okstra 0.199.5 → 0.200.1

package/README.md

@@ -37,6 +37,7 @@ Role assignments are persisted separately from the host runtime, but the lead pr
 | Antigravity | Antigravity CLI | `okstra-antigravity-exec.sh` | leader, analyser, critic, implementer, verifier |
 | Grok | Grok CLI | `okstra-grok-exec.sh` | leader, read-only analyser, and critic |
 | Kimi | Kimi CLI | `okstra-kimi-exec.sh` | leader, read-only analyser, and critic |
+| Z.ai GLM | — | `okstra-zai-exec.sh` (Claude Code) | analyser, critic, designer, planner, implementer, verifier, report-writer, translator |
 
 Canonical role names are `leader`, `analyser`, `critic`, `designer`, `planner`, `implementer`, `verifier`, `report-writer`, and `translator`. `lead` is a compatibility alias for `leader`. `executor` is a compatibility alias for `implementer`. New records write only the canonical names.
 
@@ -46,7 +47,9 @@ Grok and Kimi can now lead through their registered host adapters. Their worker
 
 `okstra run <host-id-or-alias>` resolves the requested adapter from the host registry and checks its `spawn-process` readiness before starting it. The installed `okstra-run` skill instead uses `current-session`: it declares only the semantic functions the live harness can actually perform (`plain_text_input`, plus any available native single-select, multi-select, or grouped-question function) and reuses the current lead session. User-installed adapters are discovered only from `~/.okstra/adapters/hosts/<id>/` and `~/.okstra/adapters/providers/<id>/`; project-local executable adapter code is ignored.
 
-The next direct-CLI candidates are Mistral Vibe and Qwen Code. DeepSeek V4, GLM-5.2, and MiniMax M2.7 remain API-adapter candidates because their current official coding-agent execution surfaces do not fit Okstra's wrapper contract as directly. Newly published provider models are exposed only after the corresponding local CLI reports them; this keeps model discovery separate from marketing availability.
+Z.ai GLM workers reuse the installed Claude Code executable with process-local Z.ai connection settings. Set `ZAI_API_KEY` in the environment that launches Okstra, then select `zai/glm-5.3` or `zai/glm-5.3-flash` for a worker role. Claude configuration files remain unchanged. See [GLM worker setup](docs/cli.md#zai-glm-workers) for isolation and accounting details.
+
+The next direct-CLI candidates are Mistral Vibe and Qwen Code. DeepSeek V4 and MiniMax M2.7 remain API-adapter candidates because their current official coding-agent execution surfaces do not fit Okstra's wrapper contract as directly. Model catalog entries and account availability are distinct; GLM authorization is checked when its CLI process calls Z.ai.
 
 okstra is **not** a one-shot code review tool. It is for work that **spans multiple phases, needs input from multiple agents, and feeds each phase's output into the next phase**.
 

package/dist/lib/runtime-payload.mjs

@@ -15,6 +15,7 @@ export const RUNTIME_BIN_FILES = Object.freeze([
     { name: "okstra-antigravity-exec.sh" },
     { name: "okstra-grok-exec.sh" },
     { name: "okstra-kimi-exec.sh" },
+    { name: "okstra-zai-exec.sh" },
     { name: "okstra-provider-exec.py" },
     // 진입 스크립트들이 import 하는 경로 부트스트랩. 이들과 같은
     // 디렉터리에 있어야 `sys.path` 를 고치기 전에 import 된다.

