okstra 0.202.0 → 0.204.0

package/runtime/prompts/profiles/requirements-discovery.md

@@ -1,30 +1,5 @@
 # Requirements Discovery Profile
 
-```yaml
-roles:
-  - role: analyser
-    min: 2
-    recommended: 3
-    max: 5
-    duty: discovery-worker
-  - role: critic
-    min: 0
-    recommended: 1
-    max: 1
-    duty: scope-critic
-  - role: report-writer
-    min: 1
-    recommended: 1
-    max: 1
-    duty: report-writer
-  - role: verifier
-    min: 0
-    recommended: 0
-    max: 0
-    duty: reverification-worker
-    dynamic: true
-```
-
 - Purpose: classify the work request, identify missing requirement evidence, and route the task to the safest next lifecycle phase before implementation starts
 - Required workers:
   - claude

package/runtime/prompts/profiles/technical-verification.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": "1.0",
+  "id": "technical-verification",
+  "roles": [
+    {
+      "mode": "static",
+      "roleId": "analyser",
+      "dutyId": "technical-verification-worker",
+      "min": 2,
+      "recommended": 2,
+      "max": 5
+    },
+    {
+      "mode": "static",
+      "roleId": "critic",
+      "dutyId": "scope-critic",
+      "min": 0,
+      "recommended": 1,
+      "max": 1
+    },
+    {
+      "mode": "static",
+      "roleId": "report-writer",
+      "dutyId": "report-writer",
+      "min": 1,
+      "recommended": 1,
+      "max": 1
+    },
+    {
+      "mode": "dynamic",
+      "roleId": "verifier",
+      "dutyId": "reverification-worker",
+      "sourceRoleIds": [
+        "analyser"
+      ],
+      "activation": "per-selected-source"
+    }
+  ]
+}

package/runtime/prompts/profiles/technical-verification.md

@@ -1,30 +1,5 @@
 # Technical Verification Profile
 
-```yaml
-roles:
-  - role: analyser
-    min: 2
-    recommended: 2
-    max: 5
-    duty: technical-verification-worker
-  - role: critic
-    min: 0
-    recommended: 1
-    max: 1
-    duty: scope-critic
-  - role: report-writer
-    min: 1
-    recommended: 1
-    max: 1
-    duty: report-writer
-  - role: verifier
-    min: 0
-    recommended: 0
-    max: 0
-    duty: reverification-worker
-    dynamic: true
-```
-
 - Purpose: collect experimental evidence for unresolved technical facts before a new implementation comparison.
 - Required workers:
   - claude

