okstra 0.200.0 → 0.201.0

package/runtime/python/okstra_ctl/conformance.py

@@ -17,9 +17,7 @@ import re
 from dataclasses import dataclass
 from pathlib import Path
 
-# 셸에서 프로세스의 cwd 를 바꾸는 명령. verifier 가 워크트리 cwd 에서 실행하는
-# 계약이 이것들로 무력화된다.
-_CWD_CHANGING_COMMANDS: frozenset[str] = frozenset({"cd", "pushd", "popd", "chdir"})
+from .qa_commands import verification_command_defects
 
 # diff 가 건드린 표면과 대조할 capability 태그 화이트리스트.
 CAPABILITY_WHITELIST: tuple[str, ...] = ("db", "io", "http", "external")
@@ -323,24 +321,8 @@ def _check_entry(entry: object, idx: int, errors: list[str]) -> None:
         errors.append(f"{path}.script must live under the task qa scripts dir (qa/scripts/), got {script!r}")
     _check_nonempty_str(entry.get("runCommand"), f"{path}.runCommand", errors)
     run_command = entry.get("runCommand")
-    # 이 명령은 워크트리 cwd 에서 verbatim 실행되고(_implementation-verifier.md
-    # "Otherwise run runCommand in the worktree cwd"), **그 cwd 가 곧 검사 대상**이다.
-    # 스크립트·tsconfig 는 `.okstra/` 아래 사는데 워크트리에는 `.okstra/` 가 없으므로
-    # (implementation-worker-preamble.md "the worktree may not contain them")
-    # 그것들을 절대경로로 가리키는 것은 정상이고 사실상 필수다. 금지되는 것은 cwd
-    # 를 옮기는 일뿐이다 — 선행 `cd <메인 체크아웃>` 은 stage diff 가 없는 트리에서
-    # 검사를 돌려 미변경 코드를 통과시킨다.
     if isinstance(run_command, str):
-        for segment in re.split(r"&&|\|\||;|\|", run_command):
-            words = segment.split()
-            if words and words[0] in _CWD_CHANGING_COMMANDS:
-                errors.append(
-                    f"{path}.runCommand must run in the worktree cwd — that cwd is "
-                    f"the tree under test; a leading `{words[0]}` repoints it, so "
-                    "the script checks whichever checkout it lands in instead of "
-                    "this stage's diff"
-                )
-                break
+        errors.extend(f"{path}.runCommand {error}" for error in verification_command_defects(run_command))
     _check_nonempty_str(entry.get("passContract"), f"{path}.passContract", errors)
     req_ids = entry.get("requirementIds")
     if (

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -271,6 +271,7 @@ class WorkerHandle:
     write_policy_digest: str = ""
     write_enforcement: WriteEnforcement | None = None
     runtime_handle: RuntimeHandle | None = None
+    started_at: str = ""
 
 
 @dataclass(frozen=True)
@@ -841,7 +842,8 @@ def await_dispatches(
 ) -> int:
     _correct_teardown_marked_dispatches(plan)
     deadline = time.monotonic() + timeout_seconds if timeout_seconds is not None else None
-    last_heartbeat = 0.0
+    last_heartbeat: float | None = None
+    last_pending: tuple[str, ...] = ()
     while True:
         running = _running_dispatches(plan.team_state_path)
         if not running:
@@ -853,9 +855,23 @@ def await_dispatches(
         if deadline is not None and time.monotonic() >= deadline:
             return 1
         now = time.monotonic()
-        if heartbeat_seconds > 0 and now - last_heartbeat >= heartbeat_seconds:
-            print(f"WAITING {len(running)} worker dispatch(es)")
+        pending = tuple(sorted(
+            f"{row.get('invocationRef') or row.get('worker', '')}"
+            f":attempt={row.get('attempt', 1)}"
+            for row in running
+        ))
+        # 같은 대기 출력은 작업 진행이 아니며 호스트가 재독할 내용만 늘린다.
+        if (
+            heartbeat_seconds > 0
+            and pending != last_pending
+            and (last_heartbeat is None or now - last_heartbeat >= heartbeat_seconds)
+        ):
+            print(
+                f"WAITING {len(running)} worker dispatch(es): {', '.join(pending)}",
+                flush=True,
+            )
             last_heartbeat = now
+            last_pending = pending
         time.sleep(max(poll_interval_seconds, 0))
 
