okstra 0.206.1 → 0.207.0

package/runtime/python/okstra_ctl/dispatch_checkpoints.py

@@ -0,0 +1,121 @@
+"""워커를 띄우고 거두는 명령이 대신 기록하는 리드 체크포인트.
+
+dispatch 를 정하고 결과를 확정하는 곳은 `team dispatch` / `team await`(pane)와
+`worker-dispatch`(CLI, 블로킹)이다. 그래서 `phase-3-team-create`,
+`phase-4-dispatch`, `phase-5-collect`, `phase-6-synthesis` 가 말하는 사실을 이
+명령들이 갖고 있다. 리드가 같은 사실을 `okstra lead-progress append` 로 다시
+적으면 체크포인트마다 전체 컨텍스트를 한 턴씩 쓰는데, 여기서 기록하면 턴이 들지 않는다.
+
+워커별 체크포인트는 `initial` dispatch 만 센다. reverify·critic·plan-verify 는
+리드가 따로 알리는 이후 라운드이고, 여기서 기록하면 activity-contract run 이
+존재하지 않는 `worker-dispatched` / `worker-completed` 행을 요구받게 된다.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .dispatch_state import (
+    TERMINAL_WORKER_STATUSES,
+    dispatch_worker_key,
+    has_recorded_team_create,
+    worker_dispatch_records,
+)
+from .lead_progress import record_checkpoint
+from .worker_prompt_body import REPORT_WRITER_WORKER_ID
+
+_INITIAL = "initial"
+
+
+def record_dispatch_checkpoints(
+    project_root: Path,
+    run_manifest: str | Path,
+    team_state: Mapping[str, Any],
+    jobs: Sequence[Any],
+    *,
+    source: str,
+) -> list[str]:
+    """곧 띄울 배치의 체크포인트. 배치가 시작되기 전의 team-state 로 판정한다.
+
+    `phase-3-team-create` 는 이 dispatch 가 implicit-team 마커를 쓸 때만 기록한다
+    (`dispatch_state.record_dispatch_facts`). 리드가 미리 적은 마커(concurrent-run
+    `skipped` 결정)는 리드가 알린다. `phase-6-synthesis` 는 run 의 첫 report-writer
+    dispatch 에서만 기록해서, 교정 라운드가 Phase 6 을 다시 열지 않게 한다.
+    """
+    if not jobs:
+        return []
+    lines: list[str | None] = []
+    if not has_recorded_team_create(team_state):
+        lines.append(record_checkpoint(
+            project_root, run_manifest, "phase-3-team-create", source=source,
+        ))
+    for job in jobs:
+        if job.dispatch_kind == _INITIAL:
+            lines.append(record_checkpoint(
+                project_root, run_manifest, "phase-4-dispatch", source=source,
+                worker=job.worker_id,
+                fields=(("model", job.model_execution_value),),
+            ))
+    dispatches_writer = any(job.worker_id == REPORT_WRITER_WORKER_ID for job in jobs)
+    writer_dispatched_before = bool(
+        worker_dispatch_records(team_state, REPORT_WRITER_WORKER_ID)
+    )
+    if dispatches_writer and not writer_dispatched_before:
+        lines.append(record_checkpoint(
+            project_root, run_manifest, "phase-6-synthesis", source=source,
+        ))
+    return [line for line in lines if line]
+
+
+def settled_initial_dispatches(
+    team_state: Mapping[str, Any],
+) -> dict[str, Mapping[str, Any]]:
+    """최신 attempt 가 종결 상태에 이른 `initial` dispatch 들.
+
+    재시도해도 바뀌지 않는 prompt 경로를 키로 쓴다. 실패 후 재시도 중인 attempt 는
+    재시도까지 끝나야 거둔 결과로 친다.
+    """
+    latest: dict[str, Mapping[str, Any]] = {}
+    for record in worker_dispatch_records(team_state):
+        if record.get("kind") != _INITIAL:
+            continue
+        key = str(record.get("promptPath") or "")
+        current = latest.get(key)
+        if current is None or _attempt(record) >= _attempt(current):
+            latest[key] = record
+    return {
+        key: record
+        for key, record in latest.items()
+        if record.get("status") in TERMINAL_WORKER_STATUSES
+    }
+
+
+def record_collect_checkpoints(
+    project_root: Path,
+    run_manifest: str | Path,
+    before: Mapping[str, Mapping[str, Any]],
+    after: Mapping[str, Mapping[str, Any]],
+    *,
+    source: str,
+) -> list[str]:
+    """이 명령이 확정한 dispatch 마다 `phase-5-collect` 를 기록한다.
+
+    확정이 곧 체크포인트가 알리는 결과 검증이다: 필요한 산출물이 있고, 변경 감사를
+    통과했고, 결과가 dispatch 에 연결됐거나(`dispatch_core._finish_attempt`),
+    attempt 가 `error` / `timeout` 으로 닫혔다.
+    """
+    lines = []
+    for key, record in after.items():
+        previous = before.get(key)
+        if previous is not None and _attempt(previous) == _attempt(record):
+            continue
+        lines.append(record_checkpoint(
+            project_root, run_manifest, "phase-5-collect", source=source,
+            worker=dispatch_worker_key(record),
+            fields=(("status", str(record.get("status"))),),
+        ))
+    return [line for line in lines if line]
+
+
+def _attempt(record: Mapping[str, Any]) -> int:
+    return int(record.get("attempt", 1))