package/runtime/prompts/wizard/prompts.ko.json

@@ -101,7 +101,7 @@
       "echo_template": "task-type: {value}"
     },
     "selected_direction_pick": {
-      "label": "상세 계획의 입력으로 사용할 확정 구현 방향 보고서를 선택하세요 (같은 task의 최신 3개). 고른 보고서의 user-responses/ 답변(방향 선택·C-NNN 답)이 함께 전달됩니다 — clarification-response 단계는 필요 없습니다",
+      "label": "상세 계획의 입력으로 쓸 확정 구현 방향 보고서를 고르세요 (같은 task 의 최신 3개). 고른 보고서에 딸린 답변 — 어느 방향을 골랐는지와 확인 질문(C-NNN) 답 — 이 함께 전달되므로 뒤의 clarification 단계는 건너뜁니다",
       "echo_template": "selected-direction: {value}",
       "errors": {
         "none": "같은 task에서 선택할 implementation-option-selection 최종 보고서를 찾을 수 없습니다.",
@@ -189,37 +189,33 @@
       "echo_template": "analysis-target: {value}"
     },
     "handoff_stage_pick": {
-      "label": "PR 로 내보낼 범위를 선택하세요 (복수 선택 가능 — 검증 accepted + 미-PR stage 만 표시). 제외된 stage: {blocked}",
-      "echo_template": "handoff-scope: {value}",
+      "label": "PR 을 열 stage 를 선택하세요 (복수 선택 가능, stage 하나가 PR 하나 — 검증 accepted + 미-PR stage 만 표시). 제외된 stage: {blocked}",
+      "echo_template": "handoff-stages: {value}",
       "labels": {
-        "whole_task": "전체 task — whole-task 검증 기반 단일 PR (단독 선택)",
         "stage": "stage {stage} (depends-on: {deps})",
         "blocked_none": "없음"
       },
       "echo_variants": {
-        "whole_task": "handoff scope: 전체 task (whole-task 검증 기반)",
-        "stage_group": "handoff scope: stage-group ({stages})"
+        "stages": "handoff stages: {stages}"
       },
       "errors": {
         "no_plan": "release-handoff 는 이 task 의 implementation-planning final-report 가 필요합니다 — implementation-planning → implementation → final-verification 을 먼저 진행하세요.",
         "plan_not_approved": "최신 plan 이 approved 상태가 아닙니다: {plan} — implementation 이 완료된 task 에서만 release-handoff 를 시작할 수 있습니다.",
-        "nothing_eligible": "PR 로 내보낼 수 있는 범위가 없습니다 — 제외 사유: {blocked}. 단독-stage final-verification 의 accepted 기록(okstra handoff record-verified) 또는 whole-task 검증을 먼저 완료하세요.",
-        "none_selected": "최소 1개의 범위를 선택하세요",
-        "whole_task_exclusive": "'전체 task' 는 단독 선택만 가능합니다 — stage 묶음을 원하면 stage 번호들만 선택하세요",
-        "whole_task_missing": "accepted whole-task final-verification 보고서가 없습니다",
+        "nothing_eligible": "PR 로 내보낼 수 있는 stage 가 없습니다 — 제외 사유: {blocked}. 단독-stage final-verification 의 accepted 기록(okstra handoff record-verified)을 먼저 완료하세요.",
+        "none_selected": "최소 1개의 stage 를 선택하세요",
         "not_eligible": "eligible 하지 않은 stage: {bad} (선택 가능: {eligible})"
       }
     },
     "brief_carry": {
-      "label": "이 task 에 carry-in 할 brief 가 없습니다. {task_type} 는 entry phase 의 brief 를 이어받는 단계입니다 — 어떻게 진행할까요?",
+      "label": "이 task 에는 이어받을 brief 가 없습니다. {task_type} 는 앞 단계가 쓴 brief 를 물려받아 도는 단계라 그 brief 없이는 시작할 수 없습니다 — 어떻게 할까요?",
       "echo_template": "brief-carry: {value}",
       "options": {
-        "__switch_entry__": "entry phase 로 전환 (추천) — requirements-discovery / error-analysis / improvement-discovery 부터 시작",
+        "__switch_entry__": "brief 를 처음 쓰는 단계부터 시작 (추천) — requirements-discovery / error-analysis / improvement-discovery",
         "__free_input__": "brief 경로 직접 입력",
         "__abort__": "중단"
       },
       "echo_variants": {
-        "switch_entry": "brief-carry: entry phase 로 전환 — task-type 을 다시 선택합니다",
+        "switch_entry": "brief-carry: brief 를 처음 쓰는 단계로 전환 — task-type 을 다시 선택합니다",
         "abort": "brief-carry: 중단"
       }
     },
@@ -402,7 +398,7 @@
       }
     },
     "clarification_pick": {
-      "label": "clarification-response 를 넘길까요? (follow-up 시에만 — final-report 선택 시 user-responses/ 폴더의 답변도 함께 첨부됩니다)",
+      "label": "지난 run 이 남긴 확인 질문(C-NNN)에 답한 파일을 이번 입력으로 넘길까요? 이어서 도는 run 에서만 해당합니다 — 최근 final-report 를 고르면 그 리포트에 딸린 답변도 함께 전달됩니다",
       "echo_template": "clarification(pick): {value}",
       "options": {
         "__skip__": "없음 (건너뛰기)",
@@ -590,7 +586,7 @@
       "echo_template": "related-tasks: {value}"
     },
     "clarification": {
-      "label": "clarification-response 파일 경로 (follow-up 시에만, 없으면 빈 줄)",
+      "label": "지난 run 의 확인 질문에 답한 파일 경로 (이어서 도는 run 에서만, 없으면 빈 줄)",
       "echo_template": "clarification: {value}"
     },
     "pr_template": {
@@ -670,7 +666,6 @@
     "reverify_scope_user_carry_all": "  reverify-scope: carry-all (사용자 지정 — 재검증 없이 직전 판정 전부 이월, 새 stage 만 검증; 브랜치가 움직였으면 full 로 내려감)",
     "reverify_scope_user_stages": "  reverify-scope: stage {stages} 재검증 지정 (사용자 지정 — 하위 stage 포함, 나머지는 직전 판정 이월)",
     "stage_whole_task": "전체 task",
-    "handoff_scope_whole_task": "전체 task (whole-task 검증 기반)",
-    "handoff_scope_stage_group": "stage-group ({stages})"
+    "handoff_scope_stages": "stage {stages} (stage 당 PR 1건)"
   }
 }