package/dist/lib/runtime-payload.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-payload.mjs","sourceRoot":"","sources":["../../src/lib/runtime-payload.mts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,EAAE;AACF,oCAAoC;AACpC,0DAA0D;AAC1D,iEAAiE;AACjE,gEAAgE;AAChE,kDAAkD;AAClD,EAAE;AACF,kCAAkC;AAalC,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAA8B,MAAM,CAAC,MAAM,CAAC;IACxE,EAAE,IAAI,EAAE,WAAW,EAAE;IACrB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACjC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACnC,uCAAuC;IACvC,2CAA2C;IAC3C,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAClC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACpC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE;IACpD,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,IAAI,EAAE;IACnD,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE;CAChD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,gBAAgB;IAChB,YAAY;IACZ,oBAAoB;IACpB,eAAe;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2C,MAAM,CAAC,MAAM,CAAC;IACrF,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;IACxC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACZ,CAAC,CAAC;AAEZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAClE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7C,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CACjE,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7E,CAAC"}
+{"version":3,"file":"runtime-payload.mjs","sourceRoot":"","sources":["../../src/lib/runtime-payload.mts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,EAAE;AACF,oCAAoC;AACpC,0DAA0D;AAC1D,iEAAiE;AACjE,gEAAgE;AAChE,kDAAkD;AAClD,EAAE;AACF,kCAAkC;AAalC,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAA8B,MAAM,CAAC,MAAM,CAAC;IACxE,EAAE,IAAI,EAAE,WAAW,EAAE;IACrB,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACjC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC9B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACnC,uCAAuC;IACvC,2CAA2C;IAC3C,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC/B,EAAE,IAAI,EAAE,wBAAwB,EAAE;IAClC,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtC,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACpC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE;IAC7C,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE;IACpD,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,IAAI,EAAE;IACnD,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE;CAChD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,gBAAgB;IAChB,YAAY;IACZ,oBAAoB;IACpB,eAAe;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2C,MAAM,CAAC,MAAM,CAAC;IACrF,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;IACxC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,CAAC,QAAQ,EAAE,QAAQ,CAAC;CACZ,CAAC,CAAC;AAEZ,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAClE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7C,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CACjE,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC7E,CAAC"}

package/docs/cli.md

@@ -781,6 +781,16 @@ It then displays `Continue? [y/yes]:`. Any response other than `y` or `yes` exit
 
 ---
 
+## Z.ai GLM workers
+
+Z.ai is a worker provider (`zai`) that uses the existing `claude` executable. Install Claude Code, provide `ZAI_API_KEY` in the environment inherited by Okstra, and select `zai/glm-5.3` or `zai/glm-5.3-flash` in a role-model step. For explicit launch arguments, use `--role-model analyser=zai/glm-5.3`. These models support worker roles; this integration does not provide a Z.ai lead host.
+
+Each GLM child process uses `https://api.z.ai/api/anthropic` and its own model/authentication environment. Okstra does not edit `~/.claude/settings.json`. GLM runs with `--setting-sources ""` so user, project, and local settings cannot override those connection values; settings-based hooks and integrations are consequently not inherited for GLM workers. The regular Claude provider keeps its existing settings behavior.
+
+The runtime rejects a missing `ZAI_API_KEY` before starting the worker. Catalog visibility does not verify the account's model entitlement or remaining quota. The installed Claude Code version and Z.ai account must support the selected model. See [Z.ai's Claude Code setup](https://docs.z.ai/devpack/tool/claude) and [Coding Plan usage policy](https://docs.z.ai/devpack/usage-policy) for provider requirements.
+
+GLM response model identities are recorded as `zai/<model>`; a startup model label alone is not treated as proof of the served model. The final Claude Code usage event supplies input, output, cache-creation, and cache-read counters. Repeated dispatches are summed by their status files. Missing usage stays unavailable, and billing-cost estimates are omitted rather than using Anthropic prices or treating subscription usage as metered API spend.
+
 ## `okstra` Node CLI — introspection subcommands
 
 The `okstra` Node CLI (`bin/okstra`) provides both installer/admin commands and introspection commands used by skills and agents. It goes through the Node wrapper instead of invoking the Python runtime directly, so `src/lib/python-helper.mts` wires `PYTHONPATH`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.199.5",
+  "version": "0.200.1",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.199.5",
-  "builtAt": "2026-09-12T23:19:40.021Z",
+  "package": "0.200.1",
+  "builtAt": "2026-09-13T00:15:52.944Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/bin/okstra-provider-exec.py

@@ -405,7 +405,7 @@ def _check_command(strategy: ExecutionStrategy, request: WorkerExecRequest) -> N
     """Refuse a missing CLI before the run leaves any artifact behind.
 