package/runtime/python/okstra_ctl/dispatch_core.py

@@ -9,7 +9,7 @@ from dataclasses import dataclass, field, replace
 from datetime import datetime, timezone
 import os
 from pathlib import Path
-from typing import Any, Mapping, Sequence
+from typing import Any, Callable, Mapping, Sequence
 
 from .dispatch_state import abandon_agent_dispatch_attempt
 from .agent.invocation import invocation_input_digest
@@ -33,7 +33,7 @@ from .dispatch_state import (
     link_agent_dispatch_result as _link_agent_dispatch_result,
     missing_completion_paths as _missing_completion_paths,
     unusable_result_defect,
-    _dispatch_worker_key,
+    dispatch_worker_key,
     _plan_verify_result_aliases,
     mutate_team_state as _mutate_team_state,
     require_string as _require_string,
@@ -408,7 +408,17 @@ def build_dispatch_plan(
     )
 
 
-def dispatch_plan(plan: DispatchPlan, *, wait: bool = True) -> int:
+BeforeStart = Callable[["DispatchPlan"], None]
+
+
+def dispatch_plan(
+    plan: DispatchPlan, *, wait: bool = True, before_start: BeforeStart | None = None,
+) -> int:
+    """`before_start` 는 복구·검증을 통과한 plan 으로, 워커를 띄우기 직전에 한 번 불린다.
+
+    거부된 배치와 증거 보완으로 빠진 작업은 여기까지 오지 않으므로, 띄울 워커에
+    대한 사실(체크포인트)은 이 시점에 기록해야 실제로 뜬 워커만 남는다.
+    """
     plan = _recover_declaration_failures(plan)
     if not plan.jobs:
         return 0
@@ -416,21 +426,19 @@ def dispatch_plan(plan: DispatchPlan, *, wait: bool = True) -> int:
     _validate_report_writer_isolation(plan.jobs)
     _validate_implementation_phase_order(plan.jobs)
     _revalidate_plan_role_executions(plan)
-    if wait:
-        pane_backends = sorted(
-            {
-                job.backend
-                for job in plan.jobs
-                if job.backend == BACKEND_CMUX_PANE
-            }
+    pane_backends = sorted(
+        {job.backend for job in plan.jobs if job.backend == BACKEND_CMUX_PANE}
+    )
+    if wait and pane_backends:
+        raise DispatchError(
+            f"wait=True dispatch does not support {'/'.join(pane_backends)} "
+            "workers: the per-job blocking loop would serialize panes "
+            "instead of running them concurrently; dispatch panes with "
+            "wait=False"
         )
-        if pane_backends:
-            raise DispatchError(
-                f"wait=True dispatch does not support {'/'.join(pane_backends)} "
-                "workers: the per-job blocking loop would serialize panes "
-                "instead of running them concurrently; dispatch panes with "
-                "wait=False"
-            )
+    if before_start is not None:
+        before_start(plan)
+    if wait:
         _record_dispatch_facts(plan.team_state_path, _dispatch_mode(plan.jobs))
         for job in plan.jobs:
             result = _dispatch_job_with_retry(plan, job)
@@ -509,7 +517,9 @@ def _round_artifact_paths(plan: DispatchPlan) -> tuple[Path, ...]:
     )
 