package/runtime/python/okstra_ctl/adapters/hosts/antigravity/relay.md

@@ -89,6 +89,7 @@ Render every numbered item as its option label followed by its description verba
 - For convergence reverify, consume the persisted round plan exactly. This adapter may map and transport each returned batch, but it cannot change batch membership and does not classify findings or branch on task type, provider, or model identity.
 - The current Antigravity session is the lead. Never launch another provider as a replacement lead.
 - The prepared run manifest and team-state are the assignment authority. Keep `runner=native-session` assignments in the current host and route `runner=cli-wrapper` assignments through the registered wrapper.
+- This host declares no worker session contract. A `runner=native-session` worker therefore receives no host session rules beyond its duty contract, the selected preamble, and the task instructions; the dispatch prompt carries no `**Host Session Contract Path:**` header. Declaring one means adding `workerSessionContract` to this adapter's `manifest.json` and descriptor — it is never installed into a host-global discovery path.
 - Do not infer the current host from an installed `agy` binary. The `antigravity` runtime must come from the active host skill or an explicit runtime flag.
 - Unsupported workers or unavailable models fail before dispatch; do not change the provider, model, or runner silently.
 - Reverify and critic retries use fresh attempts and persist the core-supplied `dispatchKind`.

package/runtime/python/okstra_ctl/adapters/hosts/claude-code/adapter.py

@@ -42,6 +42,9 @@ DESCRIPTOR = HostDescriptor(
     session_accounting="claude-jsonl",
     has_claude_session=True,
     relay_contract=str(Path(__file__).with_name("relay.md").resolve()),
+    worker_session_contract=str(
+        Path(__file__).with_name("worker-session.md").resolve()
+    ),
     initial_prompt_delivery_mode="eager-include",
 )
 

package/runtime/python/okstra_ctl/adapters/hosts/claude-code/manifest.json

@@ -1 +1 @@
-{"schemaVersion": 1, "id": "claude-code", "factory": "adapter.py:create_adapter", "nativeProviderId": "claude", "requiredExecutables": ["claude"], "relayContract": "relay.md"}
+{"schemaVersion": 1, "id": "claude-code", "factory": "adapter.py:create_adapter", "nativeProviderId": "claude", "requiredExecutables": ["claude"], "relayContract": "relay.md", "workerSessionContract": "worker-session.md"}

package/runtime/python/okstra_ctl/adapters/hosts/claude-code/relay.md

@@ -158,7 +158,7 @@ The `confirm` prompt's `label` is the selection summary (one line per resolved i
 | `read_artifacts` | Use the host file-read primitive and preserve the core contract's read order. |
 | `write_artifact` | Use the host file-write primitive only for paths authorized by the active lifecycle phase. |
 | `prompt_user` | Use `AskUserQuestion` for approvals and clarifications that fit `nativeLimits`. Do not print a numbered list in chat while that tool is available. Emit the question as the last thing in that turn: assistant text emitted after the call renders below the question and separates it from the user's answer. Do not infer an answer from silence. |
-| `dispatch_worker` | First verify the materialized invocation metadata. Dispatch `runner=native-session` through `Agent(name: "<role>", run_in_background: true)` without `team_name`, with `hostModelValue` and a summon message only — never the prompt body. The summon is exactly: `Your complete dispatch instructions are the document at <absolute promptPath>. Read that document in full before doing anything else — every line, continuing with offset until end of file — then execute it exactly. Do not act on this message alone.` The verified `promptPath` is already persisted and metadata-verified; inlining its body into the `Agent` call duplicates it in the lead context and lets the two copies drift. Dispatch `runner=cli-wrapper` with the deterministic shell command `okstra worker-dispatch --project-root <root> --run-manifest <path> --workers <ids>`; never wrap that process in another `Agent(...)` call. **Not in a cmux run:** when the run manifest's `terminalBackend` is `cmux-pane`, `prompts/lead/adapters/cmux.md` overrides this row. |
+| `dispatch_worker` | First verify the materialized invocation metadata. Dispatch `runner=native-session` through `Agent(name: "<role>", run_in_background: true)` without `team_name`, with `hostModelValue` and a summon message only — never the prompt body. The summon is exactly: `Your complete dispatch instructions are the document at <absolute promptPath>. Read that document in full before doing anything else — every line, continuing with offset until end of file — then execute it exactly. Do not act on this message alone. If this message carries no such path, return `CLAUDE_PROMPT_PATH_MISSING: dispatch prompt document path was not provided` and do nothing else.` The verified `promptPath` is already persisted and metadata-verified; inlining its body into the `Agent` call duplicates it in the lead context and lets the two copies drift. The summon carries the read requirement because nothing else can: every other rule the worker follows lives inside the document it is being told to open. This host declares a worker session contract (`worker-session.md`), which the materialized prompt delivers to `runner=native-session` workers as `**Host Session Contract Path:**`. Dispatch `runner=cli-wrapper` with the deterministic shell command `okstra worker-dispatch --project-root <root> --run-manifest <path> --workers <ids>`; never wrap that process in another `Agent(...)` call. **Not in a cmux run:** when the run manifest's `terminalBackend` is `cmux-pane`, `prompts/lead/adapters/cmux.md` overrides this row. |
 | `await_workers` | Arm one background shell poll for the pending Result Paths; the spawn acknowledgement is not completion. |
 | `redispatch_worker` | Materialize and verify a fresh invocation, then use a fresh native `Agent(...)` session or `okstra worker-dispatch` attempt according to the persisted runner. |
 | `shutdown_workers` | For each confirmed-complete worker selected for cleanup, send `SendMessage(to: <name>, message: { type: "shutdown_request" })` to idle the roster member **and** call `TaskStop(task_id: "<name>")` to stop its background task. Both are required; neither subsumes the other. |
@@ -169,14 +169,15 @@ The `confirm` prompt's `label` is the selection summary (one line per resolved i
 
