okstra 0.205.0 → 0.206.0

package/runtime/python/okstra_ctl/verification_target.py

@@ -1,6 +1,6 @@
 """Read the prepared final-verification target snapshot.
 
-`run.write_verification_target_snapshot` writes it; two consumers read it —
+`phases.final_verification.entry.write_verification_target_snapshot` writes it; two consumers read it —
 report assembly, which records the run's `verificationScope`, and `validate-run`,
 which re-checks the published report against it. The digest rule lived only in
 the validator, so a second reader would have been a second implementation of it;

package/runtime/python/okstra_ctl/wizard/state.py

@@ -14,6 +14,7 @@ from okstra_ctl.role_requirements import (
     load_role_profile,
 )
 from okstra_ctl.ids import slugify_task_segment
+from okstra_ctl.phases.catalog import PhaseAssetError, profile_markdown
 
 from .ids import (
     PICK_TYPE_CUSTOM,
@@ -307,7 +308,10 @@ def _slug_or_die(value: str, field_name: str) -> str:
 # ---- Roster / profile helpers -------------------------------------------
 
 def _profile_path(workspace_root: Path, task_type: str) -> Path:
-    return workspace_root / "prompts" / "profiles" / f"{task_type}.md"
+    try:
+        return profile_markdown(workspace_root, task_type)
+    except PhaseAssetError as exc:
+        raise WizardError(str(exc)) from exc
 
 
 _V2_STATE_FIELDS = (
@@ -366,7 +370,7 @@ def _role_selection_enabled(state: WizardState) -> bool:
         return False
     try:
         load_role_profile(_profile_path(Path(state.workspace_root), state.task_type))
-    except (OSError, RoleProfileError):
+    except (OSError, RoleProfileError, WizardError):
         return False
     return True
 

package/runtime/python/okstra_ctl/wizard/steps_plan.py

@@ -29,6 +29,11 @@ from okstra_ctl.user_response import PlanDecisionRecord, parse_plan_decision
 from okstra_ctl.wizard_stage_intent import WHOLE_TASK_STAGE
 from okstra_ctl import fix_cycles
 from okstra_ctl.paths import task_dir, task_runs_dir
+from okstra_ctl.phases.final_verification.wizard import (
+    StageAnswerError,
+    validate_stage_answer,
+    whole_task_verification_allowed,
+)
 from okstra_project.state import read_task_manifest
 
 from .ids import (
@@ -422,7 +427,10 @@ def _whole_task_allowed(
         return False
     if done is None:
         done = _stage_lifecycle_snapshot(state, stages).done_stages
-    return all(s.stage_number in done for s in stages)
+    return whole_task_verification_allowed(
+        stage_numbers=tuple(stage.stage_number for stage in stages),
+        done_stages=done,
+    )
 
 
 def _build_approved_plan_pick(state: WizardState) -> Prompt:
@@ -623,20 +631,14 @@ def _impl_stage_marker(t, lifecycle) -> str:
 def _submit_stage_pick(state: WizardState, answer: str) -> Optional[str]:
     if state.task_type == "implementation":
         return _submit_impl_stage_pick(state, answer)
-    # final-verification: 단일선택 유지 (whole-task 또는 단일 정수; auto 불가)
-    if not answer:
-        raise WizardError("value required")
-    if answer == WHOLE_TASK_STAGE:
-        if not _whole_task_allowed(state):
-            raise WizardError(
-                "whole-task verification requires final-verification "
-                "with all stages done")
-    else:
-        try:
-            int(answer)
-        except ValueError:
-            raise WizardError(
-                f"answer must be whole-task or a stage number, got {answer!r}")
+    try:
+        validate_stage_answer(
+            answer,
+            whole_task_token=WHOLE_TASK_STAGE,
+            whole_task_allowed=answer == WHOLE_TASK_STAGE and _whole_task_allowed(state),
+        )
+    except StageAnswerError as exc:
+        raise WizardError(str(exc)) from exc
     state.selected_stage = answer
     return f"stage: {answer}"
 

package/runtime/skills/okstra-user-response/SKILL.md

@@ -6,7 +6,7 @@ description: >-
 
 # OKSTRA User Response
 
-Use this skill for open `C-*` clarification items and explicit plan decisions. The user alone selects or writes every answer. Never infer an answer or approval.
+Use this skill for open `C-*` clarification items, explicit plan decisions, and the implementation direction a finished `implementation-option-selection` comparison awaits. The user alone selects or writes every answer. Never infer an answer or approval.
 