 
-def dispatch_cli_wrapper_plan(plan: DispatchPlan) -> int:
+def dispatch_cli_wrapper_plan(
+    plan: DispatchPlan, *, before_start: BeforeStart | None = None,
+) -> int:
     """Start one dependency-free CLI batch before collecting any worker."""
     if any(job.backend != BACKEND_CLI_WRAPPER for job in plan.jobs):
         raise DispatchError("concurrent CLI dispatch requires cli-wrapper jobs only")
@@ -520,6 +530,8 @@ def dispatch_cli_wrapper_plan(plan: DispatchPlan) -> int:
     _validate_report_writer_isolation(plan.jobs)
     _validate_implementation_phase_order(plan.jobs)
     _revalidate_plan_role_executions(plan)
+    if before_start is not None:
+        before_start(plan)
     _record_dispatch_facts(plan.team_state_path, _dispatch_mode(plan.jobs))
     final_codes = _dispatch_cli_wrapper_batch(plan, plan.jobs)
     return next((final_codes[job.worker_id] for job in plan.jobs
@@ -1855,6 +1867,7 @@ def _canonical_write_contract(
     try:
         return build_invocation_write_contract(
             role=execution.role,
+            task_type=str(plan.manifest.get("taskType") or ""),
             project_root=plan.project_root,
             worktree=worktree,
             artifact_paths=artifacts,
@@ -2269,14 +2282,23 @@ def _mutation_failure_reason(mutation, outcome: WorkerOutcome | None = None) ->
     failure = _wrapper_failure_text(outcome)
     if failure:
         reason = f"{reason}: {failure}"
-    paths = list(mutation.changed_paths)
-    if not paths:
-        return reason
+    # 산출물 위반은 소스 변경 목록에 없다 — 그 목록만 보이면 정책 안에 있던
+    # 소스 파일을 범인으로 읽는다 (실측 2026-09-26, dev-11054 `qa/baseline/`).
+    for label, paths in (
+        ("outside artifact policy", mutation.violating_artifact_paths),
+        ("changed", mutation.changed_paths),
+    ):
+        if paths:
+            reason += f" [{label}: {_capped_path_list(paths)}]"
+    return reason
+
+
+def _capped_path_list(paths: Sequence[str]) -> str:
     shown = ", ".join(paths[:_MUTATION_REASON_PATH_LIMIT])
     remaining = len(paths) - _MUTATION_REASON_PATH_LIMIT
     if remaining > 0:
         shown += f", +{remaining} more"
-    return f"{reason} [changed: {shown}]"
+    return shown
 
 
 def _finish_attempt(
@@ -2751,7 +2773,7 @@ def _record_wrapper_failure(
             out_path=out_path,
             task_key=_string_value(plan.manifest.get("taskKey")),
             phase=_workflow_phase(plan.manifest),
-            agent=_error_log_agent(job.worker_id),
+            agent=_error_log_agent(job),
             agent_role=(
                 "report-writer"
                 if job.worker_id == REPORT_WRITER_WORKER_ID
@@ -2790,16 +2812,16 @@ def _job_stored_identity(job: WorkerJob, attempt: int) -> dict[str, Any]:
     }
 
 
-def _error_log_agent(worker_id: str) -> str:
-    """The error log's `--agent` enum value for a worker id.
+def _error_log_agent(job: WorkerJob) -> str:
+    """The error log's `--agent` enum value for a job.
 