 - The session owns one implicit team. `TeamCreate` and `TeamDelete` are absent on current Claude Code builds; never probe for them and never pass `team_name`.
 - Set `name` to the core-assigned functional role label so token attribution can match `agentName`.
-- Map a `runner=native-session` Claude assignment to the real host execution definition for its function (`claude-worker`, `report-writer-worker`, or `translator-worker`). A CLI-wrapper assignment has no Claude agent definition; `worker-dispatch` starts its registered provider process directly.
+- A `runner=native-session` Claude assignment opens a general-purpose session: pass no `subagent_type`. okstra registers no agent definitions in this host's discovery path, so there is none to name (ADR-0017). Everything the worker must do reaches it through the summon message and the document that message points at. A CLI-wrapper assignment does not enter this layer at all; `worker-dispatch` starts its registered provider process directly.
+- The native worker primitive for this host is the `Agent` tool. Host session rules — working directory, shell invocation, MCP call shape, and when to return — are owned by this host's worker session contract, not by an execution definition, so they reach a native worker through `**Host Session Contract Path:**` and never reach a CLI-wrapper worker.
 - For `runner=native-session`, pass the persisted `hostModelValue` as the `model` argument. For `runner=cli-wrapper`, `worker-dispatch` passes the persisted `modelExecutionValue` to the provider process. Never interchange the two fields.
 - Immediately before every native host primitive, run `okstra agent-prompt record-dispatch` with the project root, run manifest, verified metadata path, and `--enforcement-mode host-native-spec-link-gate`. After the Result Path exists, run `okstra agent-prompt link-result` with `--dispatch-id <invocationId>:attempt-1` and that path before accepting or parsing it. CLI-wrapper calls are recorded by `worker-dispatch` itself.
 - A resumed lead can dispatch a fresh worker; resume is not a valid reason to omit a rostered role.
 
 ### Dispatch-time model enforcement
 
-- A native Claude execution definition declares `model: inherit`; the lead MUST override it with the verified assignment's `hostModelValue`.
+- A native call inherits nothing: pass the verified assignment's `hostModelValue` as the `model` argument on every dispatch.
 - CLI-wrapper assignments never enter the Agent layer. `okstra worker-dispatch` validates the metadata and passes `modelExecutionValue` to the registered provider script.
 - Missing or unsupported family-token mapping is a pre-dispatch contract failure. Never inherit the lead model, choose a nearby alias, or switch provider silently.
 - Every analysis dispatch sets `name: "<workerId>-worker"`; convergence retries append `-reverify-r<N>`, implementation uses the functional `-executor` / `-verifier` suffix, and report writing uses `report-writer`. These values are retained as `agentName` in session JSONL for usage attribution.