 The model-facing commands are fixed text reads and typed transaction writes:
 
@@ -17,6 +17,7 @@ The model-facing commands are fixed text reads and typed transaction writes:
 | `user-response begin` | Open a sidecar transaction for one report identity. |
 | `user-response answer` | Add or replace one validated clarification answer. |
 | `user-response plan-decision` | Record an explicit plan decision in the transaction. |
+| `user-response direction` | Record the implementation direction the user picked in the transaction. |
 | `user-response legacy-report-authoring` | Record legacy report-authoring permission for report contract 2.0 only. |
 | `user-response finalize` | Atomically merge and publish the user-owned sidecar. |
 
@@ -71,7 +72,7 @@ Never invent a picker function. Never ask the user to type a number when the nat
 okstra user-response list-view --home <resolved-home> --project <projectId> --limit 3
 ```
 
-The view gives `Task key`, `Task type`, `Report`, open-item counts, and readability status. If the count is zero, answer `No task has open clarification items.` and stop. Do not continue with an unreadable entry.
+The view gives `Task key`, `Task type`, `Report`, open-item counts, `Direction selection required`, and readability status. If the count is zero, answer `No task has open clarification items.` and stop. Do not continue with an unreadable entry.
 
 Present up to three task choices through the host picker. A host free-text row or unmatched next message is the report path or task key.
 
@@ -89,6 +90,8 @@ Contract 3.0 options also expose `reach` and `scopeEffects`. Contract 3.0 approv
 
 When an axis says `not stated in the report`, repeat that text. Do not infer missing report-owned impact. The skill must **never invent it**.
 
+When the view prints `Direction candidates:`, the comparison awaits a direction. Each `Direction option N:` row gives the candidate id and name, `Recommended`, `Goal`, `Core mechanism`, and `Selectable`. The `Direction picker:` block lists only selectable candidates, recommended first, each with its `Option number`.
+
 ## Step 2b: Investigate cited context before asking
 
 Do not present a picker from the raw field dump. For each still-open item, read the investigation list the view printed:
@@ -127,9 +130,15 @@ Use the displayed values to confirm the user's choice. Do not copy a predefined
 
 Copy `kind` from the view. A `reframe` does not satisfy the gate. If the user asks what an item means, explain from the view plus the cited files already read, then ask the same item again.
 
+## Step 3b: Ask for the direction
+
+Only when `Current direction selection: none` and `Direction picker:` has rows. Ask one single-select question through the host picker, after any clarification whose answer would change the choice. The body says that the comparison is finished, that the chosen candidate becomes the input of `implementation-planning`, and that planning cannot start until one is chosen. Copy each `Direction picker:` `- Label:` / `Description:` pair in order. Remember the `Option number` of the picked row. A `Selectable: no - <reason>` candidate is never offered; when the user asks for it, state the reason.
+
+When the user adds a note or a constraint for the planner, keep their words verbatim for Step 6.
+
 ## Step 4: Confirm the complete response
 
-Echo each clarification ID, kind, disposition, value, and rationale. Include any explicit plan decision or legacy report-authoring decision. Ask through the host picker, two options:
+Echo each clarification ID, kind, disposition, value, and rationale. Include any explicit plan decision, direction, or legacy report-authoring decision. Ask through the host picker, two options:
 
 1. `Record as shown` (Recommended)
 2. `Change an answer`
@@ -150,7 +159,7 @@ For a predefined option, pass only its one-based number from the fixed view:
 okstra user-response answer --transaction <transaction> --clarification-id <C-NNN> --kind <kind> --option-number <N>
 ```
 
