okstra 0.201.2 → 0.201.3

package/bin/okstra

@@ -50,4 +50,4 @@ async function main(argv) {
   }
 }
 
-main(process.argv).then((code) => process.exit(code));
+process.exitCode = await main(process.argv);

package/docs/project-structure-overview.md

@@ -29,7 +29,7 @@ Current baseline:
 - Python orchestration authority: `scripts/okstra_ctl/run.py::prepare_task_bundle`
 - lifecycle: `requirements-discovery → error-analysis → implementation-option-selection → implementation-planning → implementation → final-verification → release-handoff`
 - installed skills: 13
-- provider workers: `claude`, `codex`, `antigravity`, `grok`, `kimi`; functional report writer: `report-writer`
+- provider workers: `claude`, `codex`, `antigravity`, `grok`, `kimi`, `zai` (GLM via Claude Code); functional report writer: `report-writer`
 - final report SSOT: `schemas/final-report-v2.0.schema.json` + `*.data.json`
 
 Design principles:
@@ -224,7 +224,7 @@ Top-level scripts:
 | File | Role |
 |---|---|
 | `okstra.sh` | Bash CLI wrapper around `prepare_task_bundle`, optionally launches `claude` |
-| `okstra-{claude,codex,antigravity,grok,kimi}-exec.sh` | Worker CLI entrypoints — four lines each, `exec`ing `okstra-provider-exec.py` with the provider id. They hold no provider logic; adding a flag to one of these instead of to the provider adapter is exactly the drift this shape exists to prevent |
+| `okstra-{claude,codex,antigravity,grok,kimi,zai}-exec.sh` | Worker CLI entrypoints — four lines each, `exec`ing `okstra-provider-exec.py` with the provider id (`zai` selects the Z.ai GLM provider, which reuses the installed `claude` executable with process-local connection settings). They hold no provider logic; adding a flag to one of these instead of to the provider adapter is exactly the drift this shape exists to prevent |
 | `okstra-provider-exec.py` | The one worker entrypoint: parses the shared positional contract plus `--presentation`, resolves the provider's `ExecutionStrategy` from the registry, refuses a missing CLI before any artifact is written, then hands the run to `okstra_ctl.worker_runner` |
 | `okstra-wrapper-status.py` | Standalone writer for one worker status sidecar. No longer on the dispatch path — `worker_runner.py` writes the same document in-process |
 | `okstra-token-usage.py` | Token usage CLI entrypoint |
@@ -245,6 +245,8 @@ Important modules:
 | `exact_coverage.py` | Shared pure calculator for requirement coverage and scope precision in option selection and selected-direction planning |
 | `implementation_options.py` | Option-selection criteria, weighting, candidate fingerprint convergence, ranking, and semantic validation |
 | `implementation_direction.py` | Selected report/response validation, direction snapshot materialization, and selected-direction reference validation |
+| `technical_verification.py` | Optional `technical-verification` phase backend — resolves and freezes the explicitly classified unresolved facts from the same task's implementation-option-selection report into `state/technical-verification-input-<seq>.json` (`write_technical_verification_input` / `resolve_technical_verification_input`, driven from `run.py`). No selected direction is required and unresolved user decisions still block entry; it links test inputs to observed results and never produces adoption approval or changes candidate feasibility |
+| `verification_target.py` | Shared reader for the prepared final-verification target snapshot (`verification-target.md`) written by `run.write_verification_target_snapshot`. One implementation of the digest/scope rule serves both consumers — report assembly (records `verificationScope`) and `validators/validate-run.py` (re-checks the published report against the target) — so the two cannot drift |
 | `implementation_stage.py` | `implementation` single-stage run orchestration — read the Stage Lifecycle Snapshot → pick an available Stage Map entry → provision an isolated stage worktree → publish the selected stage as run context (extracted from `run.py`) |
 | `stage_targets.py` | Stage readiness/verification policy SSOT — from the Stage Lifecycle Snapshot (`consumers.jsonl` ledger + carry sidecar backfill + active registry reservation) it decides which stage is runnable, which commit it branches from, and what final-verification checks. `acquire_final_verification_target()` acquires the ledger, registry, worktree, Git, and optional whole-task integration facts behind one task-key mutex and returns a typed target without render-context coupling. `order_stage_closure` topologically sorts (Kahn) the dependency closure of the wizard's multi-selected stage set to produce the unattended `chain-stages` chaining order |
 | `stage_fix_carry.py` | fix-run carry derivation for a re-run on an `implementation` stage whose latest final-report data.json carries verifier `FAIL` verdicts — collects the previous report path, previous run HEAD, failed verifiers, carried blocking findings, and a routing recommendation, which `run.py` renders into the analysis profile through the `{{FIX_RUN_CONTEXT}}` token. A first run, or a re-run after `PASS`, yields no carry and renders the token empty |
@@ -300,7 +302,8 @@ Important modules:
 | `wizard/confirmation.py` | `confirmation_block` and the confirm step |
 | `wizard/registry.py` | the ordered `STEPS` literal (order is question order), `STEP_BY_ID`, `_reset_from`, and the steps that rewind the registry (edit target, brief carry) |
 | `wizard/engine.py` | public API — `init_state`, `next_prompt`, `submit`, progress / simulation, host interaction payloads |
-| `wizard/render.py` | `render_args`, `render_role_args`, `wizard_outcome` |
+| `wizard/render.py` | `render_args`, `render_role_args`, and the stage-intent helpers |
+| `wizard/outcome.py` | `wizard_outcome` — assembles the run argv, confirmation screen, and persistence actions from an approved `WizardState` (extracted from `render.py`) |
 | `wizard/cli.py`, `wizard/__main__.py` | `okstra wizard` argparse entrypoint (`main`); `python3 -m okstra_ctl.wizard` |
 | `wizard_stage_intent.py` | stage-related intent projection of the `okstra-run` wizard output — normalizes whole-task (`__whole_task__`) vs single/multi stage selection into render-args (`resolve_wizard_stage_intent`) |
 | `index.py`, `jsonl.py`, `reconcile.py`, `listing.py`, `backfill.py` | `~/.okstra` run index and history operations — `record_start` (index.py) writes a run's start; the end is closed either by `settle_run_row` (reconcile.py, records a verdict the caller already knows — used by `validate-run.py`) or by `reconcile_home` (infers one from disk — used by `run._reconcile_prior_runs` as the backstop for runs that died before validation) |
@@ -392,7 +395,7 @@ Project resolver and read-only state helpers:
 
 Token/cost accounting:
 