package/runtime/python/okstra_ctl/adapters/hosts/claude-code/worker-session.md

@@ -0,0 +1,108 @@
+# Claude Code Worker Session Contract
+
+This file is the host contract for a worker running **inside** a Claude Code
+session (`runner=native-session`). The dispatch prompt names it as
+`**Host Session Contract Path:**`. It owns only what is true because the worker
+shares the lead's host session; the duty contract owns the role, the selected
+preamble owns the audience procedure, and the task instructions own this run's
+inputs and outputs. A `runner=cli-wrapper` worker runs as its own provider
+process and never receives this file.
+
+## Dispatch verification
+
+The summon message carried the absolute path of your dispatch prompt document,
+not the prompt itself. You have already read that document; these checks confirm
+you read the right one.
+
+1. Extract the absolute `Project Root` (a line starting with `**Project Root:**`
+   or `Project Root:`). If it is absent, return
+   `CLAUDE_PROJECT_ROOT_MISSING: absolute Project Root was not provided in the lead prompt`
+   and do nothing else.
+2. Check that the path you were summoned with matches the document's
+   `Assigned worker prompt history path:` header, resolving a relative header
+   value against `Project Root`. On a mismatch, return
+   `CLAUDE_PROMPT_PATH_MISSING: summon path does not match the document's assigned prompt history path`.
+   The lead persisted and verified that document before dispatch, so never
+   rewrite it.
+
+## Working directory and shell
+
+Anchor every file operation to the absolute `Project Root`. Use absolute paths;
+do not rely on inherited cwd, and never use `cd` to move the session.
+
+- **Executor exception (implementation runs).** When you are the `Executor` and
+  the prompt provides an `EXECUTOR_WORKTREE_PATH` that differs from the
+  session's cwd, prefix cwd-sensitive Bash commands (`cargo *`, `npm *`,
+  `pnpm *`, `bun *`, `pytest`, `make *`, `go *`, and other toolchain
+  build/test commands) with `cd <EXECUTOR_WORKTREE_PATH> && ` in the same Bash
+  invocation. Pass the chained command directly to the Bash tool; do not wrap it
+  in `bash -lc "..."` or `bash -c "..."`, because the leading `cd` token has to
+  stay visible to the permission layer. The `cd` is scoped to that one subshell
+  and does not move the session, which is why it does not contradict the rule
+  above.
+- **Verifier QA-gate exception.** A verifier may use the same
+  `cd <WORKTREE> && <cmd>` shape for the project-declared `qaCommands` (lint,
+  format, typecheck, test) from `project.json`, since those are cwd-sensitive by
+  nature. Outside the QA gate a verifier still reads by absolute path only.
+- **No chaining beyond `cd && cmd`.** The permission matcher allows exactly the
+  two-segment shape. Appending a pipe, semicolon, redirect, or second `&&` — for
+  example `cd ... && cargo test ... 2>&1 | tail -20; echo "exit:$?"` —
+  disqualifies the prefix match and raises a permission prompt on every
+  dispatch. Let the host capture stdout, stderr, and the exit code natively. If
+  you genuinely need less output, run the command and read the result in a
+  separate call.
+- **Commands must not be able to prompt.** Your Bash calls see the user's own
+  shell, where `cp`, `mv`, and `rm` are commonly aliased to their `-i` form. The
+  confirmation that alias raises has nobody to answer it, and the dispatch hangs
+  until it is killed. Invoke these as `command cp` / `command mv` /
+  `command rm`, which skips alias expansion. Do not reach for `-f` instead: it
+  also changes what the tool does on failure, and `rm -f` reports success on a
+  path that never existed.
+
+## MCP
+
+The run's available MCP servers and tools are listed in the analysis packet's
+`Available MCP Servers` section. When that section is absent or says none, treat
+MCP as unavailable for this run and never infer tools from host configuration.
+Call a listed tool directly by name (`mcp__<server>__<tool>`); do not shell out
+via `claude --mcp-cli call ...` and do not run a tool name as a Bash command.
+When a server you need is not listed, record `MCP not available for this run` in
+your output rather than guessing a tool name.
+
+## Post-write gates (implementation executor)
+
+An executor prompt carries two gate blocks the lead appends after the coding
+preflight: `Pre-commit diff review sweep` and `Implementation self-check`.
+Execute both and record their coverage lines exactly as the blocks specify. The
+provider wrappers refuse to launch an executor prompt that lacks them
+(`*_POSTWRITE_GATE_MISSING`); a worker in this session has no wrapper, so the
+contract lands on you. If either block is missing, record a typed `tool-failure`
+through `okstra error-log append-observed` and tell the lead to re-dispatch with
+the blocks included.
+
+## Returning
+
+The lead's dispatch returns as soon as the session is spawned and does not block
+on you. It detects completion by polling your result file, so that file's
+appearance at `**Result Path:**` is the only completion signal it has. Lingering
+after the file is on disk extends the phase's wall-clock time for the whole run.
+
+After the write succeeds:
+
+1. Return your final message immediately, beginning with your model identity as
+   the selected preamble specifies.
+2. Do not perform further `Read`, `Grep`, `Glob`, or MCP calls, and do not
+   re-review your own output.
+3. Do not rewrite the result file. If a correction is genuinely required, make a
+   single `Edit` and return.
+4. The one exception is recording a `tool-failure` when the failure happened
+   after the write; return immediately after that command.
+
+**Enforced:** `validators/validate-run.py` `validate_team_state` fails a run
+whose worker carries a terminal status with no saved result file at its assigned
+Result Path.
+
+If you catch yourself thinking "let me double-check section 3" after the write
+succeeded, stop. Convergence and the report writer reconcile gaps across all
+workers; extra depth in one worker at the cost of returning late is a net loss
+for the run.