-Every value, rationale, and reason body file must be a regular file under `<projectRoot>/.okstra/tmp/user-response/`; do not use an external file or a symbolic link. For a direct user answer, write the exact value there. Write the rationale to a separate Markdown file only when present. Then run:
+Every value, rationale, and reason body file — and every direction note or constraints file — must be a regular file under `<projectRoot>/.okstra/tmp/user-response/`; do not use an external file or a symbolic link. For a direct user answer, write the exact value there. Write the rationale to a separate Markdown file only when present. Then run:
 
 ```bash
 okstra user-response answer --transaction <transaction> --clarification-id <C-NNN> --kind <kind> --disposition <disposition> --value-file <value.md> [--rationale-file <rationale.md>]
@@ -174,6 +183,14 @@ okstra user-response plan-decision --transaction <transaction> --status <revisio
 
 Never infer a plan decision from the user's tone.
 
+When the user picked a direction, pass the picked row's `Option number`. Write a note or constraints the user stated to separate Markdown files in that same temporary directory, one constraint per line:
+
+```bash
+okstra user-response direction --transaction <transaction> --option-number <N> [--note-file <note.md>] [--constraints-file <constraints.md>]
+```
+
+The command refuses a candidate the planning gate would refuse and a report that does not await a direction.
+
 Only for a report whose fixed view says `Report contract: 2.0`, an explicit legacy report-authoring decision may be recorded. A reason file in that same temporary directory is always required:
 
 ```bash
@@ -194,6 +211,8 @@ Leave this guidance in the final answer:
 
 > This answer was recorded in the `user-responses/` sidecar (`<sidecar path>`). Re-running this task with `/okstra-run` attaches the answer to the next eligible phase.
 
+When a direction was recorded, add: start `implementation-planning` with `/okstra-run` and pick this report in the wizard's direction-report step.
+
 ## Output rules
 
 - Keep responses in the user's language.

package/runtime/validators/validate-run.py

@@ -101,6 +101,10 @@ from okstra_ctl.incremental_scope import (  # noqa: E402
     stages_for_clarification,
 )
 from okstra_ctl import next_phase  # noqa: E402
+from okstra_ctl.phases.final_verification.validation import (  # noqa: E402
+    validate_final_verification_content,
+    validate_verification_target_match,
+)
 from okstra_ctl.clarification_items import (  # noqa: E402
     APPROVAL_BLOCKS,
     clarification_disposition,
@@ -1429,6 +1433,29 @@ def _dispatch_roster_key(row: Mapping[str, Any]) -> str:
         return ""
 
 
+def _dispatch_row_paths(team_state: Mapping[str, Any], worker_id: str) -> tuple[str, str]:
+    """이 로스터 워커의 dispatch 행이 기록한 (promptPath, resultPath).
+
+    v2 assignment 로 띄운 워커는 로스터 행의 경로가 빈 채로 남는다.
+    `workers[].promptPath` 는 첫 v1 dispatch 하나만 가리키는 필드이고 v2 행은
+    그것을 채우지 않는다(`okstra_ctl.dispatch_state.worker_dispatch_records` 의
+    주석, 2026-09-08 실측). 그래서 acceptance critic 처럼 v2 로만 띄우는 워커는
+    프롬프트와 결과 파일이 디스크에 그대로 있는데도 "promptPath 가 없다",
+    "결과 파일이 없다" 로 보고됐다(2026-09-24, jobs final-verification 002).
+    사실은 dispatch 행에 있으므로 그리로 폴백한다.
+    """
+    prompt = ""
+    result = ""
+    for row in team_state.get("workerDispatches") or ():
+        if not isinstance(row, Mapping) or _dispatch_roster_key(row) != worker_id:
+            continue
+        prompt = prompt or str(row.get("promptPath") or "")
+        result = result or str(
+            row.get("workerResultPath") or row.get("resultPath") or ""
+        )
+    return prompt, result
+
+
 def _validate_cmux_workers_were_dispatched_by_okstra(
     team_state: dict,
     workers: list,
@@ -1628,14 +1655,26 @@ def validate_team_state(
                 f"{role} must use modelExecutionValue `{expected_model_execution_value}`"
             )
 