-    The log's own allow-list is the authority on what it accepts; a worker whose
-    name is outside it is reported as such by `append_observed` rather than
-    silently rewritten into some other agent's records.
+    The enum is keyed by provider (`codex-worker`), not by worker id: a role
+    worker id such as `codex-verifier` produced `codex-verifier-worker`, which
+    the allow-list rejected, so no wrapper failure reached the log.
     """
-    if worker_id == REPORT_WRITER_WORKER_ID:
+    if job.worker_id == REPORT_WRITER_WORKER_ID:
         return REPORT_WRITER_WORKER_ID
-    return f"{worker_id}-worker"
+    return f"{job.provider}-worker"
 
 
 def _workflow_phase(manifest: Mapping[str, Any]) -> str:
@@ -3349,7 +3371,7 @@ def _record_missing_completion_paths(record: Mapping[str, Any]) -> tuple[Path, .
     result_path = Path(_string_value(record.get("resultPath")))
     worker_result = Path(_string_value(record.get("workerResultPath")))
     missing: list[Path] = []
-    worker_id = _dispatch_worker_key(record)
+    worker_id = dispatch_worker_key(record)
     dispatch_kind = _string_value(record.get("dispatchKind"))
     for path in _record_completion_paths(record):
         if path.is_file():
@@ -3366,7 +3388,7 @@ def _record_missing_completion_paths(record: Mapping[str, Any]) -> tuple[Path, .
 
 def _record_artifact_defects(record: Mapping[str, Any]) -> tuple[str, ...]:
     defect = unusable_result_defect(
-        _dispatch_worker_key(record),
+        dispatch_worker_key(record),
         Path(_string_value(record.get("resultPath"))),
         _string_value(record.get("dispatchKind")),
     )

package/runtime/python/okstra_ctl/dispatch_state.py

@@ -365,6 +365,12 @@ def resolve_required_path(
 def worktree_path(
     manifest: Mapping[str, Any], active_context: Mapping[str, Any]
 ) -> str:
+    # Must match the prompt's `**Worktree:**` anchor
+    # (`worker_prompt_headers._final_verification_target_headers`).
+    if manifest.get("taskType") == "final-verification":
+        target = active_context.get("verificationTarget")
+        if isinstance(target, Mapping) and target.get("worktreePath"):
+            return str(target["worktreePath"])
     worktree = active_context.get("executorWorktree")
     if not isinstance(worktree, Mapping):
         return ""
@@ -862,6 +868,7 @@ def _agent_write_contract(
     try:
         return build_invocation_write_contract(
             role=execution.role,
+            task_type=str(authority.get("taskType") or ""),
             project_root=project_root,
             worktree=worktree,
             artifact_paths=artifacts,
@@ -1626,12 +1633,12 @@ def record_dispatch_facts(team_state_path: Path, dispatch_mode: str) -> None:
     with _team_state_lock(team_state_path):
         payload = load_json_object(team_state_path, "team-state")
         payload["dispatchMode"] = dispatch_mode
-        if not _has_recorded_team_create(payload):
+        if not has_recorded_team_create(payload):
             payload["teamCreate"] = {"attempted": False, "status": "implicit"}
         write_json(team_state_path, payload)
 
 
-def _has_recorded_team_create(team_state: Mapping[str, Any]) -> bool:
+def has_recorded_team_create(team_state: Mapping[str, Any]) -> bool:
     existing = team_state.get("teamCreate")
     return (isinstance(existing, dict)
             and bool(str(existing.get("status") or "").strip()))
@@ -1771,7 +1778,7 @@ def worker_dispatch_records(
     집계, v2 명부 행 `scope` 는 `promptPath` 가 비어 0회).
 
     v1 행은 `workerId`, v2 행은 `assignmentRef` 마지막 마디로 워커에 묶인다
-    (`_dispatch_worker_key`). 리스트가 아니면 빈 결과 — `worker_session_ids`
+    (`dispatch_worker_key`). 리스트가 아니면 빈 결과 — `worker_session_ids`
     와 같은 이유로 호출자를 깨지 않는다.
     """
     dispatches = team_state.get("workerDispatches")
@@ -1779,13 +1786,13 @@ def worker_dispatch_records(
     for record in dispatches if isinstance(dispatches, list) else []:
         if not isinstance(record, Mapping):
             continue
-        if worker_id is not None and _dispatch_worker_key(record) != worker_id:
+        if worker_id is not None and dispatch_worker_key(record) != worker_id:
             continue
         records.append(record)
     return records
 
 
-def _dispatch_worker_key(record: Mapping[str, Any]) -> str:
+def dispatch_worker_key(record: Mapping[str, Any]) -> str:
     """The `workers[]` row a dispatch record belongs to.
 