 
@@ -1579,6 +1595,7 @@ def _spawn_job(
 def _spawn_cli_job_nonblocking(
     plan: DispatchPlan, job: WorkerJob, attempt: int,
 ) -> WorkerHandle:
+    started_at = _utc_now()
     plan = _ensure_runtime_chain(plan)
     try:
         runtime = open_worker(
@@ -1596,6 +1613,7 @@ def _spawn_cli_job_nonblocking(
         status_path_for_prompt(job.prompt_path),
         "",
         runtime_handle=runtime,
+        started_at=started_at,
     )
 
 
@@ -1921,6 +1939,7 @@ def _chain_starting_at(
 
 
 def _start_job(plan: DispatchPlan, job: WorkerJob) -> WorkerHandle:
+    started_at = _utc_now()
     plan = _ensure_runtime_chain(plan)
     try:
         runtime = open_worker(
@@ -1946,6 +1965,7 @@ def _start_job(plan: DispatchPlan, job: WorkerJob) -> WorkerHandle:
         status_path_for_prompt(settled.prompt_path),
         degraded_from,
         runtime_handle=runtime,
+        started_at=started_at,
     )
 
 
@@ -2812,7 +2832,7 @@ def _record_dispatch(
 ) -> None:
     _append_worker_dispatch(
         team_state_path,
-        _dispatch_record(
+        {**_dispatch_record(
             handle.job,
             attempt,
             status,
@@ -2826,7 +2846,7 @@ def _record_dispatch(
             ),
             write_policy_digest=handle.write_policy_digest,
             write_enforcement=handle.write_enforcement,
-        ),
+        ), "startedAt": handle.started_at or _utc_now()},
     )
 
 

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -454,10 +454,12 @@ def append_worker_dispatch(
                     isinstance(existing, Mapping)
                     and existing.get("dispatchId") == new_id
                 ):
+                    new_record["startedAt"] = existing.get("startedAt") or _utc_timestamp(None)
                     dispatches[index] = new_record
                     replaced = True
                     break
         if not replaced:
+            new_record.setdefault("startedAt", _utc_timestamp(None))
             dispatches.append(new_record)
         write_json(team_state_path, payload)
 

package/runtime/python/okstra_ctl/domain/provider.py

@@ -14,7 +14,6 @@ if TYPE_CHECKING:
 
 _MISSING = object()
 
-
 @dataclass(frozen=True)
 class ServedModelAttestation:
     """Provider-observed model identity after one execution attempt."""

package/runtime/python/okstra_ctl/domain/role.py

@@ -47,6 +47,7 @@ DUTY_ROLE_IDS = {
     "analysis-worker": "analyser",
     "discovery-worker": "analyser",
     "diagnosis-worker": "analyser",
+    "technical-verification-worker": "analyser",
     "scope-critic": "critic",
     "acceptance-critic": "critic",
     "direction-selection-worker": "designer",

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -145,7 +145,7 @@ class ExecutionMutationAudit:
         rows = tuple(policies)
         root, artifact_root = _validate_batch(rows)
         generated = _generated_paths(rows)
-        file_digests = _content_snapshot(root, generated | _non_source_paths(root))
+        file_digests = source_content_snapshot(root, generated)
         artifact_digests = (
             file_digests
             if artifact_root == root
@@ -360,6 +360,11 @@ final-verification 001).
 """
 