     Building the command is the only truthful way to learn which binary this
-    provider runs, and it is a pure call. The check stays out of the runner so a
+    provider runs and validates its configuration. The check stays out of the runner so a
     refused dispatch leaves no `started` status sidecar for the liveness probe to
     read as a worker that launched.
     """

package/runtime/bin/okstra-zai-exec.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec python3 "$script_dir/okstra-provider-exec.py" zai "$@"

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -357,7 +357,7 @@ After each worker terminates, BEFORE classifying its terminal status, verify the
 
 `--agent`, `--agent-role`, and `--error-type` are **closed enums**, not free-form labels — the role names used elsewhere in these contracts (`Codex worker`, `Claude worker`) are rejected. Use exactly:
 
-- `--agent` — `claude-worker` | `codex-worker` | `antigravity-worker` | `grok-worker` | `kimi-worker` | `report-writer`
+- `--agent` — `claude-worker` | `codex-worker` | `antigravity-worker` | `grok-worker` | `kimi-worker` | `zai-worker` | `report-writer`
 - `--agent-role` — `lead` | `worker` | `report-writer`
 - `--error-type` — `cli-failure` | `contract-violation` | `tool-failure`
 

package/runtime/prompts/lead/report-writer.md

@@ -44,15 +44,15 @@ packet. The packet contains the task brief, analysis packet, report template,
 report schema, convergence state, every successful settled worker result recorded
 by the run manifest, accumulated `user-responses/` sidecars, and the current
 session/token/cost accounting snapshot. Each file-backed source carries its owner,
-project-relative path, SHA-256 digest, and value. The report writer receives the
+project-relative path and value. The report writer receives the
 packet's Markdown reading projection as the only task input instead of an
 independently assembled list of raw paths.
 
 The packet's authoring contract names the result path, narrative format, writing
 instructions, runtime-owned content, and validation rules. Missing configured
 paths and missing files are collected across the full source set before dispatch
-and reported together with their owners. Report assembly compares every frozen
-source digest again and reports every changed or missing source in one result.
+and reported together with their owners. Report assembly checks source availability
+and readability without rejecting changed content or comparing hashes.
 This is enforced by
 `initial_prompt_materialization._materialize_report_writer_packet()`,
 `report_synthesis_packet.build_report_synthesis_packet()`, and