     A v1 record names it as `workerId`. A v2 record carries execution identity

package/runtime/python/okstra_ctl/domain/provider.py

@@ -65,6 +65,9 @@ class ModelSpec:
     supported_roles: frozenset[str] | None
     selectable: bool
     pricing: Optional[tuple[float, float, float]]
+    # 이 모델을 실행할 때마다 공급자 CLI 에 덧붙는 인자. 사용자 CLI 설정에 맡기면
+    # 기계마다 달라지는 값(예: reasoning effort)을 카탈로그가 고정한다.
+    cli_args: tuple[str, ...]
 
     def __init__(
         self,
@@ -79,6 +82,7 @@ class ModelSpec:
         pricing: Optional[tuple[float, float, float]] = None,
         *,
         in_picker: bool | None = None,
+        cli_args: tuple[str, ...] = (),
     ) -> None:
         """Accept the former display/execution form while adapters migrate."""
         is_legacy = execution_value is _MISSING or not isinstance(execution_value, str)
@@ -102,6 +106,7 @@ class ModelSpec:
         object.__setattr__(self, "supported_roles", supported_roles)
         object.__setattr__(self, "selectable", selectable if in_picker is None else in_picker)
         object.__setattr__(self, "pricing", resolved_pricing)
+        object.__setattr__(self, "cli_args", cli_args)
 
     @property
     def display(self) -> str:

package/runtime/python/okstra_ctl/domain/worker_presentation.py

@@ -93,13 +93,18 @@ class SplitText:
     가야 하므로 종결 텍스트로 돌려주고, 진행은 기록과 화면에만 남는다.
     """
 
+    _answer: list[str] = field(default_factory=list, repr=False, compare=False)
+
     def merges_stderr(self) -> bool:
         return False
 
     def sinks(self, writer: TranscriptWriter) -> tuple[SinkSpec, ...]:
         def result(line: str) -> str | None:
             writer.write(WORKER, line)
-            return strip_terminal_colors(line)
+            # 러너는 마지막으로 돌려받은 값만 호출자에게 넘기므로, 그 줄이 아니라
+            # 지금까지의 답 전체를 돌려준다.
+            self._answer.append(strip_terminal_colors(line))
+            return "\n".join(self._answer).strip("\n") or None
 
         def progress(line: str) -> str | None:
             writer.write(WORKER, line)
@@ -140,6 +145,9 @@ class JsonEvents:
     _saw_conclusion: list[bool] = field(
         default_factory=list, repr=False, compare=False
     )
+    # 마지막 도구 호출 뒤에 온 산문. Result 없는 어휘에서는 이것이 최종 답이다.
+    _trailing_text: list[str] = field(default_factory=list, repr=False, compare=False)
+    _saw_result: list[bool] = field(default_factory=list, repr=False, compare=False)
 
     def merges_stderr(self) -> bool:
         return True
@@ -164,11 +172,17 @@ class JsonEvents:
             if not isinstance(event, dict):
                 return None
             self.observe(event)
-            if self.is_conclusion is not None and self.is_conclusion(event):
+            concludes = self.is_conclusion is not None and self.is_conclusion(event)
+            if concludes:
                 self._saw_conclusion.append(True)
             closing: str | None = None
             for entry in self.normalise(event):
                 closing = self._write_entry(writer, entry) or closing
+            if concludes and closing is None and not self._saw_result:
+                # 종결 표지가 본문을 싣지 않는 어휘다. 돌려줄 것이
+                # 없으면 quiet 호출자의 stdout 이 비고 답은 로그에만 남는다.
+                joiner = "" if self.join_adjacent_text else "\n"
+                closing = joiner.join(self._trailing_text).strip() or None
             return closing
 
         return (("stdout", emit),)
@@ -179,6 +193,10 @@ class JsonEvents:
     def _write_entry(
         self, writer: TranscriptWriter, entry: StreamEvent
     ) -> str | None:
+        if isinstance(entry, Text):
+            self._trailing_text.append(entry.body)
+        else:
+            self._trailing_text.clear()
         if isinstance(entry, Text) and self.join_adjacent_text:
             self._pending_text.append(entry.body)
             self._publish_complete_lines(writer)
@@ -197,6 +215,7 @@ class JsonEvents:
             # Result 이벤트는 어휘와 무관한 종결이다. 빈 결과 텍스트도 종결이므로
             # closing_text 의 진릿값과 따로 기록한다.
             self._saw_conclusion.append(True)
+            self._saw_result.append(True)
         return closing
 