+        # 경로는 로스터 행이 소유하지만 v2 dispatch 는 그 행을 채우지 않는다.
+        # 비어 있을 때만 dispatch 행에서 읽는다 — 로스터 행에 값이 있으면 그것이
+        # 대조 대상이다.
+        roster_prompt = str(worker.get("promptPath") or "")
+        roster_result = str(worker.get("resultPath") or "")
+        if not roster_prompt or not roster_result:
+            fallback_prompt, fallback_result = _dispatch_row_paths(
+                team_state, str(worker.get("workerId") or "")
+            )
+            roster_prompt = roster_prompt or fallback_prompt
+            roster_result = roster_result or fallback_result
+
         expected_result_relative = expected.get("resultPath")
-        result_relative = worker.get("resultPath", "")
+        result_relative = roster_result
         if expected_result_relative and result_relative != expected_result_relative:
             failures.append(
                 f"{role} must use resultPath `{expected_result_relative}`"
             )
         expected_prompt_relative = expected.get("promptPath")
-        prompt_relative = worker.get("promptPath", "")
+        prompt_relative = roster_prompt
         if expected_prompt_relative and prompt_relative != expected_prompt_relative:
             failures.append(
                 f"{role} must use promptPath `{expected_prompt_relative}`"
@@ -5341,19 +5380,6 @@ def _consumers_rows(report_path: Path) -> list[dict] | None:
     return rows
 
 
-# 이 스냅샷의 다이제스트 규칙과 파싱은 `okstra_ctl.verification_target` 하나가
-# 쥔다. 조립도 같은 파일을 읽어 `verificationScope` 를 기록하므로, 사본을 두면
-# 규칙이 갈리는 순간 한쪽이 정상 target 을 변조로 판정한다.
-from okstra_ctl.verification_target import (  # noqa: E402
-    TARGET_FIELD_RES as _TARGET_FIELD_RES,
-    read_verification_target as _read_verification_target_impl,
-)
-
-
-def _read_verification_target(project_root: Path, relative: str) -> dict | None:
-    return _read_verification_target_impl(project_root, relative)
-
-
 _PLAN_BODY_STATE_KEYS = ("schemaVersion", "planItems", "roundHistory")
 
 
@@ -5713,66 +5739,6 @@ def _validate_verifier_command_log_is_read_only(
 
 
 
-def _validate_verification_target_match(
-    data: dict,
-    run_manifest: dict,
-    project_root: Path,
-    failures: list[str],
-) -> None:
-    """The verification report must mirror the target it was prepared against.
-
-    `verificationScope`, the worktree, and the base/head refs were entirely
-    self-declared: the schema required the fields to exist but nothing compared
-    them to the digest-verified snapshot written at prep time. That matters
-    because both `handoff.compute_eligibility` and the `release-handoff`
-    routing check read `verificationScope` — a single-stage run that writes
-    `whole-task` passes both, and an `accepted` verdict can be rendered against
-    a worktree or head nobody verified.
-    """
-    # 최상위 `verificationTargetPath` 가 run 매니페스트의 실물 키다(render.py).
-    # `instructionSet` 블록은 active-run-context 의 것이라 여기서 읽으면 검사가
-    # 통째로 건너뛰어졌다(실측 2026-09-06, dev-10626 final-verification 001).
-    relative = str(run_manifest.get("verificationTargetPath") or "").strip()
-    if not relative:
-        return
-    target = _read_verification_target(project_root, relative)
-    if target is None:
-        return
-
-    source = (data.get("finalVerification") or {}).get("sourceImplementationReport") or {}
-    declared = {
-        "scope": str(data.get("verificationScope") or "").strip(),
-        "worktree": str(source.get("worktreePath") or "").strip(),
-        "base": str(source.get("implementationBaseRef") or "").strip(),
-        "head": str(source.get("capturedHeadSha") or "").strip(),
-    }
-    for key, expected in ((k, target[k]) for k in _TARGET_FIELD_RES):
-        actual = declared[key]
-        if expected and actual and actual != expected:
-            failures.append(
-                f"final-verification report declares {key} `{actual}` but the "
-                f"prepared verification target says `{expected}` "
-                f"(`{relative}`). The report must mirror the target it was "
-                "prepared against — `verificationScope` in particular gates "
-                "both stage-group eligibility and release-handoff routing, so "
-                "a self-declared value lets a run be judged as something it "
-                "was not."
-            )
-
-    declared_stages = {
-        row.get("stage")
-        for row in ((data.get("finalVerification") or {}).get("stageReports") or [])
-        if isinstance(row, dict) and isinstance(row.get("stage"), int)
-    }
-    if target["stages"] and declared_stages and declared_stages != target["stages"]:
-        failures.append(
-            f"final-verification report covers stages {sorted(declared_stages)} "
-            f"but the prepared target names {sorted(target['stages'])} "
-            f"(`{relative}`). A verdict must not be rendered for a stage set "
-            "nobody prepared evidence for."
-        )
-
-
 def _validate_verified_row_recorded(
     data: dict,
     report_path: Path,
@@ -7990,98 +7956,19 @@ def _validate_stage_has_requirement(data: dict, failures: list[str]) -> None:
         )
 