 
+def source_content_snapshot(root: Path, excluded: frozenset[str] = frozenset()) -> dict[str, str]:
+    """소스 감사와 검사 실행이 동일한 생성·무시 경로 제외 규칙을 사용한다."""
+    return _content_snapshot(root, excluded | _non_source_paths(root))
+
+
 def _content_snapshot(root: Path, excluded: frozenset[str]) -> dict[str, str]:
     """감사 대상 트리의 내용 다이제스트. `excluded` 는 정책이 선언한 생성
     경로와 레포가 무시하는 경로를 합친 접두사 집합이다."""

package/runtime/python/okstra_ctl/implementation_direction.py

@@ -687,6 +687,7 @@ def _coverage_reference_errors(
     step_ids: set[str],
     validation_ids: set[str],
     file_paths: tuple[str, ...],
+    dependencies: list[Mapping[str, Any]],
 ) -> list[str]:
     failures: list[str] = []
     reference_sets = {
@@ -694,11 +695,52 @@ def _coverage_reference_errors(
         "stepRefs": step_ids,
         "validationRefs": validation_ids,
         "fileRefs": set(file_paths),
+        "crossProjectDependencyRefs": {row.get("id") for row in dependencies},
     }
     for row in rows:
         requirement_id = str(row.get("originalRequirementId") or "<missing>")
+        external_refs = row.get("crossProjectDependencyRefs") or ()
+        if row.get("status") == "externally-tracked":
+            if not external_refs:
+                failures.append(
+                    f"requirementCoverage {requirement_id} requires crossProjectDependencyRefs"
+                )
+            for ref in external_refs:
+                matches = [item for item in dependencies if item.get("id") == ref]
+                if (
+                    len(matches) != 1
+                    or any(
+                        not isinstance(matches[0].get(field), str)
+                        or not matches[0][field].strip()
+                        for field in (
+                            "project",
+                            "requiredWork",
+                            "verificationSignal",
+                            "linkedWork",
+                            "howToStart",
+                        )
+                    )
+                    or matches[0].get("direction")
+                    not in {"upstream-precondition", "downstream-carry"}
+                ):
+                    failures.append(
+                        f"requirementCoverage {requirement_id} crossProjectDependencyRefs must resolve to one complete dependency: {ref}"
+                    )
+        elif external_refs:
+            failures.append(
+                f"requirementCoverage {requirement_id} external references require externally-tracked status"
+            )
+        elif any(
+            not row.get(field)
+            for field in ("stageRefs", "stepRefs", "validationRefs", "fileRefs")
+        ):
+            failures.append(
+                f"requirementCoverage {requirement_id} requires local stage, step, validation and file references"
+            )
         for field, valid_values in reference_sets.items():
-            dangling = [value for value in row.get(field) or () if value not in valid_values]
+            dangling = [
+                value for value in row.get(field) or () if value not in valid_values
+            ]
             if dangling:
                 failures.append(
                     f"requirementCoverage {requirement_id} {field} contains "
@@ -740,19 +782,33 @@ def _coverage_summary_errors(
     stage_ids, step_ids, validation_ids, file_paths = _plan_reference_sets(planning)
     failures.extend(
         _coverage_reference_errors(
-            rows, stage_ids, step_ids, validation_ids, file_paths
+            rows,
+            stage_ids,
+            step_ids,
+            validation_ids,
+            file_paths,
+            [
+                row
+                for row in planning.get("crossProjectDependencies") or ()
+                if isinstance(row, Mapping)
+            ],
         )
     )
-    if structure_failures:
+    if failures:
         return failures
-    statuses = {row_id: str(row.get("status") or "") for row_id, row in zip(row_ids, rows)}
+    # 검증된 외부 작업 연결은 계획 범위에만 포함하며 실제 완료 상태는 바꾸지 않는다.
+    statuses = {
+        row_id: "covered"
+        if row.get("status") == "externally-tracked"
+        else str(row.get("status") or "")
+        for row_id, row in zip(row_ids, rows)
+    }
     stage_requirements = {
         stage: _requirement_ids_for_scope(rows, "stageRefs", stage)
         for stage in sorted(stage_ids)
     }
     file_requirements = {
-        path: _requirement_ids_for_scope(rows, "fileRefs", path)
-        for path in file_paths
+        path: _requirement_ids_for_scope(rows, "fileRefs", path) for path in file_paths
     }
     try:
         result, unmapped_stages, unmapped_files = calculate_plan_exact_coverage(
@@ -761,7 +817,8 @@ def _coverage_summary_errors(
     except ExactCoverageError as exc:
         return [*failures, f"plan-ready requires exact 100% coverage: {exc}"]
     failures.extend(
-        f"unmapped stage {stage} has no original requirement" for stage in unmapped_stages
+        f"unmapped stage {stage} has no original requirement"
+        for stage in unmapped_stages
     )
     failures.extend(
         f"unmapped file change {path} has no original requirement"