package/runtime/python/okstra_ctl/adapters/hosts/codex/relay.md

@@ -205,6 +205,7 @@ The worker's `--sandbox danger-full-access` flag only selects the child Codex po
 - For convergence reverify, consume the persisted round plan exactly. This adapter may map and transport each returned batch, but it cannot change batch membership and does not classify findings or branch on task type, provider, or model identity.
 - Do not invoke Claude Code team or subagent tools.
 - The prepared run manifest and team-state are the dispatch authority. A `runner=native-session` assignment stays in the current Codex host; a `runner=cli-wrapper` assignment uses the registered provider wrapper. Unsupported explicitly requested workers fail; an adapter must not silently change the roster.
+- This host declares no worker session contract. A `runner=native-session` worker therefore receives no host session rules beyond its duty contract, the selected preamble, and the task instructions; the dispatch prompt carries no `**Host Session Contract Path:**` header. Declaring one means adding `workerSessionContract` to this adapter's `manifest.json` and descriptor — it is never installed into a host-global discovery path.
 - The report-writer follows its persisted provider, model, and runner assignment exactly. It has no Codex-only provider override or separate opt-in gate.
 - Reverify and critic retries invoke a fresh worker attempt and persist the core-supplied `dispatchKind` (`reverify-r<N>` or `critic`) in the dispatch record; never reuse a prior rollout as a new vote.
 - Native calls use only `hostModelValue`. Immediately before the host primitive, run `okstra agent-prompt record-dispatch` with the project root, run manifest, verified metadata path, and `--enforcement-mode host-native-spec-link-gate`; after the Result Path exists, run `okstra agent-prompt link-result` with `--dispatch-id <invocationId>:attempt-1` and that path before accepting it. CLI calls use only `modelExecutionValue` through `worker-dispatch`, which records its own dispatch. The native linkage proves association with a verified specification, not observed prompt delivery.

package/runtime/python/okstra_ctl/adapters/hosts/grok/relay.md

@@ -161,6 +161,8 @@ For a `host-text` mapping, render each numbered item as its option label followe
 | `record_lead_event` | Append progress and activity records to the manifest-provided `leadEventsPath`. Use `okstra lead-progress append --phase <phase-id>` for a checkpoint and `okstra agent-activity append --kind <kind>` for an activity record; both resolve the ledger path from the run manifest. Emit the matching `PROGRESS:` line — the command prints it as `progressLine` — and, when an activity record is required, the immediately following `ACTIVITY:` line from the same structured fields. |
 | `collect_usage` | Return explicit unavailable lead usage until Grok registers a session transcript or CLI usage artifact contract. |
 
+- This host declares no worker session contract. A `runner=native-session` worker therefore receives no host session rules beyond its duty contract, the selected preamble, and the task instructions; the dispatch prompt carries no `**Host Session Contract Path:**` header. Declaring one means adding `workerSessionContract` to this adapter's `manifest.json` and descriptor — it is never installed into a host-global discovery path.
+
 ## Completion, cleanup, and resume
 
 - Do not infer the current host from an installed `grok` executable. The runtime must come from an explicit request or current-session declaration.

package/runtime/python/okstra_ctl/adapters/hosts/kimi/relay.md

@@ -83,6 +83,8 @@ Render every numbered item as its option label followed by its description verba
 | `record_lead_event` | Append progress and activity records to the manifest-provided `leadEventsPath`. Use `okstra lead-progress append --phase <phase-id>` for a checkpoint and `okstra agent-activity append --kind <kind>` for an activity record; both resolve the ledger path from the run manifest. Emit the matching `PROGRESS:` line — the command prints it as `progressLine` — and, when an activity record is required, the immediately following `ACTIVITY:` line from the same structured fields. |
 | `collect_usage` | Return explicit unavailable lead usage until Kimi registers a session transcript or CLI usage artifact contract. |
 
+- This host declares no worker session contract. A `runner=native-session` worker therefore receives no host session rules beyond its duty contract, the selected preamble, and the task instructions; the dispatch prompt carries no `**Host Session Contract Path:**` header. Declaring one means adding `workerSessionContract` to this adapter's `manifest.json` and descriptor — it is never installed into a host-global discovery path.
+
 ## Completion, cleanup, and resume
 