 
-_ADDED_SURFACE_NO_CALLER_RE = re.compile(r"^\s*none\b", re.IGNORECASE)
-
-
-def _validate_added_surface_audit(data: dict, failures: list[str]) -> None:
-    """Every surface the diff added is traced to a requirement, exempted, or paid for.
-
-    The coverage table proves each requirement reached the diff. Nothing proved
-    the reverse — that each thing the diff added answers a requirement — so work
-    nobody asked for passed every gate. This check reads the reverse table and
-    refuses a row that calls itself over-delivery without the blocker or
-    condition it became: a caller-less surface is an acceptance blocker, and a
-    surface with callers but no requirement is a conditional-acceptance
-    condition (ADR-0009 grades the two differently on purpose).
-    """
-    fv = data.get("finalVerification")
-    if not isinstance(fv, Mapping):
-        return
-    rows = fv.get("addedSurfaceAudit")
-    if not isinstance(rows, list):
-        return
-    blocker_ids = {
-        str(row.get("id"))
-        for row in (fv.get("acceptanceBlockers") or [])
-        if isinstance(row, Mapping)
-    }
-    condition_ids = {
-        str(row.get("id"))
-        for row in ((data.get("finalVerdict") or {}).get(
-            "conditionalAcceptanceConditions") or [])
-        if isinstance(row, Mapping)
-    }
-    for row in rows:
-        if not isinstance(row, Mapping):
-            continue
-        row_id = str(row.get("id") or "<id 없음>")
-        disposition = str(row.get("disposition") or "")
-        note = str(row.get("note") or "")
-        if disposition == "traced" and not str(row.get("requirement") or "").strip():
-            failures.append(
-                f"final-verification: addedSurfaceAudit {row_id} is `traced` but "
-                "names no requirement — a surface is traced to something the "
-                "brief asked for, or it is not traced."
-            )
-            continue
-        if disposition != "over-delivery":
-            continue
-        caller_less = bool(
-            _ADDED_SURFACE_NO_CALLER_RE.match(str(row.get("callers") or ""))
-        )
-        expected, known = (
-            ("AB", blocker_ids) if caller_less else ("CA", condition_ids)
-        )
-        cited = set(re.findall(rf"\b{expected}-\d{{3,}}\b", note))
-        if not cited:
-            failures.append(
-                f"final-verification: addedSurfaceAudit {row_id} is "
-                f"`over-delivery` with callers "
-                f"{'none' if caller_less else 'recorded'}, so its note MUST cite "
-                f"the `{expected}-NNN` row it became — "
-                + (
-                    "a caller-less surface is an acceptance blocker"
-                    if caller_less
-                    else "a surface with callers but no requirement is a "
-                         "conditional-acceptance condition"
-                )
-                + "."
-            )
-            continue
-        missing = sorted(cited - known)
-        if missing:
-            failures.append(
-                f"final-verification: addedSurfaceAudit {row_id} cites "
-                f"{missing}, which the report does not carry."
-            )
-
-
 def _validate_final_verification_consistency(data: dict, failures: list[str]) -> None:
-    """Enforce verdict ↔ blocker/condition/routing consistency on the
-    final-verification data.json (SSOT). The schema guarantees field SHAPE;
-    these are the cross-field invariants the release-handoff gate depends on.
-
-    No-op for non-final-verification data so the caller's gate stays defensive.
-    """
+    """단계 내용 판정 뒤에 이동 적합성을 본다. 다른 작업 유형은 건너뛴다."""
     if (data.get("header") or {}).get("taskType") != "final-verification":
         return
-    _validate_added_surface_audit(data, failures)
+    validate_final_verification_content(data, failures)
+    _validate_final_verification_routing(data, failures)
+
+
+def _validate_final_verification_routing(data: dict, failures: list[str]) -> None:
+    """다음 단계 이름이 판정과 맞는지 본다. 대상 선택은 추론하지 않는다."""
     verdict = data.get("finalVerdict") or {}
     token = (verdict.get("verdictToken") or "").strip().lower()
-    fv = data.get("finalVerification") or {}
-    blockers = fv.get("acceptanceBlockers") or []
-    conditions = verdict.get("conditionalAcceptanceConditions") or []
-    routing_value = fv.get("routingRecommendation")
+    routing_value = (data.get("finalVerification") or {}).get("routingRecommendation")
     routing_token = ""
     if isinstance(routing_value, dict):
         routing_token = str(routing_value.get("target") or "")
@@ -8090,23 +7977,16 @@ def _validate_final_verification_consistency(data: dict, failures: list[str]) ->
             "final-verification: routingRecommendation.target must name exactly one "
             "supported routing target."
         )
-        routing_token = None
+        return
+    _refuse_unsuitable_final_verification_route(data, failures, token, routing_token)
 