package/runtime/python/okstra_ctl/implementation_options.py

@@ -12,9 +12,12 @@ from typing import Any
 
 from .clarification_items.dispositions import (
     USER_INPUT_BLOCKS,
-    progress_blocking_ids,
+    clarification_disposition,
+    incorporated_clarification_ids,
+    row_blocks_progress,
 )
 from .exact_coverage import ExactCoverageError, calculate_exact_coverage
+from .technical_verification import TechnicalVerificationError, technical_verification_facts
 
 
 EVALUATION_CRITERIA = (
@@ -354,10 +357,10 @@ def _validate_option_count_and_routing(
     if not valid_candidates:
         if recommended is not None:
             errors.append("recommendedOptionId must be null when no valid options exist")
-        if routing != NO_VALID_OPTIONS_ROUTING:
+        if routing not in {NO_VALID_OPTIONS_ROUTING, "technical-verification"}:
             errors.append("routing must be blocked only when no valid options exist")
         return
-    if routing == NO_VALID_OPTIONS_ROUTING:
+    if routing in {NO_VALID_OPTIONS_ROUTING, "technical-verification"}:
         errors.append("routing may be blocked only when no valid options exist")
     if not options:
         errors.append("recommendedOptionId must name the first ranked option")
@@ -434,54 +437,64 @@ def vote_gaps(
 def validate_blocked_answer_channel(
     report_data: Mapping[str, object],
 ) -> list[str]:
-    """차단된 run 이 사용자가 답할 자리를 남겼는지.
-
-    `routing: blocked` 는 목적지가 없는 유일한 종료 상태다. 그 차단이
-    `unresolvedFeasibilityFacts` 때문이면 — 값이 미정이다, 계약이 없다,
-    리포터 확인이 필요하다 — 푸는 사람은 사용자인데, 답변 채널은
-    `clarificationItems[]` 하나뿐이다. 조립은 그 배열을 승인 결정 원장에서만
-    읽고(`report_assembly._clarifications`), `okstra user-response` 는 발행된
-    리포트의 그 배열만 읽는다(`user_response._record_clarification_rows`).
-    그래서 미해결 사실이 산문으로만 남으면 run 은 "사용자를 기다림" 상태로
-    발행되고 사용자에게는 답할 항목이 0건으로 보인다(2026-09-10 실측,
-    dev-10630: 후보 5개 전부 미해결 사실을 달고 원장은 빈 배열).
-
-    앞으로 가는 길은 원장에 행을 여는 것이다 —
-    `okstra approval-decision open --ledger <approvalDecisionsPath>` 를 행마다
-    한 번. 미해결 사실이 없는 차단(워커가 결과를 못 냈다 같은 실행 차단)은
-    사용자가 답할 것이 없으므로 이 검사에 걸리지 않는다.
-
-    `clarificationItems[]` 는 리드 소유라 작성자 서사에는 없다. 그래서 이
-    검사는 조립이 끝난 리포트 레코드 전체를 받고
-    `validate_implementation_option_selection`(작성자 소유 의미론) 과 따로
-    선다 — 교정 루프의 semantic validator 에 묶으면 원장에 행이 있어도 매번
-    발화한다.
+    """사실별 해결 방식과 사용자 질문 연결을 검사하며 차단 상태는 보존한다.
+
+    구형 보고서의 분류 없는 사실은 사용자 결정으로 추정하지 않는다. 읽기
+    스키마는 수용하지만 재발행 전에 작성자가 분류를 보완해야 한다.
+    답변의 진행 차단 판정은 공통 처분 규칙을 그대로 사용한다.
     """
     selection = report_data.get("implementationOptionSelection")
     if not isinstance(selection, Mapping):
         return []
-    if selection.get("routing") != NO_VALID_OPTIONS_ROUTING:
-        return []
-    unresolved = [
-        str(candidate.get("id"))
-        for key in ("rankedOptions", "candidateAudit")
-        for candidate in (selection.get(key) or ())
-        if isinstance(candidate, Mapping)
-        and candidate.get("unresolvedFeasibilityFacts")
-    ]
-    if not unresolved:
+    if selection.get("routing") not in {NO_VALID_OPTIONS_ROUTING, "technical-verification"}:
         return []