 - Do not infer the current host from an installed `kimi` executable. The runtime must come from an explicit request or current-session declaration.

package/runtime/python/okstra_ctl/adapters/providers/antigravity/adapter.py

@@ -33,9 +33,16 @@ ANTIGRAVITY = {
         "gemini-3.1-pro", "Gemini 3.1 Pro", "gemini-3.1-pro",
         aliases=("gemini 3.1 pro",),
     ),
+    "gemini-3.8-flash": ModelSpec(
+        "gemini-3.8-flash", "Gemini 3.8 Flash", "gemini-3.8-flash",
+        aliases=("gemini 3.8 flash",),
+    ),
+    # picker 에서는 감춘다: Flash 계열의 최신은 3.8 이다(`agy models` 2026-09-23
+    # 확인). 엔트리는 남긴다 — 이 모델로 디스패치된 과거 task 의 서빙 모델
+    # 관측값이 카탈로그에서 자기 행을 찾아야 게이트를 통과한다.
     "gemini-3.7-flash": ModelSpec(
         "gemini-3.7-flash", "Gemini 3.7 Flash", "gemini-3.7-flash",
-        aliases=("gemini 3.7 flash",),
+        aliases=("gemini 3.7 flash",), selectable=False,
     ),
 }
 

package/runtime/python/okstra_ctl/adapters/providers/claude/adapter.py

@@ -41,6 +41,14 @@ CLAUDE = {
         "opus-5", "opus-5", "claude-opus-5", aliases=("claude-opus-5",),
         channel_family="opus", selectable=False,
     ),
+    # opus 채널이 지금 서빙하는 점-릴리스. 엔트리가 없으면 served-model 게이트가
+    # 관측값을 카탈로그에서 못 찾아 dispatch 가 exit 78 로 실패한다 — 실측
+    # 2026-09-23, 두 프로젝트에서 `claude-opus-5-5` 로 같은 실패(dev-10860
+    # stage-3·4·5). haiku-4-5-20251001 과 같은 이유의 엔트리다.
+    "opus-5-5": ModelSpec(
+        "opus-5-5", "opus-5-5", "claude-opus-5-5", aliases=("claude-opus-5-5",),
+        channel_family="opus", selectable=False,
+    ),
     "sonnet": ModelSpec(
         "sonnet", "sonnet", "sonnet", version_kind="channel", channel_family="sonnet"
     ),