-- provider adapters: `claude.py`, `codex.py`, `antigravity.py`, `grok.py` (`grok.py` reads the Grok Build session docs under `~/.grok/sessions/<percent-encoded-cwd>/`, taking cumulative tokens from the last `params.update.usage.modelUsage` snapshot in `updates.jsonl`)
+- provider adapters: `claude.py`, `codex.py`, `antigravity.py`, `grok.py`, `kimi.py`, `zai/adapter.py` (`grok.py` reads the Grok Build session docs under `~/.grok/sessions/<percent-encoded-cwd>/`, taking cumulative tokens from the last `params.update.usage.modelUsage` snapshot in `updates.jsonl`; `zai/adapter.py` wraps the Claude Code executor for GLM workers — reads `ZAI_API_KEY` from the process env or the current user's `~/.env`, runs each child against `https://api.z.ai/api/anthropic` with `--setting-sources ""`, attests the served model only from response `message.model`, and prices usage at Z.ai's public API rates for `glm-5.3` / `glm-5.3-flash`)
 - aggregation: `collect.py`, `blocks.py`, `jsonl_io.py`, `paths.py`
 - incremental scan cache: `cursor.py` (`$OKSTRA_HOME/cache/token-usage/` byte cursor + usage event extracts; bypass with `--no-cache`)
 - pricing: `pricing.py`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.201.2",
+  "version": "0.201.3",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.201.2",
-  "builtAt": "2026-09-13T23:51:12.747Z",
+  "package": "0.201.3",
+  "builtAt": "2026-09-14T12:27:48.872Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -343,6 +343,8 @@ For `improvement-discovery`, Lead records `## Primary Pass Assignments` in the P
 
 ### Phase 4 / Phase 5 — Dispatch, await, and error-log recording
 
+Before redispatch, inspect the invocation's last attempt in the run manifest. A running attempt is awaited; only `failed-no-mutation` can append another attempt within its retry budget. Other terminal states retain their original result and audit. For a legacy implementer rejected solely by `declared out-of-plan path did not change`, `okstra team dispatch` prepares a separate evidence-recovery invocation with the same assignment and model and distinct prompt/result paths. Collect that recovery result, then continue the selected independent verifier. Do not replay completed implementation or ask the user to reauthorize unchanged scope. For other terminal failures, use `okstra agent-prompt materialize` with a new `--invocation-id` and distinct `--prompt`/`--result` paths for the bounded verified defect or missing evidence. These retry restrictions are enforced by `dispatch_core._next_attempt` and `execution_manifest._validate_next_attempt`.
+
 For each selected worker assignment, persist the exact prompt history, emit the per-worker Phase 4 checkpoint, and call `dispatch_worker(assignment, promptPath)` through the selected adapter — the dispatch hands the worker the persisted prompt's path, never a re-inlined copy of its body. Then call `await_workers(handles)`. A dispatch acknowledgement or process/pane creation is never completion: verify the terminal status, Result Path, and worker-results audit path required by `team-contract` before emitting the Phase 5 collection checkpoint.
 
 Retries and convergence re-verification always call `redispatch_worker` to create a fresh one-shot session. Never reuse a worker conversation or switch adapters/providers to hide a failed assignment.
@@ -357,7 +359,7 @@ The launch prompt's `## Run Logs (error-log wiring)` section gives Lead the reso
 
 Workers are contractually required to extract this line and abort with `<WORKER>_ERRORS_PATH_MISSING` if it is absent (see each worker definition's "Path extraction (BLOCKING)" block). A worker records its tool failure through the typed `okstra error-log append-observed` form in that contract; it does not write an intermediate JSON file.
 
-After each worker terminates, BEFORE classifying its terminal status, verify the canonical result file exists at the absolute path resolved from the `**Result Path:**` header. If it is absent — or the deterministic provider process returned `CODEX_RESULT_MISSING` / `ANTIGRAVITY_RESULT_MISSING` — re-dispatch the SAME worker once with the byte-identical prompt. Only after the second attempt also misses may the role be classified `error` with `--message "result-missing after 1 retry"`. Full rules: [team-contract](./team-contract.md) "Lead Redispatch Policy on Result-Missing".
+After each worker terminates, verify the canonical result file at `**Result Path:**` and inspect the recorded mutation status. A missing result permits the same worker/prompt retry only for `failed-no-mutation` within its retry budget. A terminal state with changes or unresolved attribution requires a separate bounded corrective invocation, preserving existing work and evidence. Full rules: [team-contract](./team-contract.md) "Lead Redispatch Policy on Result-Missing".
 
 `--agent`, `--agent-role`, and `--error-type` are **closed enums**, not free-form labels — the role names used elsewhere in these contracts (`Codex worker`, `Claude worker`) are rejected. Use exactly:
 
@@ -568,3 +570,13 @@ The run-level error log lives at `<runDir>/logs/errors-<task-type>-<seq>.jsonl`.
 | Re-sending a finding absent from the persisted round plan | Dispatch exactly the engine-returned `findingIds`; see [convergence](./convergence.md) "Re-verification Dispatch" |
 | Aggregating a `timeout`/`error` reverify dispatch as `DISAGREE` | Put the terminal outcome in round results; `apply-round` records `verification-error`. See [convergence](./convergence.md) "Worker failure handling in reverify" |
 | Bypassing `report-finalize` and running its Phase 7 steps manually | Run `okstra report-finalize ...`; it owns token substitution and the remaining persistence order. |
+
+## Recoverable completion discrepancies
+
+Treat `plannedPaths` as an expected change inventory, not an exhaustive authorization list. `ExecutionMutationAudit.compare` enforces write authority and emits plan discrepancies as warnings; `dispatch_state.missing_completion_paths` checks required result availability and usability. Collect usable results with warnings and pass the observed changes and unresolved evidence to independent verification before declaring task completion.
+
+Preserve original results and attempt identities when correcting declaration formatting, missing rationale, or required artifacts. Continue the smallest affected repair within the approved objectives. Do not restart implementation or request renewed permission solely for a plan-path mismatch. If a required artifact is unusable, repair that artifact and keep only its dependent steps waiting. If the same repair produces no new evidence, report the unresolved requirement and resume point instead of repeating the whole implementation.
+
+Ask for user judgment only when the proposed work changes approved objectives or acceptance conditions, crosses an explicit authority boundary, or adds an unapproved external action. A warning does not waive read-only roles, protected paths, independent verification, or final acceptance checks. Never convert an old closed failed attempt into success by overwriting its audit; use a recorded recovery with independent evidence.
+
+For a closed attempt whose only failure was a declaration discrepancy, preserve that attempt and its original result. Use the existing `agent-prompt materialize` and dispatch workflow to create a bounded evidence-recovery invocation in the same run, with a distinct result path and explicit references to the original invocation, result, and audit. Ask it to reconcile the declaration and required artifacts against current evidence, not repeat completed implementation. Then dispatch the selected independent verifiers against the current source and artifacts. Adopt the new verified result through normal result collection; retain the original failure as history. Do not use this route to bypass a real authority violation or unresolved code defect.