-    if progress_blocking_ids(
-        report_data.get("clarificationItems"), USER_INPUT_BLOCKS
+    if selection.get("routing") == "technical-verification":
+        try:
+            technical_verification_facts(report_data)
+        except TechnicalVerificationError as exc:
+            return [str(exc)]
+    incorporated = incorporated_clarification_ids(report_data)
+    answer_channels = {
+        row.get("id")
+        for row in (report_data.get("clarificationItems") or ())
+        if isinstance(row, Mapping)
+        and str(row.get("status") or "").strip().lower() != "obsolete"
+        and (
+            row.get("blocks") in USER_INPUT_BLOCKS
+            or not row_blocks_progress(
+                str(row.get("status") or ""), clarification_disposition(row),
+                incorporated=row.get("id") in incorporated,
+            )
+        )
+    }
+    errors: list[str] = []
+    for candidate in (
+        row for key in ("rankedOptions", "candidateAudit")
+        for row in (selection.get(key) or ()) if isinstance(row, Mapping)
     ):
-        return []
-    return [
-        "blocked routing leaves the user no answer channel: "
-        f"{', '.join(unresolved)} carry unresolvedFeasibilityFacts and no open "
-        "clarification row asks them — open one decision row per answerable "
-        "fact with `okstra approval-decision open --ledger "
-        "<approvalDecisionsPath>`, then reassemble"
-    ]
+        for index, fact in enumerate(candidate.get("unresolvedFeasibilityFacts") or ()):
+            label = f"{candidate.get('id')} unresolvedFeasibilityFacts[{index}]"
+            if not isinstance(fact, Mapping):
+                errors.append(f"{label}: expected a fact object with resolutionKind")
+                continue
+            label += f" ({fact.get('fact')})"
+            kind = fact.get("resolutionKind")
+            if kind == "technical-verification":
+                continue
+            if kind != "user-decision":
+                errors.append(f"{label}: classification required — set resolutionKind to "
+                              "user-decision or technical-verification; preserve the fact "
+                              "and evidence, then reassemble; do not infer a user question")
+                continue
+            refs = fact.get("clarificationRefs")
+            if not isinstance(refs, list) or not refs or any(
+                not isinstance(ref, str) or ref not in answer_channels for ref in refs
+            ):
+                errors.append(f"{label}: clarificationRefs {refs!r} must link each required "
+                              "user decision to an existing blocking or answered clarification; "
+                              "use `okstra approval-decision open --ledger <approvalDecisionsPath>` "
+                              "only for a missing question, preserve recorded answers, then reassemble")
+    return errors
 
 
 def _validate_candidate_audit(

package/runtime/python/okstra_ctl/model_pool.py

@@ -6,6 +6,7 @@ from dataclasses import dataclass
 from types import MappingProxyType
 from typing import TYPE_CHECKING
 
