it settles the stage, so
-    the tag and the ledger cannot drift apart.
-
-    Best effort by design: the ledger is the record and a tag is a convenience
-    for the reader. A tree that is not a git repository, or a commit git cannot
-    resolve, leaves the row written and says so on stderr.
-    """
-    if not isinstance(head_commit, str) or not head_commit.strip():
-        return
-    root = _repo_root(Path(plan_run_root).resolve())
-    if root is None:
-        return
-    commit = head_commit.strip()
-    tag = STAGE_EXIT_TAG.format(stage=stage)
-    try:
-        exists = subprocess.run(
-            ["git", "-C", str(root), "cat-file", "-e", f"{commit}^{{commit}}"],
-            capture_output=True,
-        )
-        if exists.returncode != 0:
-            print(
-                f"okstra: stage {stage} done recorded, but {commit[:12]} is not "
-                f"a commit in {root} — `{tag}` not moved",
-                file=sys.stderr,
-            )
-            return
-        subprocess.run(
-            ["git", "-C", str(root), "tag", "-f", tag, commit],
-            capture_output=True,
-            check=True,
-        )
-    except (OSError, subprocess.CalledProcessError) as exc:
-        print(f"okstra: could not move `{tag}` to {commit[:12]}: {exc}", file=sys.stderr)
-
-
 def _equivalent_row_exists(plan_run_root: Path, impl_task_key: str, stage: int,
                            status: str, force_reappend: bool,
                            head_commit: Any) -> bool:

package/runtime/python/okstra_ctl/domain/worker_exec.py

@@ -7,9 +7,9 @@ regardless of provider — see ``ExecutionPolicy``.
 """
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Literal, Protocol, runtime_checkable
+from typing import Literal, Mapping, Protocol, runtime_checkable
 
 from .worker_presentation import Presentation
 from .write_policy import WriteEnforcement, WritePolicy
@@ -84,6 +84,9 @@ class ExecCommand:
     stdin_text: str | None
     cwd: Path
     presentation: Presentation
+    # 인증 값은 프로세스 경계에서만 전달하고 명령 표현·실행 기록에서 제외한다.
+    # None 은 부모에게서 상속된 설정을 지운다.
+    environment: Mapping[str, str | None] = field(default_factory=dict, repr=False)
 
 
 @dataclass(frozen=True)

package/runtime/python/okstra_ctl/domain/write_policy.py

@@ -131,8 +131,14 @@ def validate_write_policy_payload(payload: Mapping[str, Any]) -> None:
     _relative_paths(artifact.get("allowedPaths", ()))
     if source.get("mode") not in {"source-readonly", "project-mutation"}:
         raise WritePolicyError("sourcePolicy mode is invalid")
-    if set(source) != {"mode", "allowedRoot", "plannedPaths", "protectedPaths"}:
+    if set(source) - {"plannedPathsDeclared"} != {
+        "mode", "allowedRoot", "plannedPaths", "protectedPaths"
+    }:
         raise WritePolicyError("sourcePolicy is incomplete")
+    if "plannedPathsDeclared" in source and not isinstance(
+        source["plannedPathsDeclared"], bool
+    ):
+        raise WritePolicyError("sourcePolicy.plannedPathsDeclared must be a boolean")
     _absolute_text(source.get("allowedRoot"), "sourcePolicy.allowedRoot")
     _relative_paths(source.get("plannedPaths", ()))
     _relative_paths(source.get("protectedPaths", ()))

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -793,28 +793,17 @@ def _stable_git_projection(snapshot: MutationSnapshot) -> dict[str, Any]:
 
 
 def _path_ledger_is_unenforceable(policy: WritePolicy) -> bool:
-    """이 정책의 경로 장부를 근거로 변경을 거절할 수 있는가.
-
-    승인된 계획서에 `plannedPaths` 컬럼이 있으면 실행기는 그 목록에 묶이고,
-    목록은 반드시 비어 있지 않다(`write_policy._planned_paths_from_report` 는
-    선언된 경우에만 항목을 싣는다). 그 컬럼이 없는 옛 계획서에서는 실을 값이
-    없어 장부가 빈 채로 온다 — 종전에는 산문에서 유도한 문장 조각(`28 rows)`,
-    `captured in Stage 1)`)을 실었고, 그래서 계획이 지시한 파일 전부가 미허가
-    변경으로 읽혔다.
-
-    `project-mutation` 정책에서만 빈 장부가 "물을 수 없음" 을 뜻한다.
-    `source-readonly` 워커는 장부가 원래 비어 있고 그것이 "아무것도 바꾸지
-    말라" 는 뜻이므로, 그쪽 집행은 건드리지 않는다.
-
-    이 판정은 감사의 두 절반이 같은 함수를 읽는다. 종전에는 git 쪽만
-    `plannedPathsDeclared` 를 봤는데 그 키는 `build_write_policy` 가 만드는
-    sourcePolicy 에 아예 실리지 않아(4개 키 고정, `validate_write_policy_payload`
-    가 그 집합을 강제) 어느 쪽에서도 참이 된 적이 없다.
+    """옛 계획의 미선언 목록만 면제하고, 산출물 전용 계획의 빈 소스 목록은 집행한다.
+
+    선언 여부가 저장되기 전 정책은 기존의 빈 목록 해석을 유지한다.
+    새 정책은 경로 분류 후에도 선언 여부를 보존하므로 산출물만 남은 계획이
+    임의의 소스 변경이나 커밋을 허용하지 않는다.
     """
     source = policy.source_policy
     return (
         source.get("mode") == "project-mutation"
         and not source.get("plannedPaths")
+        and not source.get("plannedPathsDeclared", False)
     )