package/runtime/prompts/lead/team-contract.md

@@ -167,6 +167,8 @@ Branch on the exit code, not the JSON: without `--wait`, `0` = every probe healt
 
 ## Lead Redispatch Policy on Result-Missing
 
+For V2 calls, check the recorded attempt before applying any retry below. Only `failed-no-mutation` may append an attempt within its budget. Await an unfinished attempt. Preserve other terminal attempts and use a separate bounded corrective invocation with the same assignment/model and distinct prompt/result paths; do not replay implementation that already changed source or artifacts. `dispatch_core._next_attempt` and `execution_manifest._validate_next_attempt` enforce this restriction. A legacy declaration-only implementer rejection is routed by `okstra team dispatch` to evidence recovery before independent verification.
+
 After each worker attempt returns (regardless of role), Lead MUST verify the canonical result file exists at the absolute path resolved from the `**Result Path:**` anchor header (against `**Project Root:**`). The check is identical for host-native workers and deterministic CLI processes.
 
 **Triggers (any of):**

package/runtime/prompts/profiles/_implementation-executor.md

@@ -92,8 +92,8 @@ template's check; that template is gone.
 
 ## Allowed actions during the run
 
-- **Edit / Write on approved project source files**: scope is bounded first by the shared Resource boundary, then by the approved plan's file list. Editing files outside the plan's list is permitted only when strictly needed to satisfy a step, and MUST be recorded in your worker result's `Out-of-plan edits` block with rationale.
-  - **The block's shape is fixed, because a machine reads it (BLOCKING).** Write a `## Out-of-plan edits` heading, then one `- ` line per file whose first backticked token is the repository-relative path, followed by the rationale: ``- `src/http/router.ts` — the plan's step 3 needs a route the plan did not list``. Nothing else on that line is read. With no such edits, write the heading and the single line `- (none)`. The write audit compares the stage's changed files against the plan's paths union this block: a file edited outside the plan and absent here settles the run as a contract violation, and a path this parser cannot find is the same as one you never declared.
+- **Edit / Write on approved project source files**: scope is bounded by the shared Resource boundary and the approved objectives and acceptance conditions; the plan's file list predicts expected changes. Editing files outside the plan's list is permitted only when strictly needed to satisfy a step, and MUST be recorded in your worker result's `Out-of-plan edits` block with rationale.
+  - Use `## Out-of-plan edits` with a backticked path and rationale per item when convenient. The dispatcher reads this shape as supporting evidence, not write authorization. `ExecutionMutationAudit.compare` records observed changes independently and treats missing declarations or declaration/diff mismatches as warnings. Do not rerun implementation merely to repair this block; reconcile the explanation while preserving the original result. Required result usability is checked by `dispatch_state.missing_completion_paths`; source-readonly, protected paths, assigned roots and Git authority remain enforced by the write audit.
 - read-only inspection commands: `git status`, `git diff`, `git log`, `grep`, `rg`, `find`, `cat`, `ls`, file Read tools
 - build, lint, type-check, and test commands (`npm test`, `pytest`, `go build`, `cargo test`, `bash -n`, etc.)
 - **local git operations only**: `git add`, `git commit`. Prefer small commits keyed to plan steps.

package/runtime/prompts/profiles/_implementation-verifier.md

@@ -256,3 +256,9 @@ If every verifier present in the resolved roster ends with a non-result terminal
 ## Executor completion self-check (not this role's gate)
 
 - The executor's `Implementation self-check` gate (`prompts/profiles/_implementation-self-check.md`) belongs to the worker that owns the diff, and its body is deliberately not delivered here: it asks for in-place fixes and break-then-restore mutation checks, every one of which this verifier is forbidden to perform. Do not re-derive its items or claim to have run it. What grades the same defects from this side is the blocking taxonomy above, applied to the diff you re-read yourself. When the executor's `Coverage:` / `Self-check coverage:` lines are among the inputs this prompt enumerates, a missing line or one whose file list does not reconcile with the diff is a blocking finding — the gate was skipped or partially run.
+
+## Plan differences and completion recovery
+
+Review the observed source and artifact changes, including paths absent from the planned file list or the executor's declaration. Link necessary changes to the approved objectives and acceptance conditions. A file-list discrepancy, declaration spelling, or a restored file is not an implementation failure by itself. Record missing rationale as evidence to reconcile. Reject unrelated scope expansion or weakened acceptance checks on their substantive impact, with the affected requirement and evidence.
+
+When the audit reports unavailable historical artifact coverage, verify the current artifact content and its acceptance checks independently. Do not reconstruct missing before-state from the current file or claim that a source-only diff proves an artifact did not change. Preserve the original result and qualify any unverified attribution. Required independent validation remains enforced by `validate-run.py::_validate_verifier_reran_independently` and the existing conformance gates.