+from .registry.provider_registry import provider_display_order
 from .domain.provider import ModelSpec, UnknownModelError
 from .domain.role import ROLE_DEFINITIONS, RoleCatalogError, normalize_role
 from .domain.worker_exec import WorkerWriteCapability
@@ -15,7 +16,6 @@ if TYPE_CHECKING:
     from .registry.provider_registry import ProviderRegistry
 
 
-_BUNDLED_PROVIDER_ORDER = ("claude", "antigravity", "codex", "grok", "kimi")
 _TOKEN = re.compile(r"[a-z0-9][a-z0-9._-]*\Z")
 _VERSION_KINDS = frozenset({"pinned", "channel"})
 
@@ -219,10 +219,7 @@ class ModelPool:
         )
 
     def _ordered_providers(self) -> tuple[str, ...]:
-        providers = self._registry.providers
-        bundled = tuple(provider for provider in _BUNDLED_PROVIDER_ORDER if provider in providers)
-        users = tuple(sorted(provider for provider in providers if provider not in bundled))
-        return (*bundled, *users)
+        return tuple(sorted(self._registry.ids(), key=provider_display_order))
 
     def _snapshot_provider_facts(self) -> dict[str, ProviderRuntimeFacts]:
         facts: dict[str, ProviderRuntimeFacts] = {}

package/runtime/python/okstra_ctl/next_phase.py

@@ -63,6 +63,7 @@ HANDLED_TASK_TYPES = frozenset(
     | {
         "requirements-discovery",
         "error-analysis",
+        "technical-verification",
         "implementation-option-selection",
         "implementation-planning",
         "implementation",
@@ -131,6 +132,8 @@ def project(report_data: Mapping[str, Any]) -> dict[str, str]:
 
     if task_type == "requirements-discovery":
         return _from_nested_routing(report_data, "requirementsDiscovery")
+    if task_type == "technical-verification":
+        return _from_nested_routing(report_data, "technicalVerification")
     if task_type == "error-analysis":
         return _from_nested_routing(report_data, "errorAnalysis")
     if task_type == "implementation-option-selection":

package/runtime/python/okstra_ctl/plan_items.py

@@ -612,6 +612,19 @@ def reverify_item_ids(
     return queue
 
 
+def requires_plan_repair(verification: Mapping[str, Any]) -> bool:
+    """검사·구현 가능성의 사실 결함은 단계 수에 따른 자문 면제에서 제외한다."""
+    return any(
+        str(vote.get("verdict") or "").upper() == "DISAGREE"
+        and vote.get("claimKind") != "judgement"
+        and (vote.get("breakageKind") in {"b", "c", "e"}
+             or (vote.get("breakageKind") == "f" and str(item.get("id", "")).startswith("P-Req")))
+        for item in verification.get("planItems", []) if isinstance(item, Mapping)
+        and not str(item.get("id", "")).upper().startswith("P-RB")
+        for vote in item.get("verdicts", []) if isinstance(vote, Mapping)
+    )
+
+
 def advisory_plan_body_gating(
     planning: Mapping[str, Any],
     extracted: Sequence[Mapping[str, Any]] | None = None,
@@ -622,6 +635,8 @@ def advisory_plan_body_gating(
     초안과 탐지기 스냅샷이 생긴 뒤에만 이 판정을 쓴다. 다단계이거나
     PREP 항목이 있으면 지금 게이트 계약 그대로다.
     """
+    if requires_plan_repair(planning.get("planBodyVerification") or {}):
+        return False
     if len(_planning_stage_rows(planning)) != 1:
         return False
     if extracted is not None and any(