package/runtime/python/okstra_ctl/adapters/providers/zai/adapter.py

@@ -0,0 +1,96 @@
+"""Claude Code 실행기를 사용하는 Z.ai GLM 작업자."""
+import os
+from dataclasses import replace
+from typing import Any, Mapping
+
+from okstra_ctl.adapters.providers.claude.adapter import ClaudeExecution
+from okstra_ctl.domain.provider import ModelSpec, ProviderSpec, ServedModelAttestation
+from okstra_ctl.domain.role import ROLE_DEFINITIONS
+from okstra_ctl.domain.worker_exec import ExecCommand, PolicySupport, WorkerExecRequest
+from okstra_ctl.domain.worker_presentation import JsonEvents
+from okstra_ctl.domain.worker_stream import content_block_events
+
+
+ZAI_MODELS = {
+    name: ModelSpec(name, label, name)
+    for name, label in (
+        ("glm-5.3", "GLM-5.3"),
+        ("glm-5.3-flash", "GLM-5.3 Flash"),
+    )
+}
+
+
+def normalise_served_model(raw_model: str | None) -> ServedModelAttestation:
+    if not raw_model or not raw_model.strip():
+        return ServedModelAttestation.unknown()
+    return ServedModelAttestation(
+        raw_model, f"zai/{raw_model.strip().lower()}", "exact", "provider-output"
+    )
+
+
+def observe_served_model(event: Mapping[str, Any]) -> str | None:
+    # init.model 은 실행기가 요청한 값이다. 응답 message.model 만 관측으로 인정한다.
+    message = event.get("message")
+    model = message.get("model") if isinstance(message, Mapping) else None
+    return model if isinstance(model, str) and model.strip() else None
+
+
+def observe_usage(event: Mapping[str, Any]) -> Mapping[str, Any] | None:
+    # assistant.usage 는 턴별 값이므로 최종 누적 result.usage 와 섞어 더하지 않는다.
+    usage = event.get("usage") if event.get("type") == "result" else None
+    return usage if isinstance(usage, Mapping) and usage else None
+
+
+class ZaiExecution:
+    def build_command(self, request: WorkerExecRequest) -> ExecCommand:
+        api_key = os.environ.get("ZAI_API_KEY", "").strip()
+        if not api_key:
+            raise OSError("ZAI_API_KEY is required for Z.ai GLM workers")
+        command = ClaudeExecution().build_command(request)
+        return replace(
+            command,
+            # 설정 파일의 env 가 자식 환경을 다시 덮어쓰지 않게 한다.
+            argv=(*command.argv, "--setting-sources", ""),
+            environment={
+                "ANTHROPIC_BASE_URL": "https://api.z.ai/api/anthropic",
+                "ANTHROPIC_AUTH_TOKEN": api_key,
+                "ANTHROPIC_API_KEY": None,
+                "CLAUDE_CODE_OAUTH_TOKEN": None,
+                "CLAUDE_CODE_USE_BEDROCK": None,
+                "CLAUDE_CODE_USE_VERTEX": None,
+                "CLAUDE_CODE_USE_FOUNDRY": None,
+                "CLAUDECODE": None,
+                "ANTHROPIC_MODEL": request.model,
+                "ANTHROPIC_DEFAULT_OPUS_MODEL": request.model,
+                "ANTHROPIC_DEFAULT_SONNET_MODEL": request.model,
+                "ANTHROPIC_DEFAULT_HAIKU_MODEL": request.model,
+                "CLAUDE_CODE_SUBAGENT_MODEL": request.model,
+                "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
+            },
+            presentation=JsonEvents(
+                normalise=content_block_events,
+                observe=observe_served_model,
+                observe_usage=observe_usage,
+            ),
+        )
+
+    def policy_support(self) -> PolicySupport:
+        return ClaudeExecution().policy_support()
+
+
+def create_provider() -> ProviderSpec:
+    roles = frozenset(role.id for role in ROLE_DEFINITIONS if role.id != "leader")
+    return ProviderSpec(
+        provider="zai",
+        display_label="Z.ai GLM",
+        models=ZAI_MODELS,
+        default_models={role: "glm-5.3" for role in roles},
+        wrapper="okstra-zai-exec.sh",
+        supported_roles=roles,
+        execution_capabilities=frozenset({
+            "worker-artifact-io", "source-readonly",
+            "extended-artifact-authoring", "project-mutation",
+        }),
+        exec_strategy=ZaiExecution(),
+        served_model_normalizer=normalise_served_model,
+    )

package/runtime/python/okstra_ctl/adapters/providers/zai/manifest.json

@@ -0,0 +1,5 @@
+{
+  "schemaVersion": 1,
+  "id": "zai",
+  "factory": "adapter.py:create_provider"
+}

package/runtime/python/okstra_ctl/domain/worker_exec.py

@@ -7,9 +7,9 @@ regardless of provider — see ``ExecutionPolicy``.
 """
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Literal, Protocol, runtime_checkable
+from typing import Literal, Mapping, Protocol, runtime_checkable
 
 from .worker_presentation import Presentation
 from .write_policy import WriteEnforcement, WritePolicy
@@ -84,6 +84,9 @@ class ExecCommand:
     stdin_text: str | None
     cwd: Path
     presentation: Presentation
+    # 인증 값은 프로세스 경계에서만 전달하고 명령 표현·실행 기록에서 제외한다.
+    # None 은 부모에게서 상속된 설정을 지운다.
+    environment: Mapping[str, str | None] = field(default_factory=dict, repr=False)
 