package/runtime/python/okstra_ctl/agent/evidence_recovery.py

@@ -0,0 +1,78 @@
+"""종결된 호출의 결과를 보존하는 증거 보완 프롬프트 발행."""
+from __future__ import annotations
+
+from pathlib import Path
+
+from .invocation import (
+    AgentInstruction, AgentInstructionSource, AgentInvocationError,
+    AgentInvocationRequest, PreparedAgentInvocation, _extract_anchor_lines,
+    _split_prompt, agent_model_assignment_from_payload, invocation_metadata_identity,
+    prepare_agent_invocation, verify_agent_invocation,
+)
+from ..json_boundary import load_owned_object
+from ..worker_artifact_paths import audit_sidecar_rel
+
+
+def prepare_evidence_recovery(
+    metadata_path: Path, *, project_root: Path, result_path: Path,
+    source_attempt: int,
+) -> tuple[PreparedAgentInvocation, Path]:
+    """원래 모델·역할을 유지하고 새 결과 경로에 제한된 증거 보완을 발행한다."""
+    metadata = load_owned_object(metadata_path, artifact="recovery source metadata")
+    source = metadata["contractSource"]
+    manifest = project_root / source["runManifestPath"]
+    errors = verify_agent_invocation(
+        metadata_path, project_root=project_root, expected_run_manifest_path=manifest,
+    )
+    if errors:
+        raise AgentInvocationError("invalid recovery source: " + "; ".join(errors))
+    identity = invocation_metadata_identity(metadata)
+    if identity is None or not result_path.is_file():
+        raise AgentInvocationError("evidence recovery requires v2 identity and an existing result")
+    suffix = f"-evidence-recovery-{source_attempt}"
+    invocation_id = identity.invocation_ref + suffix
+    old_prompt = project_root / metadata["prompt"]["path"]
+    prompt = old_prompt.with_name(old_prompt.stem + suffix + old_prompt.suffix)
+    result = result_path.with_name(result_path.name.replace("-worker-", suffix + "-worker-", 1))
+    prefix, _ = _split_prompt(old_prompt.read_text(encoding="utf-8"))
+    replacements = {
+        "**Prompt History Path:**": str(prompt.relative_to(project_root)),
+        "Assigned worker prompt history path:": str(prompt),
+        "**Result Path:**": str(result.relative_to(project_root)),
+        "**Worker Result Path:**": str(result.relative_to(project_root)),
+        "**Audit sidecar path:**": audit_sidecar_rel(str(result)),
+    }
+    anchors = tuple(next((f"{key} {value}" for key, value in replacements.items()
+                          if line.startswith(key)), line) for line in _extract_anchor_lines(prefix))
+    body = _recovery_instructions(identity.invocation_ref, source_attempt, result_path, old_prompt)
+    prepared = prepare_agent_invocation(AgentInvocationRequest(
+        invocation_id=invocation_id, worker_id=None, audience=metadata["audience"],
+        assignment_ref=metadata["assignmentRef"], purpose=None,
+        assignment=agent_model_assignment_from_payload(metadata["modelAssignment"]),
+        instruction=AgentInstruction(anchor_lines=anchors, body=body, source_paths=(
+            AgentInstructionSource("project", str(result_path.relative_to(project_root))),)),
+        project_root=project_root, run_manifest_path=manifest,
+        duty_root=project_root / source["dutyRootPath"], prompt_path=prompt,
+        metadata_path=prompt.with_name(prompt.name + ".meta.json"),
+        dispatch_kind=metadata["dispatchKind"], participant_ref=identity.participant_ref,
+        role_execution_ref=identity.role_execution_ref, duty_id=identity.duty_id,
+        invocation_ref=invocation_id, attempt=1,
+    ))
+    return prepared, result
+
+
+def _recovery_instructions(invocation_ref: str, source_attempt: int, result_path: Path, old_prompt: Path) -> str:
+    """완료된 구현을 재실행하지 않는 보완 범위를 전달한다."""
+    return (
+        "## Evidence recovery scope\n\n"
+        f"Original invocation: {invocation_ref}; attempt: {source_attempt}.\n"
+        f"Read and preserve the original result: {result_path}.\n"
+        f"Read the original audit: {old_prompt}.mutation-audit.json.\n"
+        "The prior attempt failed only on a declaration discrepancy. Preserve existing source and QA work. "
+        "Do not repeat completed implementation steps or edit production source. Reconcile the declaration "
+        "and required evidence against current artifacts; retain historical validation as historical. "
+        "Do not invent a missing before-state or claim independent verification. If a substantive defect "
+        "or authority problem is found, report it for the lead instead of expanding this repair. "
+        "Write a new completion result in the original role's required format, citing the original result "
+        "and clearly separating recovered evidence from remaining independent checks.\n"
+    )

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -13,6 +13,7 @@ from typing import Any, Mapping, Sequence
 
 from .dispatch_state import abandon_agent_dispatch_attempt
 from .agent.invocation import invocation_input_digest
+from .agent.evidence_recovery import prepare_evidence_recovery
 from .dispatch_state import (
     CompletedWithoutResultError,
     BACKEND_CLI_WRAPPER,
@@ -71,7 +72,7 @@ from .domain.worker_runtime import (
     WorkerSpawnRequest,
 )
 from .ports.worker_runtime import WorkerRuntimePort
-from .execution_identity import Attempt, Invocation, RoleExecution, model_spec_digest
+from .execution_identity import Attempt, ExecutionManifest, Invocation, RoleExecution
 from .execution_manifest import (
     ExecutionManifestError,
     finish_attempt_mutation,
@@ -153,7 +154,6 @@ _WRAPPER_LOG_TAIL_BYTES = 800
 class RevalidatedBinding:
     role_execution_ref: str
     binding: HostModelBinding
-    model_spec_digest: str
 
 
 def revalidate_role_execution(
@@ -165,7 +165,6 @@ def revalidate_role_execution(
     if (
         role_execution.model_ref is None
         or role_execution.binding is None
-        or role_execution.model_spec_digest is None
     ):
         raise DispatchError("model binding changed: role execution is unbound")
     try:
@@ -188,18 +187,16 @@ def revalidate_role_execution(
         binding = assignment.binding
         if binding is None:
             raise AssignmentResolutionError("selected model has no worker binding")
-        digest = model_spec_digest(pool.resolve(role_execution.model_ref), binding)
     except (ValueError, RuntimeError) as exc:
         raise DispatchError(f"model binding changed: {exc}") from exc
     identity_matches = (
         assignment.provider_id == role_execution.provider
         and assignment.model_id == role_execution.model_id
         and binding == role_execution.binding
-        and digest == role_execution.model_spec_digest
     )
     if not identity_matches:
         raise DispatchError("model binding changed for selected role execution")
-    return RevalidatedBinding(role_execution.role_execution_ref, binding, digest)
+    return RevalidatedBinding(role_execution.role_execution_ref, binding)
 
 
 def dispatch_revalidated_role_execution(
@@ -407,6 +404,9 @@ def build_dispatch_plan(
 
 
 def dispatch_plan(plan: DispatchPlan, *, wait: bool = True) -> int:
+    plan = _recover_declaration_failures(plan)
+    if not plan.jobs:
+        return 0
     plan = _ensure_runtime_chain(plan)
     _validate_report_writer_isolation(plan.jobs)
     _validate_implementation_phase_order(plan.jobs)
@@ -508,6 +508,9 @@ def dispatch_cli_wrapper_plan(plan: DispatchPlan) -> int:
     """Start one dependency-free CLI batch before collecting any worker."""
     if any(job.backend != BACKEND_CLI_WRAPPER for job in plan.jobs):
         raise DispatchError("concurrent CLI dispatch requires cli-wrapper jobs only")
+    plan = _recover_declaration_failures(plan)
+    if not plan.jobs:
+        return 0
     plan = _ensure_runtime_chain(plan)
     _validate_report_writer_isolation(plan.jobs)
     _validate_implementation_phase_order(plan.jobs)
@@ -1617,6 +1620,74 @@ def _spawn_cli_job_nonblocking(
     )
 