package/runtime/python/okstra_ctl/plan_items_cli.py

@@ -31,6 +31,7 @@ from .plan_items import (
     NextDispatch,
     PlanItemContractError,
     advisory_plan_body_gating,
+    requires_plan_repair,
     content_hash,
     correction_prompt_text,
     critic_is_rostered,
@@ -467,7 +468,7 @@ _PAYLOAD_FIELDS = {
     # 거부되므로 줄이지 말 것.
     "Req": ("id", "source", "requirement", "coveredBy", "originalRequirementId",
             "stageRefs", "stepRefs", "validationRefs", "fileRefs", "ticketId", "status",
-            "approvalDisposition", "decisionRefs"),
+            "approvalDisposition", "decisionRefs", "crossProjectDependencyRefs"),
     "Prep": ("stage", "kind", "evidence"),
 }
 _VAR_ANALYSIS_FIELDS = (
@@ -1354,8 +1355,9 @@ def _seed(args: argparse.Namespace) -> dict[str, Any]:
     verification["dispatchQueue"] = _queue_for(
         extracted, _planning(source), getattr(args, "run_manifest", None), previous,
     )
-    verification["gating"] = not advisory_plan_body_gating(
-        _planning(source), extracted,
+    verification["gating"] = (
+        verification.get("gating") is True or requires_plan_repair(verification)
+        or not advisory_plan_body_gating(_planning(source), extracted)
     )
     write_json_atomic(target, data)
     result = {
@@ -1451,6 +1453,8 @@ def _apply_verdicts(args: argparse.Namespace) -> dict[str, Any]:
     for item in recorded:
         if isinstance(item, Mapping) and item.get("id") in rows:
             writer(item, rows[item["id"]], args.round_number, project_root)
+    if requires_plan_repair(verification):
+        verification["gating"] = True
     _validate_advisory_round(verification, args.round_number)
     write_json_atomic(target, data)
     return {"ok": True, "operation": "apply-verdicts", "path": str(target)}
@@ -1850,6 +1854,8 @@ def _complete_round(args: argparse.Namespace) -> dict[str, Any]:
         raise PlanItemContractError("--round must be 1 or greater")
     data, current, audit, history = _round_inputs(args)
     verification = data["planBodyVerification"]
+    if requires_plan_repair(verification):
+        verification["gating"] = True
     _validate_advisory_round(verification, args.round_number)
     if verification.get("gating") is False:
         if args.self_fix_group or args.self_fix_note or args.self_fix_stop_reason:

package/runtime/python/okstra_ctl/qa_commands.py

@@ -17,6 +17,7 @@ self-enforce 하는 측면) 의 계약은 `prompts/profiles/implementation.md`
 from __future__ import annotations
 
 import re
+import shlex
 from typing import Iterable
 
 # 카테고리 화이트리스트. 알 수 없는 카테고리는 오타 가능성이 높으므로 거부.
@@ -97,6 +98,35 @@ def find_unfrozen_installs(cmd: str) -> list[str]:
     return found
 
 
+def verification_command_defects(command: str) -> list[str]:
+    """선언된 작업 폴더를 셸에서 다른 체크아웃으로 바꾸는 명령을 거부한다."""
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=";&|()\n")
+        lexer.whitespace = " \t\r"
+        lexer.whitespace_split = True
+        words = list(lexer)
+    except ValueError as exc:
+        return [f"invalid shell command: {exc}"]
+    start = True
+    shell = False
+    for word in words:
+        if word and not word.strip(";&|()\n"):
+            start, shell = True, False
+            continue
+        if start and (word in {"command", "builtin", "env", "!", "if", "then", "do"}
+                      or re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", word)):
+            continue
+        if start:
+            if word in {"cd", "pushd", "popd", "chdir", "-C", "--chdir"} or word.startswith("--chdir="):
+                return ["command must run in the worktree cwd; remove the checkout-changing command"]
+            shell = word.rsplit("/", 1)[-1] in {"sh", "bash", "zsh", "fish"}
+            start = False
+        elif shell and word.startswith("-") and not word.startswith("--") and "c" in word:
+            return ["nested shell command; declare the verification command directly"]
+
+    return []
+
+
 def find_denied_tokens(cmd: str) -> list[str]:
     """`cmd` 안에 포함된 모든 denied 토큰 목록을 반환. 비어 있으면 안전."""
     if not isinstance(cmd, str):