-    if token == "accepted" and blockers:
-        failures.append(
-            "final-verification: verdict `accepted` but acceptanceBlockers is "
-            "non-empty — an accepted verdict must have zero blockers."
-        )
-    if token == "blocked" and not blockers:
-        failures.append(
-            "final-verification: verdict `blocked` but acceptanceBlockers is "
-            "empty — a blocked verdict must list at least one blocker."
-        )
-    if token == "conditional-accept" and not conditions:
-        failures.append(
-            "final-verification: verdict `conditional-accept` but "
-            "conditionalAcceptanceConditions is empty — list every condition."
-        )
+
+def _refuse_unsuitable_final_verification_route(
+    data: dict,
+    failures: list[str],
+    token: str,
+    routing_token: str,
+) -> None:
     if routing_token in RELEASE_HANDOFF_TARGETS and not release_handoff_allowed(data):
         blocking = blocking_condition_ids(data)
         reason = (
@@ -8121,7 +8001,6 @@ def _validate_final_verification_consistency(data: dict, failures: list[str]) ->
             "or a `conditional-accept` whose every condition declares "
             "`blocksReleaseHandoff: false`."
         )
-
     if routing_token == "final-verification" and token == "accepted":
         failures.append(
             "final-verification: routingRecommendation cites `final-verification` "
@@ -8129,13 +8008,6 @@ def _validate_final_verification_consistency(data: dict, failures: list[str]) ->
             "to re-verify. Route to release-handoff or done."
         )
 
-    scope = data.get("verificationScope", "whole-task")
-    if scope not in ("whole-task", "single-stage"):
-        failures.append(
-            f"final-verification: verificationScope must be `whole-task` or "
-            f"`single-stage`, got {scope!r}."
-        )
-
 
 def validate_report_views(report_path: Path, failures: list[str]) -> None:
     """Enforce Phase 7 step 1.5 (BLOCKING) — the self-contained HTML
@@ -9813,7 +9685,7 @@ def main() -> int:
             Path(args.state).resolve() if args.state else None,
         )
     if task_type == "final-verification":
-        _validate_verification_target_match(
+        validate_verification_target_match(
             validation_data,
             run_manifest,
             project_root,