 
+def _recover_declaration_failures(plan: DispatchPlan) -> DispatchPlan:
+    """선언만으로 거부된 구현은 같은 호출을 재시도하지 않고 증거 보완으로 연결한다."""
+    if not any(job.has_execution_identity for job in plan.jobs):
+        return plan
+    manifest = read_execution_manifest(plan.manifest_path)
+    jobs: list[WorkerJob] = []
+    for job in plan.jobs:
+        source_attempt = _declaration_recovery_attempt(manifest, job)
+        if source_attempt is None:
+            jobs.append(job)
+            continue
+        recovered_ref = f"{job.invocation_ref}-evidence-recovery-{source_attempt}"
+        recovered = [row for row in manifest.attempts if row.invocation_ref == recovered_ref]
+        if recovered and max(recovered, key=lambda row: row.attempt).status == "ok":
+            continue
+        try:
+            prepared, result = prepare_evidence_recovery(
+                job.prompt_metadata_path, project_root=plan.project_root,
+                result_path=job.result_path, source_attempt=source_attempt,
+            )
+        except AgentInvocationError as exc:
+            raise DispatchError(f"evidence recovery could not be prepared: {exc}") from exc
+        jobs.append(replace(
+            job, invocation_id=prepared.invocation_id, invocation_ref=prepared.invocation_ref,
+            attempt=1, prompt_path=prepared.prompt_path, prompt_metadata_path=prepared.metadata_path,
+            result_path=result, worker_result_path=result, completion_paths=(result,),
+            result_aliases=(), instruction_digest=prepared.instruction_digest,
+            prompt_digest=prepared.prompt_digest,
+        ))
+        if not recovered:
+            _append_event(plan, "worker-evidence-recovery-prepared", {
+                "sourceInvocationRef": job.invocation_ref, "sourceAttempt": source_attempt,
+                "invocationRef": prepared.invocation_ref, "resultPath": str(result),
+                "modelExecutionValue": job.model_execution_value,
+            })
+    return replace(plan, jobs=tuple(jobs))
+
+
+def _declaration_recovery_attempt(manifest: ExecutionManifest, job: WorkerJob) -> int | None:
+    """선언 오류만 있는 종결 시도를 고르고 이미 시작한 후속 작업은 보존한다."""
+    prior = [row for row in manifest.attempts if row.invocation_ref == job.invocation_ref]
+    last = max(prior, key=lambda row: row.attempt) if prior else None
+    summary = last.change_summary if last else {}
+    if not (
+        job.audience == "implementation-executor" and last is not None
+        and last.finished_at is not None and last.status == "contract-failed-unattributed"
+        and summary.get("sourceChanged") is False and summary.get("gitChanged") is False
+        and summary.get("violations") == ["declared out-of-plan path did not change"]
+        and "-evidence-recovery-" not in job.invocation_ref
+    ):
+        return None
+    recovered_ref = f"{job.invocation_ref}-evidence-recovery-{last.attempt}"
+    later_refs = {
+        row.invocation_ref for row in manifest.invocations
+        if row.role_execution_ref == job.role_execution_ref
+        and row.invocation_ref not in (job.invocation_ref, recovered_ref)
+    }
+    later = [row for row in manifest.attempts if row.invocation_ref in later_refs
+             and row.started_at >= last.finished_at]
+    if later:
+        raise DispatchError(
+            "a subsequent invocation already exists for this role; collect or await "
+            f"{', '.join(sorted({row.invocation_ref for row in later}))} instead of redispatching "
+            f"the historical failure {job.invocation_ref}"
+        )
+    return last.attempt
+
+
 def _next_attempt(plan: DispatchPlan, job: WorkerJob) -> int:
     """이 invocation 이 다음에 청구할 attempt 번호.
 
@@ -1630,12 +1701,23 @@ def _next_attempt(plan: DispatchPlan, job: WorkerJob) -> int:
         return job.attempt
     manifest = read_execution_manifest(plan.manifest_path)
     prior = [
-        row.attempt for row in manifest.attempts
+        row for row in manifest.attempts
         if row.invocation_ref == job.invocation_ref
     ]
     if not prior:
         return job.attempt
-    spent = max(prior)
+    last = max(prior, key=lambda row: row.attempt)
+    if last.finished_at is None:
+        raise DispatchError(f"invocation is still running: {job.invocation_ref}; use okstra team await")
+    if last.status != "failed-no-mutation":
+        raise DispatchError(
+            f"invocation {job.invocation_ref} attempt {last.attempt} is already closed as {last.status}; "
+            "preserve its result and audit. Use okstra agent-prompt materialize with a new "
+            "--invocation-id and distinct --prompt/--result paths in the same run, retaining "
+            "--assignment-ref and the selected model. Scope the corrective instruction to "
+            "missing evidence or the verified defect; do not append another attempt or replay completed implementation."
+        )
+    spent = last.attempt
     if spent >= MAX_WORKER_ATTEMPTS:
         raise DispatchError(
             f"worker retry budget is spent: {job.invocation_ref} used "
@@ -2309,15 +2391,7 @@ def _audit_attempt(
 
 
 def _declared_out_of_plan_paths(result_path: Path) -> tuple[str, ...]:
-    """워커가 자기 결과의 `Out-of-plan edits` 블록에 선언한 경로.
-
-    감사는 워커가 끝나는 시점에 돈다. 그때 디스크에 있는 것은 워커 결과
-    마크다운뿐이고, `implementation.outOfPlanEdits` 는 리드가 나중에 쓰는 최종
-    리포트의 필드다. JSON 형태만 읽었기 때문에 executor 의 선언이 한 번도 보이지
-    않았고, 계약대로 선언한 편집까지 미허가 변경으로 집계됐다. 블록의 형태는 이
-    판독기를 위해 `_implementation-executor.md` 가 고정한다 — `- ` 줄마다 첫 백틱
-    토큰이 경로다.
-    """
+    """지원하는 결과 표기에서 참고 선언을 읽는다. 권한 판정에는 사용하지 않는다."""
     if not result_path.is_file() or result_path.suffix != ".md":
         return ()
     try:

package/runtime/python/okstra_ctl/execution_identity.py

@@ -283,10 +283,17 @@ def model_spec_digest(
     write_policy_digest: str | None = None,
     served_model_attestation: ServedModelAttestation | None = None,
 ) -> str:
-    """Digest preparation facts; invocation policy and observations are excluded."""
+    """실행 준비 사실을 해시하며 요금·호출 정책·관측 결과는 제외한다."""
     del write_policy_digest, served_model_attestation
+    specification = _canonical_model_spec(model_spec)
+    # 요금 미설정 실행의 기존 해시와 동일한 표현을 유지한다.
+    specification["pricing"] = None
+    return _digest_model_binding(specification, binding)
+
+
+def _digest_model_binding(specification: Mapping[str, Any], binding: HostModelBinding) -> str:
     canonical = {
-        "modelSpec": _canonical_model_spec(model_spec),
+        "modelSpec": specification,
         "binding": _binding_payload(binding),
     }
     encoded = json.dumps(