     def _publish_complete_lines(self, writer: TranscriptWriter) -> None:

package/runtime/python/okstra_ctl/domain/write_policy.py

@@ -125,10 +125,11 @@ def validate_write_policy_payload(payload: Mapping[str, Any]) -> None:
     source = _mapping(payload.get("sourcePolicy"), "sourcePolicy")
     git = _mapping(payload.get("gitPolicy"), "gitPolicy")
     auxiliary = _mapping(payload.get("auxiliaryPolicy"), "auxiliaryPolicy")
-    if set(artifact) != {"allowedRoot", "allowedPaths"}:
+    if set(artifact) - {"preservedPaths"} != {"allowedRoot", "allowedPaths"}:
         raise WritePolicyError("artifactPolicy is incomplete")
     _absolute_text(artifact.get("allowedRoot"), "artifactPolicy.allowedRoot")
     _relative_paths(artifact.get("allowedPaths", ()))
+    _relative_paths(artifact.get("preservedPaths", ()))
     if source.get("mode") not in {"source-readonly", "project-mutation"}:
         raise WritePolicyError("sourcePolicy mode is invalid")
     if set(source) - {"plannedPathsDeclared"} != {

package/runtime/python/okstra_ctl/execution_mutation_audit.py

@@ -123,6 +123,7 @@ class MutationAuditResult:
     declared_out_of_plan_paths: tuple[str, ...] = ()
     unobserved_artifact_paths: tuple[str, ...] = ()
     external_workspace_changes: tuple[str, ...] = ()
+    violating_artifact_paths: tuple[str, ...] = ()
 
     def change_summary(self) -> dict[str, Any]:
         return {
@@ -140,6 +141,7 @@ class MutationAuditResult:
             "declaredOutOfPlanPaths": list(self.declared_out_of_plan_paths),
             "unobservedArtifactPaths": list(self.unobserved_artifact_paths),
             "externalWorkspaceChanges": list(self.external_workspace_changes),
+            "violatingArtifactPaths": list(self.violating_artifact_paths),
             "beforeDigest": self.before_digest,
             "afterDigest": self.after_digest,
         }
@@ -242,10 +244,11 @@ class ExecutionMutationAudit:
             rows,
             source_changes,
         )
-        artifact_failures, untracked_artifact_changes, switched, external = (
+        violating_artifacts, untracked_artifact_changes, switched, external = (
             _artifact_policy_failures(before, rows, artifact_changed, after=after)
         )
-        violations.extend(artifact_failures)
+        if violating_artifacts:
+            violations.append("artifact-root change exceeds batch policy union")
         worker_artifact_changes = {
             path for path in artifact_changed
             if path not in untracked_artifact_changes and path not in switched and path not in external
@@ -287,6 +290,7 @@ class ExecutionMutationAudit:
             declared_out_of_plan_paths=tuple(out_of_plan_edits),
             unobserved_artifact_paths=tuple(sorted(unobserved)),
             external_workspace_changes=tuple(sorted(external)),
+            violating_artifact_paths=tuple(sorted(violating_artifacts)),
         )
 
 
@@ -784,8 +788,8 @@ def _artifact_policy_failures(
     changed: set[str],
     *,
     after: MutationSnapshot | None = None,
-) -> tuple[list[str], set[str], set[str], set[str]]:
-    """위반·비추적 파일·브랜치 전환·외부 작업공간 관측을 분리한다.
+) -> tuple[set[str], set[str], set[str], set[str]]:
+    """위반 경로·비추적 파일·브랜치 전환·외부 작업공간 관측을 분리한다.
 