 
 @dataclass(frozen=True)

package/runtime/python/okstra_ctl/report_projections.py

@@ -21,6 +21,7 @@ _AGENT_LABELS = {
     "antigravity": "Antigravity",
     "grok": "Grok",
     "kimi": "Kimi",
+    "zai": "Z.ai GLM",
 }
 _STATUS = {
     "done": "completed",

package/runtime/python/okstra_ctl/report_synthesis_packet.py

@@ -2,7 +2,6 @@
 from __future__ import annotations
 
 import copy
-import hashlib
 import json
 import os
 import re
@@ -54,7 +53,6 @@ class ReportSynthesisSource:
     label: str
     owner: str
     path: str
-    digest: str
     content: str
 
     def to_dict(self) -> dict[str, str]:
@@ -62,7 +60,6 @@ class ReportSynthesisSource:
             "label": self.label,
             "owner": self.owner,
             "path": self.path,
-            "digest": self.digest,
             "content": self.content,
         }
 
@@ -282,7 +279,6 @@ class ReportSynthesisPacket:
                     "user response carry-in",
                 ],
                 "validationRules": [
-                    "source-digest-match",
                     "writer-owned-fields-only",
                     "all-defects-collected",
                     *self._carry_validation_rules(),
@@ -307,7 +303,7 @@ class ReportSynthesisPacket:
             "- Runtime-owned values: session identifiers, token usage, estimated cost, "
             "user response carry-in",
             "- Accounting details stay in the JSON snapshot; assembly supplies them.",
-            "- Validation: source digest match, writer-owned fields, all defects collected",
+            "- Validation: writer-owned fields, all defects collected",
         ]
         # 작성자가 실제로 읽는 것은 마크다운이다. JSON 정본에만 실으면 지시가
         # 도달하지 않는다.
@@ -351,8 +347,7 @@ def _source_markdown(
         if content != source.content.rstrip("\n"):
             view = [
                 "- View: repeated extracts refer to frozen sources below; "
-                "the original line index is omitted. The digest identifies "
-                "the frozen original.",
+                "the original line index is omitted.",
             ]
     if source.label == "Final report schema":
         try:
@@ -361,7 +356,7 @@ def _source_markdown(
             schema = {}
             view = ["- View: schema is not JSON; the original text is retained."]
         if isinstance(schema, dict) and schema.get("properties"):
-            # 원본과 해시는 JSON 보관본에 남긴다. 저작용 읽기에는 검증기와
+            # 원본은 JSON 보관본에 남긴다. 저작용 읽기에는 검증기와
             # 같은 소유권 투영을 쓰고, 도달하지 않는 정의만 기존 발췌기로 뺀다.
             owned = writer_owned_schema(schema)
             # 부분 서사 검증에서 빠지는 루트 조건도 작성 지침에는 남긴다.
@@ -374,8 +369,8 @@ def _source_markdown(
             excerpt = build_schema_excerpt(owned, task_type)
             content = json.dumps(excerpt, ensure_ascii=False, indent=2)
             view = [
-                "- View: writer-owned schema excerpt; the digest identifies the "
-                "frozen original. Task-specific requirements are listed above.",
+                "- View: writer-owned schema excerpt. "
+                "Task-specific requirements are listed above.",
             ]
     longest = max((len(run) for run in re.findall(r"`+", content)), default=0)
     fence = "`" * max(3, longest + 1)
@@ -385,7 +380,6 @@ def _source_markdown(
         "",
         f"- Owner: `{source.owner}`",
         f"- Path: `{source.path}`",
-        f"- Digest: `{source.digest}`",
         *view,
         "",
         f"{fence}text",
@@ -700,13 +694,11 @@ def _read_sources(
         except (OSError, UnicodeError) as exc:
             issues.append(ReportSynthesisPacketIssue(owner, label, path, str(exc)))
             continue
-        digest = "sha256:" + hashlib.sha256(content.encode("utf-8")).hexdigest()
         sources.append(
             ReportSynthesisSource(
                 label=label,
                 owner=owner,
                 path=_relative(project_root, path),
-                digest=digest,
                 content=content,
             )
         )
@@ -929,18 +921,8 @@ def verify_report_synthesis_packet_sources(
             )
             continue
         try:
-            content = path.read_text(encoding="utf-8")
+            path.read_text(encoding="utf-8")
         except (OSError, UnicodeError) as exc:
             issues.append(ReportSynthesisPacketIssue(owner, label, path, str(exc)))
             continue
-        digest = "sha256:" + hashlib.sha256(content.encode("utf-8")).hexdigest()
-        if digest != source.get("digest"):
-            issues.append(
-                ReportSynthesisPacketIssue(
-                    owner,
-                    label,
-                    path,
-                    "source value changed after packet materialization",
-                )
-            )
     return tuple(issues)