package/runtime/python/okstra_ctl/execution_manifest.py

@@ -559,7 +559,7 @@ def _validate_role_identity(
     role = _required_text(row, "role")
     provider = _required_text(row, "provider")
     model_id = _required_text(row, "modelId")
-    unknown = row.get("modelRef") is None or row.get("modelSpecDigest") is None
+    unknown = row.get("modelRef") is None
     if unknown and not _is_current_session_unknown_leader(payload, row, participant):
         raise ExecutionManifestError("unknown model is allowed only for current-session leader")
     if not unknown and row.get("binding") is None:
@@ -901,7 +901,11 @@ def _validate_next_attempt(manifest: ExecutionManifest, row: Attempt) -> None:
         raise ExecutionManifestError("previous attempt is not terminal")
     if last.status != "failed-no-mutation":
         raise ExecutionManifestError(
-            "invocation cannot append another attempt after a terminal mutation"
+            "invocation cannot append another attempt after a terminal mutation; "
+            "preserve the existing result and audit. Materialize a new corrective invocation "
+            "with okstra agent-prompt materialize, a new --invocation-id and distinct "
+            "--prompt/--result paths, retaining the same assignment and selected model. "
+            "Do not replay completed implementation."
         )
 
 

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -44,6 +44,7 @@ class MutationSnapshot:
     # 스냅샷이 아직 실행 중인 디스패치에 남아 있고, 그것을 못 읽으면 그 워커가
     # 통째로 error 가 된다. 두 루트가 같으면 None.
     artifact_git_head: str | None = None
+    artifact_observation_roots: tuple[str, ...] = ()
 
     def to_payload(self) -> dict[str, Any]:
         return {
@@ -57,6 +58,7 @@ class MutationSnapshot:
             "digest": self.digest,
             "orchestratorPaths": list(self.orchestrator_paths),
             "artifactGitHead": self.artifact_git_head,
+            "artifactObservationRoots": list(self.artifact_observation_roots),
         }
 
     @classmethod
@@ -75,6 +77,7 @@ class MutationSnapshot:
                 str(payload["artifactGitHead"])
                 if payload.get("artifactGitHead") else None
             ),
+            artifact_observation_roots=tuple(payload.get("artifactObservationRoots", ())),
         )
         expected = _snapshot_digest(
             snapshot.root,
@@ -85,6 +88,7 @@ class MutationSnapshot:
             snapshot.scratch_digests,
             snapshot.git_projection,
             snapshot.orchestrator_paths,
+            snapshot.artifact_observation_roots,
         )
         if snapshot.digest != expected:
             raise MutationAuditError("mutation snapshot digest does not match payload")
@@ -115,6 +119,9 @@ class MutationAuditResult:
     # 에러 원장(contract-violation)이 따로 잡는다.
     untracked_artifact_paths: tuple[str, ...] = ()
     warnings: tuple[str, ...] = ()
+    changed_artifact_paths: tuple[str, ...] = ()
+    declared_out_of_plan_paths: tuple[str, ...] = ()
+    unobserved_artifact_paths: tuple[str, ...] = ()
 
     def change_summary(self) -> dict[str, Any]:
         return {
@@ -128,6 +135,9 @@ class MutationAuditResult:
             "retryAllowed": self.retry_allowed,
             "violations": list(self.violations),
             "warnings": list(self.warnings),
+            "changedArtifactPaths": list(self.changed_artifact_paths),
+            "declaredOutOfPlanPaths": list(self.declared_out_of_plan_paths),
+            "unobservedArtifactPaths": list(self.unobserved_artifact_paths),
             "beforeDigest": self.before_digest,
             "afterDigest": self.after_digest,
         }
@@ -147,12 +157,14 @@ class ExecutionMutationAudit:
         generated = _generated_paths(rows)
         file_digests = source_content_snapshot(root, generated)
         artifact_digests = (
-            file_digests
+            dict(file_digests)
             if artifact_root == root
             else _content_snapshot(
                 artifact_root, generated | _non_source_paths(artifact_root)
             )
         )
+        observation_roots = _artifact_observation_roots(rows)
+        artifact_digests.update(_observed_artifact_contents(artifact_root, observation_roots))
         scratch_digests = _scratch_snapshot(rows)
         git_projection = _git_projection(root)
         orchestrator = tuple(
@@ -168,6 +180,7 @@ class ExecutionMutationAudit:
             scratch_digests,
             git_projection,
             orchestrator,
+            observation_roots,
         )
         return MutationSnapshot(
             root=root,
@@ -182,6 +195,7 @@ class ExecutionMutationAudit:
             artifact_git_head=(
                 None if artifact_root == root else _git_head(artifact_root)
             ),
+            artifact_observation_roots=observation_roots,
         )
 
     def compare(
@@ -203,6 +217,13 @@ class ExecutionMutationAudit:
         artifact_changed = _changed_keys(
             before.artifact_digests, after.artifact_digests
         )
+        unobserved = {
+            path for path in artifact_changed
+            if path not in before.artifact_digests
+            and any(_is_within(path, root) for root in after.artifact_observation_roots)
+            and not any(_is_within(path, root) for root in before.artifact_observation_roots)
+        }
+        artifact_changed -= unobserved
         scratch_changed = _changed_keys(
             before.scratch_digests, after.scratch_digests
         )
@@ -218,22 +239,27 @@ class ExecutionMutationAudit:
             after,
             rows,
             source_changes,
-            out_of_plan_edits,
         )
         artifact_failures, untracked_artifact_changes, switched = (
             _artifact_policy_failures(before, rows, artifact_changed, after=after)
         )
         violations.extend(artifact_failures)
+        worker_artifact_changes = {
+            path for path in artifact_changed
+            if path not in untracked_artifact_changes and path not in switched
+            and not any(_is_relative_to(before.artifact_root / path, Path(item))
+                        for item in before.orchestrator_paths)
+        }
         status = _terminal_status(
             rows,
-            source_changed=bool(source_changes),
+            source_changed=bool(source_changes or worker_artifact_changes),
             git_changed=git_changed,
             attempt_succeeded=attempt_succeeded,
             result_present=result_present,
             violations=violations,
         )
         retry_allowed = _retry_allowed(
-            status, bool(source_changes), git_changed, bool(scratch_changed)
+            status, bool(source_changes or worker_artifact_changes), git_changed, bool(scratch_changed)
         )
         return MutationAuditResult(
             status=status,
@@ -249,10 +275,84 @@ class ExecutionMutationAudit:
             git_projection=after.git_projection,
             untracked_artifact_paths=tuple(sorted(untracked_artifact_changes)),
             warnings=_audit_warnings(untracked_artifact_changes)
-            + _branch_switch_warnings(before, after, switched),
+            + _branch_switch_warnings(before, after, switched)
+            + _plan_change_warnings(rows, source_changes | untracked_changes,
+                                    artifact_changed, out_of_plan_edits, unobserved),
+            changed_artifact_paths=tuple(sorted(artifact_changed)),
+            declared_out_of_plan_paths=tuple(out_of_plan_edits),
+            unobserved_artifact_paths=tuple(sorted(unobserved)),
         )
 