package/runtime/python/okstra_ctl/registry/provider_registry.py

@@ -13,6 +13,16 @@ from ..json_boundary import JsonBoundaryError, load_owned_object
 from .factory_loader import FactoryLoadError, load_relative_factory
 
 
+_PROVIDER_DISPLAY_ORDER = ("claude", "codex", "grok", "antigravity", "zai", "kimi")
+
+
+def provider_display_order(provider_id: str) -> tuple[int, str]:
+    """내장 제공자를 지정 순서로, 추가 제공자를 그 뒤에 이름순으로 표시한다."""
+    if provider_id in _PROVIDER_DISPLAY_ORDER:
+        return _PROVIDER_DISPLAY_ORDER.index(provider_id), provider_id
+    return len(_PROVIDER_DISPLAY_ORDER), provider_id
+
+
 class ProviderAdapterContractError(ValueError):
     """Raised when a discovered provider adapter violates its contract."""
 
@@ -72,17 +82,10 @@ def _registry_for_roots(
     user_root: Path,
 ) -> ProviderRegistry:
     discovered = ProviderRegistry.from_roots((bundled_root, user_root)).providers
-    bundled_order = ("claude", "antigravity", "codex", "grok", "kimi")
     ordered = {
         provider_id: discovered[provider_id]
-        for provider_id in bundled_order
-        if provider_id in discovered
+        for provider_id in sorted(discovered, key=provider_display_order)
     }
-    ordered.update(
-        (provider_id, discovered[provider_id])
-        for provider_id in sorted(discovered)
-        if provider_id not in ordered
-    )
     return ProviderRegistry(ordered)
 
 

package/runtime/python/okstra_ctl/render.py

@@ -1755,6 +1755,7 @@ def render_run_manifest(run_manifest_path: str, ctx: dict) -> None:
         "taskKey": ctx.get("TASK_KEY", ""),
         "taskType": ctx.get("TASK_TYPE", ""),
         "runTimestamp": ctx.get("RUN_TIMESTAMP_ISO", ""),
+        "userAuthorization": json.loads(ctx.get("USER_AUTHORIZATION_JSON", "{}")),
         # 리포트 언어의 유일한 해석기. 예전에는 아무도 채우지 않는
         # `REPORT_LANGUAGE` 를 읽어 항상 "en" 이 나왔고, report-writer 프롬프트만
         # `resolve_report_language()` 를 써서 프롬프트는 ko, 매니페스트는 en 으로
@@ -2074,6 +2075,8 @@ def _guard_invocation_manifest_rewrite(
         for key in _IMMUTABLE_INVOCATION_KEYS
         if existing.get(key) != proposed.get(key)
     ]
+    if existing.get("userAuthorization", {}) != proposed.get("userAuthorization", {}):
+        drift.append("userAuthorization")
     if drift:
         raise ValueError(
             "immutable invocation manifest fields changed: " + ", ".join(drift)

package/runtime/python/okstra_ctl/render_final_report.py

@@ -77,6 +77,7 @@ TASK_DELIVERABLE_TITLES = {
     "requirements-discovery": "Requirements Discovery",
     "improvement-discovery": "Improvement Discovery",
     "error-analysis": "Error Analysis",
+    "technical-verification": "Technical Verification",
     "implementation-option-selection": "Implementation Option Selection",
     "project-analysis": "Project Analysis",
     "feature-analysis": "Feature Analysis",