package/runtime/python/okstra_ctl/worker_runner.py

@@ -202,7 +202,7 @@ def _launch(
             stdout=subprocess.PIPE,
             stderr=_stderr_target(strategy),
             start_new_session=True,
-            env=_child_env(),
+            env=_child_env(command.environment),
         )
         on_spawn(process)
         exit_code, timed_out, idle_seconds = _pump(
@@ -604,7 +604,7 @@ def _terminate(process: subprocess.Popen[bytes]) -> None:
         process.wait()
 
 
-def _child_env() -> dict[str, str]:
+def _child_env(overrides: Mapping[str, str | None]) -> dict[str, str]:
     """The worker's environment with git's fsmonitor disabled.
 
     The main worktree's fsmonitor daemon leaks its IPC socket into task
@@ -614,6 +614,11 @@ def _child_env() -> dict[str, str]:
     GIT_CONFIG_* the caller already set.
     """
     env = dict(os.environ)
+    for key, value in overrides.items():
+        if value is None:
+            env.pop(key, None)
+        else:
+            env[key] = value
     index = int(env.get("GIT_CONFIG_COUNT", "0") or "0")
     env[f"GIT_CONFIG_KEY_{index}"] = "core.fsmonitor"
     env[f"GIT_CONFIG_VALUE_{index}"] = "false"

package/runtime/python/okstra_token_usage/claude.py

@@ -9,6 +9,7 @@ from pathlib import Path
 
 from .cursor import MAX_NEEDLES, fresh_cache, load_cache, save_cache
 from .paths import claude_project_dir, ts_in_window
+from okstra_ctl.wrapper_status import read_wrapper_status
 
 # lead 의 단계 체크포인트 라인(prompts/lead/okstra-lead-contract.md "Progress reporting") — phase id 가
 # `phase-<digit>` 로 시작하는 라인만 마커로 인정해 일반 대화의 오탐을 줄인다.
@@ -16,6 +17,34 @@ _PROGRESS_RE = re.compile(r"^PROGRESS:\s+(phase-\d\S*(?:[ \t].*)?)$", re.MULTILI
 _PROGRESS_MARKER_MAX_CHARS = 160
 