 
+def _observed_artifact_contents(root: Path, observation_roots: Sequence[str]) -> dict[str, str]:
+    """관측 경계의 링크 자체를 기록하고 링크 목적지는 탐색하지 않는다."""
+    artifact_digests: dict[str, str] = {}
+    for relative in observation_roots:
+        target = root / relative
+        link = next((parent for parent in (*target.parents, target)
+                     if parent != root and _is_relative_to(parent, root)
+                     and parent.is_symlink()), None)
+        if link is not None:
+            artifact_digests[link.relative_to(root).as_posix()] = _path_digest(link)
+            continue
+        if target.is_symlink() or target.is_file():
+            artifact_digests[relative] = _path_digest(target)
+        else:
+            artifact_digests.update({
+                f"{relative}/{key}": value
+                for key, value in _content_snapshot(target, frozenset()).items()
+            })
+    return artifact_digests
+
+
+def _artifact_observation_roots(policies: Sequence[WritePolicy]) -> tuple[str, ...]:
+    """현재 배정의 QA와 실행 산출물은 Git 무시 규칙과 무관하게 관측한다."""
+    roots: set[str] = set()
+    for path in _allowed_artifact_paths(policies):
+        parts = Path(path).parts
+        if len(parts) < 5 or parts[:2] != (".okstra", "tasks"):
+            continue
+        if parts[4] == "qa":
+            roots.add(Path(*parts[:5]).as_posix())
+        elif parts[4] == "runs":
+            boundary = next((i for i, part in enumerate(parts)
+                             if part in {"worker-results", "prompts"}), len(parts) - 1)
+            roots.add(Path(*parts[:boundary]).as_posix())
+        else:
+            roots.add(path)
+    return tuple(sorted(roots))
+
+
+def _plan_change_warnings(
+    policies: Sequence[WritePolicy], source_changes: set[str],
+    artifact_changes: set[str], declared: Sequence[str], unobserved: set[str],
+) -> tuple[str, ...]:
+    """예상 목록과의 차이는 검토 자료이며 쓰기 권한 위반이 아니다."""
+    warnings: list[str] = []
+    for policy in policies:
+        if policy.source_mode != "project-mutation":
+            continue
+        planned = policy.source_policy.get("plannedPaths", ())
+        extra = sorted(path for path in source_changes
+                       if not any(_is_within(path, item) for item in planned))
+        if extra:
+            warnings.append("source changes outside expected plan; review scope: " + ", ".join(extra))
+    observed = {Path(str(policy.source_policy["allowedRoot"])) / path
+                for policy in policies for path in source_changes}
+    observed.update(Path(str(policy.artifact_policy["allowedRoot"])) / path
+                    for policy in policies for path in artifact_changes)
+    roots = {Path(str(policy.source_policy["allowedRoot"])) for policy in policies}
+    roots.update(Path(str(policy.artifact_policy["allowedRoot"])) for policy in policies)
+    missing = sorted(path for path in declared
+                     if not any(root / path in observed for root in roots))
+    if missing:
+        warnings.append("declared changes not observed; reconcile evidence: " + ", ".join(missing))
+    if unobserved:
+        warnings.append(f"artifact baseline coverage unavailable ({len(unobserved)} paths); "
+                        "independently verify current artifacts; see unobservedArtifactPaths")
+    return tuple(warnings)
+
+
 def _audit_warnings(untracked_artifact_changes: set[str]) -> tuple[str, ...]:
     if not untracked_artifact_changes:
         return ()
@@ -595,6 +695,7 @@ def _snapshot_digest(
     scratch: Mapping[str, str],
     git_projection: Mapping[str, Any],
     orchestrator_paths: Sequence[str],
+    observation_roots: Sequence[str] = (),
 ) -> str:
     encoded = json.dumps(
         {
@@ -606,6 +707,7 @@ def _snapshot_digest(
             "scratch": scratch,
             "gitProjection": git_projection,
             "orchestratorPaths": list(orchestrator_paths),
+            **({"artifactObservationRoots": list(observation_roots)} if observation_roots else {}),
         },
         sort_keys=True,
         separators=(",", ":"),
@@ -680,7 +782,7 @@ def _artifact_policy_failures(
         and not any(_is_within(path, item) for item in orchestrator)
     }
     if snapshot.artifact_root == snapshot.root:
-        return [], set(), set()
+        unauthorized = {path for path in unauthorized if _is_within(path, _OKSTRA_ARTIFACT_SUBTREE)}
     tracked = _tracked_paths(snapshot.artifact_root)
     if tracked is None:
         untracked_outside: set[str] = set()
@@ -761,7 +863,6 @@ def _policy_violations(
     after: MutationSnapshot,
     policies: tuple[WritePolicy, ...],
     source_changes: set[str],
-    out_of_plan_edits: Sequence[str],
 ) -> list[str]:
     if all(policy.source_mode == "source-readonly" for policy in policies):
         failures = ["readonly source changed"] if source_changes else []
@@ -769,8 +870,8 @@ def _policy_violations(
             failures.append("gitPolicy disabled but Git projection changed")
         return failures
     policy = next(row for row in policies if row.source_mode == "project-mutation")
-    failures = _source_policy_failures(policy, source_changes, out_of_plan_edits)
-    failures.extend(_git_policy_failures(before, after, policy, source_changes, out_of_plan_edits))
+    failures = _source_policy_failures(policy, source_changes)
+    failures.extend(_git_policy_failures(before, after, policy))
     return failures
 
 
@@ -797,37 +898,14 @@ def _stable_git_projection(snapshot: MutationSnapshot) -> dict[str, Any]:
     }
 