     작업트리와 기본 체크아웃이 다르면 기본 체크아웃 소스의 변경 주체는
     전후 비교로 판단할 수 없다. 배정된 산출물 밖의 변경은 관측으로 남기고,
@@ -797,10 +801,18 @@ def _artifact_policy_failures(
         for value in snapshot.orchestrator_paths
         if _is_relative_to(Path(value), snapshot.artifact_root)
     }
+    preserved = {
+        path
+        for policy in policies
+        for path in policy.artifact_policy.get("preservedPaths", ())
+    }
     unauthorized = {
         path for path in changed
-        if not any(_is_within(path, item) for item in allowed)
-        and not any(_is_within(path, item) for item in orchestrator)
+        if path in preserved
+        or (
+            not any(_is_within(path, item) for item in allowed)
+            and not any(_is_within(path, item) for item in orchestrator)
+        )
     }
     if snapshot.artifact_root == snapshot.root:
         unauthorized = {path for path in unauthorized if _is_within(path, _OKSTRA_ARTIFACT_SUBTREE)}
@@ -826,8 +838,7 @@ def _artifact_policy_failures(
         and not _is_within(path, _OKSTRA_ARTIFACT_SUBTREE)
     }
     violating = unauthorized - untracked_outside - switched - external
-    failures = ["artifact-root change exceeds batch policy union"] if violating else []
-    return failures, untracked_outside, switched, external
+    return violating, untracked_outside, switched, external
 
 
 def _branch_switch_paths(

package/runtime/python/okstra_ctl/initial_prompt_materialization.py

@@ -44,8 +44,10 @@ from .worker_prompt_headers import source_worktree_headers, worker_prompt_header
 from .worker_prompt_policy import (
     APPROVED_PLAN_HEADER,
     IMPLEMENTATION_STAGE_HEADER,
+    STAGE_QA_OWNER_HEADER,
     PromptPlan,
     resolve_prompt_plan_for_manifest,
+    stage_qa_owner,
 )
 
 
@@ -1469,6 +1471,9 @@ def _implementation_anchor_lines(
     lines.append(
         f"{IMPLEMENTATION_STAGE_HEADER} {_required_stage_number(context)}"
     )
+    owner = stage_qa_owner(context.manifest)
+    if plan.audience == "implementation-verifier" and owner:
+        lines.append(f"{STAGE_QA_OWNER_HEADER} {owner}")
     return lines
 
 

package/runtime/python/okstra_ctl/lead_progress.py

@@ -220,6 +220,38 @@ def record_progress(
     return event, warning
 
 
+def record_checkpoint(
+    project_root: Path,
+    run_manifest: str | Path,
+    phase: str,
+    *,
+    source: str,
+    worker: str | None = None,
+    fields: Sequence[tuple[str, str]] = (),
+) -> str | None:
+    """단계를 수행하는 명령이 체크포인트를 기록하고 그 줄을 돌려준다.
+
+    기록이 실패해도 그 기록이 붙은 dispatch·await·reclaim·finalize 는 실패시키지
+    않는다. 장부 한 줄 때문에 작업 자체를 잃는 쪽이 더 나쁘다. 실패는 stderr 에
+    출력하고, 이후 검증기가 체크포인트 누락으로 보고한다.
+    """
+    root = project_root.resolve()
+    try:
+        event, warning = record_progress(
+            root,
+            _resolve_project_path(root, run_manifest),
+            phase,
+            worker=worker,
+            fields=fields,
+        )
+    except (ProgressRecordError, OSError) as exc:
+        print(f"{source}: could not record `{phase}`: {exc}", file=sys.stderr)
+        return None
+    if warning:
+        print(f"{source}: {warning}", file=sys.stderr)
+    return str(event.details["line"])
+
+
 def _append(args: argparse.Namespace) -> int:
     fields = [_parse_field(raw) for raw in args.field]
     event, warning = record_progress(
@@ -243,7 +275,7 @@ def _append(args: argparse.Namespace) -> int:
 
 _CLI_EPILOG = r"""Usage:
   okstra lead-progress append --project-root <dir> --run-manifest <path> --phase phase-1-intake
-  okstra lead-progress append --project-root <dir> --run-manifest <path> --phase phase-4-dispatch --worker codex-worker --field model=gpt-6-sol
+  okstra lead-progress append --project-root <dir> --run-manifest <path> --phase phase-4-dispatch --worker codex-worker --field model=gpt-6.1-sol
   okstra lead-progress append --project-root <dir> --run-manifest <path> --phase phase-5-collect --worker codex-worker --field status=completed
 
 `progressLine` in the output is the line to emit to the user, verbatim.