 
+def claude_code_status_total(status_path: Path) -> dict:
+    """Claude Code의 최종 누적 사용량을 제공자 가격과 분리해서 읽는다."""
+    status = read_wrapper_status(status_path)
+    usage = status.raw.get("usage") if status is not None else None
+    if not isinstance(usage, dict) or not usage:
+        return {"available": False, "totalTokens": 0}
+    attestation = status.raw.get("servedModelAttestation")
+    model = attestation.get("observedModel") if isinstance(attestation, dict) else None
+    input_tokens = usage.get("input_tokens")
+    output_tokens = usage.get("output_tokens")
+    cache_creation = usage.get("cache_creation_input_tokens", 0)
+    cache_read = usage.get("cache_read_input_tokens", 0)
+    if any(
+        not isinstance(value, int) or isinstance(value, bool) or value < 0
+        for value in (input_tokens, output_tokens, cache_creation, cache_read)
+    ):
+        return {"available": False, "totalTokens": 0}
+    return {
+        "available": True,
+        "totalTokens": input_tokens + output_tokens + cache_creation,
+        "inputTokens": input_tokens,
+        "outputTokens": output_tokens,
+        "cacheCreationTokens": cache_creation,
+        "cacheReadTokens": cache_read,
+        "model": model,
+    }
+
+
 def _event_from_record(rec: dict) -> dict | None:
     """jsonl 레코드 1개 → 압축 이벤트. 집계에 기여하지 않으면 None.
 

package/runtime/python/okstra_token_usage/collect.py

@@ -11,6 +11,7 @@ from okstra_project.dirs import OKSTRA_RELATIVE
 
 from .blocks import na_block, usage_block
 from .claude import (
+    claude_code_status_total,
     claude_session_totals,
     find_claude_agent_sessions,
     find_claude_team_sessions,
@@ -662,6 +663,8 @@ def _cli_session_totals(
             )
         elif provider == "grok":
             total = grok_session_total(session_path)
+        elif provider == "zai":
+            total = claude_code_status_total(session_path)
         else:
             continue
         if total.get("available"):
@@ -705,12 +708,15 @@ def _cli_usage_block(provider: str, totals: dict, session_paths: list[Path]) ->
         billable = provider_billable_equivalent(provider, *rates)
         if billable is not None:
             block["billableEquivalentTokens"] = billable
-    else:
+    elif provider == "antigravity":
         cost = antigravity_cost_usd(
             totals.get("model"),
             totals.get("inputTokens", 0) or 0,
             totals.get("outputTokens", 0) or 0,
         )
+    else:
+        cost = None
+        block["cliNote"] = "Token usage recorded; provider billing cost is unavailable."
     if cost is not None:
         block["cliEstimatedCostUsd"] = cost
     return block
@@ -919,6 +925,10 @@ def _worker_cli_usage_block(
             if path not in session_paths:
                 session_paths.append(path)
     status_path = status_paths[-1] if status_paths else None
+    if provider == "zai":
+        session_paths = list(dict.fromkeys(
+            path for path in status_paths if path is not None and path.is_file()
+        ))
     if provider == "antigravity":
         for raw, source_status in zip(prompt_paths, status_paths):
             for source in _antigravity_usage_sources(

package/runtime/schemas/final-report-v2.0.schema.json

@@ -7025,7 +7025,8 @@
             "Codex",
             "Antigravity",
             "Grok",
-            "Kimi"
+            "Kimi",
+            "Z.ai GLM"
           ]
         },
         "role": {

package/runtime/schemas/final-report-v3.0.schema.json

@@ -7122,7 +7122,8 @@
             "Codex",
             "Antigravity",
             "Grok",
-            "Kimi"
+            "Kimi",
+            "Z.ai GLM"
           ]
         },
         "role": {

package/runtime/schemas/report-synthesis-packet-v1.0.schema.json

@@ -111,7 +111,7 @@
       "minItems": 1,
       "items": {
         "type": "object",
-        "required": ["label", "owner", "path", "digest", "content"],
+        "required": ["label", "owner", "path", "content"],
         "additionalProperties": false,
         "properties": {
           "label": {