 
-def _path_ledger_is_unenforceable(policy: WritePolicy) -> bool:
-    """옛 계획의 미선언 목록만 면제하고, 산출물 전용 계획의 빈 소스 목록은 집행한다.
-
-    선언 여부가 저장되기 전 정책은 기존의 빈 목록 해석을 유지한다.
-    새 정책은 경로 분류 후에도 선언 여부를 보존하므로 산출물만 남은 계획이
-    임의의 소스 변경이나 커밋을 허용하지 않는다.
-    """
-    source = policy.source_policy
-    return (
-        source.get("mode") == "project-mutation"
-        and not source.get("plannedPaths")
-        and not source.get("plannedPathsDeclared", False)
-    )
-
-
 def _source_policy_failures(
     policy: WritePolicy,
     changed: set[str],
-    out_of_plan_edits: Sequence[str],
 ) -> list[str]:
-    planned = set(policy.source_policy.get("plannedPaths", ()))
-    declared = set(out_of_plan_edits)
     protected = set(policy.source_policy.get("protectedPaths", ()))
     failures: list[str] = []
-    if (
-        not _path_ledger_is_unenforceable(policy)
-        and not changed <= planned | declared
-    ):
-        failures.append("source changes exceed planned and declared out-of-plan paths")
-    if not declared <= changed:
-        failures.append("declared out-of-plan path did not change")
+    if policy.source_mode == "source-readonly" and changed:
+        failures.append("readonly source changed")
     if any(_is_within(path, item) for path in changed for item in protected):
         failures.append("protected path changed")
     return failures
@@ -837,8 +915,6 @@ def _git_policy_failures(
     before: MutationSnapshot,
     after: MutationSnapshot,
     policy: WritePolicy,
-    changed: set[str],
-    out_of_plan_edits: Sequence[str],
 ) -> list[str]:
     git = policy.git_policy
     root = before.root
@@ -857,23 +933,16 @@ def _git_policy_failures(
         failures.append("final Git index contains staged changes")
     if not _is_ancestor(root, str(git.get("expectedBaseCommit")), str(after.git_projection.get("head"))):
         failures.append("final HEAD is not a fast-forward descendant")
-    allowed = set(policy.source_policy.get("plannedPaths", ())) | set(out_of_plan_edits)
-    if _path_ledger_is_unenforceable(policy):
-        # The plan predates the declared path column, so there is no ledger
-        # anyone can be held to. Every other check above still applies; only
-        # the path comparison stands down.
-        return failures
+    protected = policy.source_policy.get("protectedPaths", ())
     if any(
-        not paths <= allowed
+        any(_is_within(path, item) for path in paths for item in protected)
         for paths in _commit_paths_by_commit(
             root,
             str(git.get("expectedBaseCommit")),
             str(after.git_projection.get("head")),
         )
     ):
-        failures.append("commit chain changed paths outside source policy")
-    if not changed <= allowed:
-        failures.append("working tree changed paths outside source policy")
+        failures.append("commit chain changed protected paths")
     return failures
 
 

package/runtime/skills/okstra-run/SKILL.md

@@ -244,6 +244,8 @@ Output: `{ok: true, outcome: {renderArgv: ["--lead-runtime", "...", ...], render
 
 `userAuthorization`, when present, preserves the confirmation prompt actually emitted by this wizard and the relayed `proceed` response. Its `--user-authorization-json` token carries that record into the run manifest; preserve it unchanged. Do not synthesize a receipt for older confirmed states. Include the translator's disclosed provider/model and report material when citing this record in host execution requests, including `report-finalize`. The record documents task scope; it does not grant host execution privileges.
 
+Before retrying a worker in an existing run, inspect its last invocation attempt: await running work; append an attempt only after `failed-no-mutation` within the retry budget. Preserve every other terminal attempt. `okstra team dispatch` routes the legacy declaration-only implementer failure to a separate same-model evidence-recovery invocation; collect its result before independent verification. Other terminal failures need `okstra agent-prompt materialize` with a new `--invocation-id`, distinct `--prompt`/`--result` paths, and unchanged assignment/model for a bounded correction. Do not restart completed implementation or request renewed approval for unchanged scope. Enforcement: `dispatch_core._next_attempt` and `execution_manifest._validate_next_attempt`.
+
 Run every `outcome.persistActions[]` entry BEFORE `render-bundle`. The only supported action is:
 
 ```json

package/runtime/validators/validate-run.py

@@ -5443,19 +5443,8 @@ def _validate_plan_body_state_rounds(
         )
 
 
-def _validate_out_of_plan_edits_are_real(data: dict, failures: list[str]) -> None:
-    """선언한 out-of-plan 편집은 실제로 바뀐 파일이어야 한다.
-
-    입력 템플릿의 §"Forbidden In This Run" 은 계획 목록 밖에서 건드린 파일을 전부
-    `Out-of-plan edits` 에 적으라고 요구한다. 그 목록이 실제 diff 와 무관하면 기록은
-    검토자에게 성실해 보이는 문자열일 뿐이다 — 실제로 바꾼 적 없는 파일이 적혀
-    있으면 나머지 행도 믿을 근거가 없다.
-
-    계획 목록 자체와의 대조(계획 밖 파일이 여기 빠졌는지)는 하지 않는다. 그러려면
-    `approvedPlanReference.planFile` 이 가리키는 다른 리포트를 열어 stage 범위까지
-    풀어야 하고, 그 경로 해소를 검증할 실물 run 이 저장소에 없다. 여기서는 리포트
-    안에서 닫히는 방향만 본다.
-    """
+def _warn_out_of_plan_edits_not_in_diff(data: dict, warnings: list[str]) -> None:
+    """소스 차이 목록은 별도 QA 산출물의 변경 여부를 증명하지 못한다."""
     implementation = data.get("implementation")
     if not isinstance(implementation, dict):
         return
@@ -5470,7 +5459,7 @@ def _validate_out_of_plan_edits_are_real(data: dict, failures: list[str]) -> Non
             continue
         target = row.get("file")
         if isinstance(target, str) and target and target not in changed:
-            failures.append(
+            warnings.append(
                 f"out-of-plan-edit: {row.get('id') or 'OOP-???'} 가 `{target}` 을 "
                 "계획 밖 편집으로 신고했지만 diffSummary 에 그 파일이 없다"
             )
@@ -9755,7 +9744,10 @@ def main() -> int:
         _validate_verifier_command_log_is_read_only(validation_data, failures)
         _validate_verifier_reran_independently(validation_data, failures)
         _validate_verifier_discrepancy_is_not_passed(validation_data, failures)
-        _validate_out_of_plan_edits_are_real(validation_data, failures)
+        declaration_warnings: list[str] = []
+        _warn_out_of_plan_edits_not_in_diff(validation_data, declaration_warnings)
+        for warning in declaration_warnings:
+            print(f"validate-run: warning: {warning}", file=sys.stderr)
     if task_type == "implementation-planning":
         _validate_plan_body_state_file(
             validation_data,