package/runtime/python/okstra_ctl/adapters/providers/codex/adapter.py

@@ -17,9 +17,21 @@ import okstra_ctl.model_discovery as model_discovery
 
 
 # 모델 식별자와 순서는 Codex의 `~/.codex/models_cache.json`을 따른다
-# (2026-09-07 확인, 클라이언트 0.153.4): astra / sol / terra / luna.
-# `gpt-5.6` is not a slug that catalog offers at all, so it is gone from here;
-# its rate moved to `_LEGACY_CODEX_PRICING` so past runs still price.
+# (2026-09-23 확인, 클라이언트 0.155.0): gpt-6 astra / sol / luna 와 5.6 계열의
+# sol / terra / luna. `gpt-5.6` is not a slug that catalog offers at all, so it
+# is gone from here; its rate moved to `_LEGACY_CODEX_PRICING` so past runs
+# still price.
+#
+# 노출 규칙: 티어(astra·sol·terra·luna)마다, **이 계정이 실제로 서빙하는** 최신
+# 세대 하나만 selectable 로 둔다. 카탈로그가 슬러그를 내놓는 것과 계정이 그것을
+# 실행하는 것은 다르다 — 실측 2026-09-23(jobs dev-10860
+# implementation-option-selection-002): ChatGPT 계정으로 로그인한 이 기계에서
+# `gpt-6-sol` 디스패치가 두 번 다 400 으로 거절됐다
+# ("The 'gpt-6-sol' model is not supported when using Codex with a ChatGPT
+# account"). 같은 계정의 `models_cache.json` 도 6세대로는 astra 만 싣는다.
+# 그래서 sol·luna 티어는 5.6 행이 선택 가능한 행이고, gpt-6 의 두 행은 엔트리만
+# 남긴다 — 서빙하는 계정이 그 값을 쓰거나 과거 run 을 정산할 때 필요하다.
+# astra 는 이 계정에서 실제로 돌아 gpt-6 행이 선택 가능하다.
 CODEX = {
     # 비용은 계정이 구독이든 API 든 공개 API 단가(입력·캐시 입력·출력 USD/1M)로
     # 추정한다 — 리포트가 답하는 것은 "얼마나 썼는가" 이지 "청구서에 얼마가
@@ -28,12 +40,17 @@ CODEX = {
     # 계상된다(실측 2026-09-08). 출처: OpenAI 표준 등급, 2026-09 기준
     # (morphllm.com/openai-api-pricing, cloudzero.com/blog/openai-pricing,
     # layer3labs.io/guides/gpt-6-astra-api-pricing).
+    # gpt-6 단가는 OpenAI 모델 문서의 표준 등급(2026-09-23 확인):
+    # developers.openai.com/api/docs/models/gpt-6-sol, .../gpt-6-luna.
     "gpt-6-astra": ModelSpec("gpt-6-astra", "gpt-6-astra", "gpt-6-astra", pricing=(10.0, 1.0, 50.0)),
-    "gpt-5.6-sol": ModelSpec("gpt-5.6-sol", "gpt-5.6-sol", "gpt-5.6-sol", pricing=(5.0, 0.50, 30.0)),
+    # picker 에서는 감춘다: 이 계정이 400 으로 거절한다(위 노출 규칙). 엔트리는
+    # 남긴다 — 서빙하는 계정의 값이고, 과거 run 의 단가도 이 표에서 찾는다.
+    "gpt-6-sol": ModelSpec("gpt-6-sol", "gpt-6-sol", "gpt-6-sol", pricing=(2.0, 0.20, 10.0), selectable=False),
+    "gpt-6-luna": ModelSpec("gpt-6-luna", "gpt-6-luna", "gpt-6-luna", pricing=(0.10, 0.01, 0.50), selectable=False),
     "gpt-5.6-terra": ModelSpec("gpt-5.6-terra", "gpt-5.6-terra", "gpt-5.6-terra", pricing=(2.0, 0.20, 12.0)),
+    "gpt-5.6-sol": ModelSpec("gpt-5.6-sol", "gpt-5.6-sol", "gpt-5.6-sol", pricing=(5.0, 0.50, 30.0)),
     "gpt-5.6-luna": ModelSpec("gpt-5.6-luna", "gpt-5.6-luna", "gpt-5.6-luna", pricing=(0.20, 0.02, 1.20)),
-    # picker 에서는 감춘다. 엔트리는 남긴다 — 과거 run 의 토큰 사용량을
-    # 정산할 때 pricing 을 이 표에서 찾는다.
+    # picker 에서는 감춘다(사유는 위와 동일 — 더 이상 카탈로그가 내놓지 않는다).
     "gpt-5.4-mini": ModelSpec("gpt-5.4-mini", "gpt-5.4-mini", "gpt-5.4-mini", pricing=(0.75, 0.075, 4.50), selectable=False),
     "codex-auto-review": ModelSpec("codex-auto-review", "codex-auto-review", "codex-auto-review", selectable=False),
 }

package/runtime/python/okstra_ctl/adapters/providers/grok/adapter.py

@@ -21,7 +21,11 @@ from okstra_ctl.domain.worker_stream import StreamEvent, Text, ToolCall, ToolRes
 
 
 GROK = {
-    "grok-4.6": ModelSpec("grok-4.6", "grok-4.6", "grok-4.6", pricing=(2.00, 0.50, 6.00)),
+    "grok-4.7": ModelSpec("grok-4.7", "grok-4.7", "grok-4.7", pricing=(2.00, 0.50, 6.00)),
+    # picker 에서는 감춘다: grok-4.7 이 같은 계열의 최신이다(`grok` CLI 1.0.40 의
+    # 기본값도 4.7, 2026-09-23 확인). 엔트리는 남긴다 — 과거 run 의 정산이 이
+    # 표의 단가를 읽고, 서빙 모델 게이트가 옛 관측값을 여기서 찾는다.
+    "grok-4.6": ModelSpec("grok-4.6", "grok-4.6", "grok-4.6", pricing=(2.00, 0.50, 6.00), selectable=False),
     # picker 에서는 감춘다(사유는 codex 의 gpt-5.4-mini 와 동일).
     "grok-build-0.1": ModelSpec("grok-build-0.1", "grok-build-0.1", "grok-build-0.1", pricing=(1.00, 0.20, 2.00), selectable=False),
 }
@@ -294,7 +298,7 @@ def create_provider() -> ProviderSpec:
         display_label="Grok",
         models=GROK,
         default_models={
-            role: "grok-4.6"
+            role: "grok-4.7"
             for role in (
                 "lead",
                 "analyser",