package/runtime/validators/validate_session_conformance.py

@@ -383,6 +383,9 @@ def _collect_lead_evidence(
         if candidate is not None:
             sessions.setdefault(sid, candidate)
     evidence = _LeadEvidence(window=(since, until))
+    ledger_progress = _ledger_progress(
+        team_state, run_manifest, project_root, task_type, suffix
+    )
     for sid, path in sorted(sessions.items()):
         progress, reads, agent_name = _scan_one_jsonl(path, since, until)
         if agent_name and sid != lead_sid:
@@ -400,7 +403,10 @@ def _collect_lead_evidence(
             "implementation entry-guard conformance cannot be verified, which "
             "fails the run (same principle as the token-usage accuracy contract)."
         )
-    evidence.progress.sort()
+    # 전사와 원장은 같은 체크포인트의 두 기록이다. 계약은 둘 다 요구하고
+    # (`lead-progress append` 로 기록, 같은 줄을 대화에 raw 로 emit), 검사는
+    # 어느 쪽에 남았든 그 체크포인트를 본 것으로 판정한다.
+    evidence.progress = _merge_progress(evidence.progress, ledger_progress)
     for ts_list in evidence.sidecar_reads.values():
         ts_list.sort()
     if _is_activity_contract_v1_planning(run_manifest):
@@ -643,6 +649,69 @@ def _collect_artifact_lead_evidence(
     return evidence, None
 
 
+def _ledger_progress(
+    team_state: dict,
+    run_manifest: Mapping[str, Any],
+    project_root: Path,
+    task_type: str,
+    suffix: str | None,
+) -> list[tuple[str, str, str]]:
+    """원장에 기록된 이 run 의 PROGRESS 체크포인트. 못 읽으면 빈 목록.
+
+    `okstra lead-progress append` 는 호스트와 무관하게 체크포인트를
+    `leadEventsPath` 에 쓰고, 리드 계약은 모든 체크포인트를 그 명령으로
+    기록하라고 요구한다(`prompts/lead/okstra-lead-contract.md` "Progress
+    reporting"). 그런데 `claude-jsonl` 증거 경로는 세션 전사만 훑어서, 계약대로
+    기록한 run 이 체크포인트 전건 누락으로 보고됐다 — 기본 호스트에서 그 명령의
+    출력을 읽는 소비자가 없었다(2026-09-24, jobs final-verification 002:
+    원장에 progress 30행, advisory 10건).
+
+    원장 행은 스크랩한 대화 텍스트보다 약한 증거가 아니다. `--phase` 는 열거된
+    phase id 만 받고 `--worker` 는 로스터 역할로 다시 쓰이므로, 그 행은 검증된
+    입력으로 okstra 자신이 쓴 것이다.
+    """
+    events_path, _error = _resolve_lead_events_path(
+        team_state, run_manifest, project_root
+    )
+    if events_path is None:
+        return []
+    try:
+        events = read_lead_events(events_path)
+    except LeadEventParseError:
+        return []
+    run_seq = _run_sequence(run_manifest, suffix)
+    rows: list[tuple[str, str, str]] = []
+    for event in events:
+        if event.event_type not in ("progress", "progress-checkpoint"):
+            continue
+        if not _event_matches_run(event, team_state, run_manifest, task_type, run_seq):
+            continue
+        progress = _progress_line_from_event(event)
+        if progress is not None:
+            rows.append(progress)
+    return rows
+
+
+def _merge_progress(
+    rows: list[tuple[str, str, str]],
+    extra: list[tuple[str, str, str]],
+) -> list[tuple[str, str, str]]:
+    """두 증거 출처의 체크포인트를 합친다. 같은 줄은 한 번만 남는다.
+
+    리드는 계약상 원장에 기록하고 같은 줄을 대화에 내보내므로, 합치면 같은
+    체크포인트가 두 번 들어온다. 서술 정확성 검사는 줄 단위로 대조하니 중복은
+    판정을 바꾸지 않지만, 보고 문구에 같은 줄이 두 번 실리는 것을 막는다.
+    """
+    seen = {(phase, line) for _ts, phase, line in rows}
+    for ts, phase, line in extra:
+        if (phase, line) in seen:
+            continue
+        seen.add((phase, line))
+        rows.append((ts, phase, line))
+    rows.sort()
+    return rows
+
+
 def _conformance_evidence_source(
     team_state: dict,
 ) -> tuple[str | None, str | None]: