okstra 0.206.1 → 0.207.1

package/runtime/python/okstra_ctl/manager_view.py

@@ -41,11 +41,16 @@ def _table(headers: tuple[str, ...], rows: list[list[str]], empty: str) -> str:
     if not rows:
         return f'<p class="empty">{_e(empty)}</p>'
     head = "".join(f"<th>{_e(header)}</th>" for header in headers)
-    body = "".join("<tr>" + "".join(f"<td>{cell}</td>" for cell in row) + "</tr>" for row in rows)
+    body = "".join(
+        "<tr>"
+        + "".join(f'<td data-label="{_e(header)}">{cell}</td>' for header, cell in zip(headers, row))
+        + "</tr>"
+        for row in rows
+    )
     return f'<div class="scroll"><table><thead><tr>{head}</tr></thead><tbody>{body}</tbody></table></div>'
 
 
-def _file_link(project_root: str, path: str) -> str:
+def _file_link(project_root: str, path: str, label: str) -> str:
     """하위 프로젝트 기준 상대 경로를 절대 file 링크로 바꾼다. 빈 값은 `-`."""
     if not path:
         return "-"
@@ -53,8 +58,8 @@ def _file_link(project_root: str, path: str) -> str:
     if not target.is_absolute() and project_root:
         target = Path(project_root) / target
     if not target.is_absolute():
-        return f"<code>{_e(path)}</code>"
-    return f'<a href="{_e(target.as_uri())}"><code>{_e(path)}</code></a>'
+        return f'<span title="{_e(path)}">{_e(label)}</span>'
+    return f'<a href="{_e(target.as_uri())}" title="{_e(target)}">{_e(label)}</a>'
 
 
 def _command(*args: str) -> str:
@@ -81,7 +86,8 @@ def _projects_table(projects: list[dict]) -> str:
         ]
         for project in projects
     ]
-    return _table(("Project", "Root", "Role", "Tags", "Linked at"), rows, "No projects registered.")
+    table = _table(("Project", "Root", "Role", "Tags", "Linked at"), rows, "No projects registered.")
+    return f'<div class="projects">{table}</div>'
 
 
 def _child_rows(children: list[dict], roots: dict[str, str]) -> list[list[str]]:
@@ -93,23 +99,30 @@ def _child_rows(children: list[dict], roots: dict[str, str]) -> list[list[str]]:
         assignment = " — ".join(part for part in (child.get("role"), child.get("assignment")) if part)
         # `task split` 하위 태스크는 assignment 대신 범위 목록을 가진다.
         assignment = assignment or "; ".join(child.get("scope") or [])
+        status_fields = (
+            ("Work status", child.get("workStatus") or "-"),
+            ("Phase", f"{phase} ({phase_state})" if phase and phase_state else phase or "-"),
+            ("Verdict", child.get("finalVerdict") or "-"),
+            ("Launch", launch.get("status") or "-"),
+        )
+        status = "".join(f"<dt>{_e(label)}</dt><dd>{_e(value)}</dd>" for label, value in status_fields)
+        links = "".join(
+            _file_link(root, str(path), label)
+            for root, path, label in (
+                ("", child.get("briefPath"), "Brief"),
+                (roots.get(str(child.get("projectId") or ""), ""), child.get("latestReportRecordPath"), "Latest report"),
+            )
+            if path
+        )
+        error = f'<p class="child-error"><strong>Error:</strong> {_e(child["error"])}</p>' if child.get("error") else ""
+        ticket = f'<strong class="child-ticket">{_e(child["ticketId"])}</strong>' if child.get("ticketId") else ""
         rows.append(
             [
-                f"<code>{_e(child.get('taskKey'))}</code>"
+                ticket + f"<code class=\"child-key\">{_e(child.get('taskKey'))}</code>"
                 + ("" if child.get("projectLinked", True) else " " + _chip("unlinked")),
-                _e(child.get("ticketId") or "-"),
-                _chip(str(child.get("summaryBucket") or "planned")),
-                _e(child.get("workStatus") or "-"),
-                _e(f"{phase} ({phase_state})" if phase and phase_state else phase or "-"),
-                _e(child.get("finalVerdict") or "-"),
-                _e(launch.get("status") or "-"),
-                f'<span class="wrap">{_e(assignment or "-")}</span>',
-                _e(child.get("error") or "-"),
-                _file_link("", str(child.get("briefPath") or "")),
-                _file_link(
-                    roots.get(str(child.get("projectId") or ""), ""),
-                    str(child.get("latestReportRecordPath") or ""),
-                ),
+                _chip(str(child.get("summaryBucket") or "planned")) + f'<dl class="child-status">{status}</dl>',
+                f'<div class="child-assignment">{_e(assignment or "-")}</div>'
+                + error + (f'<div class="child-links">{links}</div>' if links else ""),
             ]
         )
     return rows
@@ -161,11 +174,11 @@ def _task_panel(home: Path, manager_id: str, task: dict, status: dict, roots: di
         f"<code>{_e(sync_command)}</code>, then re-run the view command.</p>"
     )
     children = _table(
-        ("Child", "Ticket", "Summary", "Work status", "Phase", "Verdict", "Launch", "Assignment", "Error",
-         "Brief", "Latest report"),
+        ("TaskID", "Status", "Assignment"),
         _child_rows(status["children"], roots),
         "No child tasks.",
     )
+    children = f'<div class="children">{children}</div>'
     directives = read_jsonl(directives_jsonl_path(home, manager_id, group, task_id))
     events = read_jsonl(events_jsonl_path(home, manager_id, group, task_id))
     details = (

package/runtime/python/okstra_ctl/model_io/lines.py

@@ -75,14 +75,31 @@ def _assignment_line(prefix: str, assignment: Mapping[str, Any], identifier: obj
 
 def _worker_assignment_lines(run: Mapping[str, Any]) -> str:
     assignments = run.get("workerAssignments")
-    if not isinstance(assignments, list):
-        return "- None\n"
     lines = [
         _assignment_line("Worker", assignment, assignment.get("workerId"))
-        for assignment in assignments
+        for assignment in (assignments if isinstance(assignments, list) else ())
         if isinstance(assignment, Mapping)
     ]
-    return "".join(lines) or "- None\n"
+    return "".join(lines + _critic_assignment_lines(run)) or "- None\n"
+
+
+def _critic_assignment_lines(run: Mapping[str, Any]) -> list[str]:
+    """Opt-in critics live only in `invocationAssignments`, never in `workerAssignments`.
+
+    The id is the assignment ref's last segment, the value team dispatch and
+    `optionalWorkerRoles[].workerId` use (`render._optional_worker_roles`).
+    """
+    assignments = run.get("invocationAssignments")
+    if not isinstance(assignments, Mapping):
+        return []
+    return [
+        _assignment_line(
+            "Worker", {"role": "critic", **assignment}, ref.rsplit("/", 1)[-1],
+        )
+        for ref, assignment in sorted(assignments.items())
+        if isinstance(ref, str) and ref.startswith("critic/")
+        and isinstance(assignment, Mapping)
+    ]
 
 
 def _worker_prompt_lines(run: Mapping[str, Any]) -> str:

package/runtime/python/okstra_ctl/models.py

@@ -35,7 +35,7 @@ IMPLEMENTATION_ROLES = frozenset({"executor", "verifier"})
 # Legacy role-keyed compatibility defaults. Canonical assignments resolve a
 # provider first and then use ProviderSpec.default_models for that role.
 ROLE_DEFAULTS = {
-    "lead": "opus", "claude": "opus", "codex": "gpt-6-sol",
+    "lead": "opus", "claude": "opus", "codex": "gpt-6.1-sol",
     "antigravity": "gemini-3.1-pro", "report-writer": "sonnet",
 }
 
@@ -65,6 +65,9 @@ def lead_launch_argv(
         argv.extend(launch.sandbox_waiver)
     if model:
         argv.extend([launch.model_flag, model])
+        spec = provider_spec(provider).models.get(model)
+        if spec is not None:
+            argv.extend(spec.cli_args)
     if session_id and launch.start_session_id_flag:
         argv.extend([launch.start_session_id_flag, session_id])
     if launch.prompt_flag:

package/runtime/python/okstra_ctl/operation_invocation.py

@@ -42,12 +42,14 @@ def resolve_operation_slots(
     *,
     contract_root: Path,
     pool: ModelPool,
+    count: int | None = None,
 ) -> Sequence[OperationSlot]:
     """작업 계약이 요구하는 칸과 각 칸의 모델.
 
     모델은 런과 같은 기본값 사슬에서 고른다. 서로 다른 모델 참조를 요구한
     수만큼 채우지 못하면 여기서 멈춘다 — 같은 모델을 반복하거나 워커 수를
-    줄이면 그 작업이 요구한 교차검증이 조용히 사라진다.
+    몰래 줄이면 그 작업이 요구한 교차검증이 조용히 사라진다. `count` 는
+    호출자가 계약 상한 안에서 명시적으로 고른 수다.
     """
     graph_root = ContractGraphRoot.from_base(contract_root)
     try:
@@ -63,7 +65,14 @@ def resolve_operation_slots(
             f"unknown operation: {operation_id} (known: {known})"
         )
     duty_id = str(operation.payload["dutyId"])
-    count = int(operation.payload["count"])
+    # 계약의 수는 상한이다. 더 적게 여는 것은 호출자가 명시할 때만이다.
+    ceiling = int(operation.payload["count"])
+    if count is None:
+        count = ceiling
+    elif not 1 <= count <= ceiling:
+        raise OperationPreparationError(
+            f"operation {operation_id!r} takes a count from 1 to {ceiling}, got {count}"
+        )
     role_id = graph.duties[duty_id].role_id
 
     candidates = pool.default_candidates(role_id)

package/runtime/python/okstra_ctl/phases/final_verification/profile.md

@@ -66,7 +66,7 @@
   - **Read-only command log**: any pre-existing test/validation command touched during this run MUST be listed with its exact command line and one honest status — `executed` (ran; carries its exit code) / `advisory` (external Tier 3 did not PASS; carries observed/expected results and remains user-owned) / `env-unavailable` (should run but cannot in this environment — missing replica DB, container, or service; carries the reason, never a faked pass) / `not-configured` (no such qa-command tier) / `rejected` (a mutating/denied token — skipped, carries the denied token). A check that could not run locally is recorded as `env-unavailable` or `advisory` according to the external QA policy — never silently dropped and never reported as `executed` with an invented exit code. Mutating-command prohibition is the shared read-only boundary (see Non-goals); it is not restated per row.
   - **Could-not-verify roll-up (§5.8.9)**: the template mechanically aggregates every not-confirmed check into one scannable list — `gap` requirement-coverage rows, `advisory` / `not-configured` / `env-unavailable` / `rejected` command rows, and `blocked` manual tests. You do not hand-author it, but you MUST give those rows their honest status so nothing unverified hides across sections: a check silently recorded as `executed`/`covered` will not surface in the roll-up. This is okstra's answer to "say what could not be verified this run."
   - **Routing recommendation**: this phase records the verdict, the blockers, the conditions, and the repair each blocker needs. The lead chooses the next phase from the `## final-verification` section of `prompts/lead/phase-routing.md`, which lists the allowed targets and the shape of `finalVerification.routingRecommendation`. Read that section before writing the field.
-  - **Verified-row recording** (both scopes): when the verdict is release-ready, the lead MUST run `okstra handoff record-verified --plan-run-root <plan-run-root> --stage <N> --report-path <final-report data.json path> --data-json <final-report data.json path>` and quote the command + exit code in the report. Pass the record path to both: the Markdown reading copy is rendered on request and does not exist in a finished run (ADR-0014), and the helper normalizes either path to the record anyway. A `whole-task` report clears every stage in its own `stageReports`, so run it **once per those stages** — each run writes that stage's row from this one report. Without those rows the stage is never offered a pull request, and release-handoff opens one PR per stage. The helper checks the latest verification manifest, task/stage identity, report pointer, prepared target, and recorded implementation commit. It records the captured commit and original verdict, including conditional acceptance conditions. A missing target or mismatched commit requires re-verification. Recording happens before final validation; eligibility is granted only after that verification passes validation. **Enforced:** `okstra_ctl.handoff_verification` validates the evidence, and `validators/validate-run.py` `_validate_verified_row_recorded` requires a `verified` row matching this report, captured commit, and verdict.
+  - **Verified-row recording** (both scopes): when the verdict is release-ready, `okstra report-finalize` writes the `verified` rows itself in its `record-verified` step, right before `validate-run`: it runs `okstra handoff record-verified` once per stage in this report's `stageReports`, with the final-report data.json as both report and record. The lead does not run `handoff record-verified` by hand; it needs the data.json that `report-finalize` assembles and `validate-run` reads the rows in the same call, so no lead step fits between them. Without those rows the stage is never offered a pull request, and release-handoff opens one PR per stage. The helper checks the latest verification manifest, task/stage identity, report pointer, prepared target, and recorded implementation commit, and records the captured commit and original verdict, including conditional acceptance conditions. A missing target or mismatched commit fails the step and requires re-verification. Eligibility is granted only after the verification passes validation. **Enforced:** `okstra_ctl.report_finalize._record_verified_stages` runs the step, `okstra_ctl.handoff_verification` validates the evidence, and `validators/validate-run.py` `_validate_verified_row_recorded` fails the run (blocking, `okstra_ctl.blocking_checks`) when a cleared stage has no `verified` row matching this report, captured commit, and verdict.
 - Clarification request policy (phase-specific addendum — shared policy is in `_common-contract.md`):
   - populate `## 1. Clarification Items` only when a blocker hinges on information only the user can supply (deployment intent, intended target environment, business-rule interpretation); use `Blocks=next-phase` for items that gate continuing to release-handoff
 - Self-review pass before finalising the report (the Okstra lead runs this; do not delegate it):

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-executor.md

@@ -89,7 +89,7 @@ template's check; that template is gone.
   ```
 
   The file MUST NOT exist before the run starts (overwrite is refused — see `--force-stage` non-goal). **Enforced:** `validators/validate-run.py` `_validate_stage_carry_sidecar_exists` fails a run that declares `stageSidecarEvidence` without the file on disk. Transcribing the JSON into the report is not the same as writing it: `consumers` treats the carry file as the source of truth for marking the stage `done`, so a missing file leaves the stage permanently incomplete and blocks every dependent stage with a `PrepareError` — while this run reports success.
-- **Verifier gates are not yours to run (BLOCKING).** The self-mock detector (`validators/detect_self_mock.py`) belongs to the implementation verifier and is never delegated to you (`_implementation-verifier.md` §"Self-mock detection"). The coding-conventions preflight names it as the enforcement behind the no-self-mocking principle — that names who will check your diff, not a command for you to run. You MUST NOT invoke it and MUST NOT write `<task_root>/qa/self-mock-*.json`; running it early does not pre-satisfy the gate, because the verifier runs it again under its own duty. **Enforced:** that sidecar is not among the paths your attempt's `writePolicy.artifactPolicy.allowedPaths` carries, so the write audit closes the attempt as `error` with `artifact-root change exceeds batch policy union` (`scripts/okstra_ctl/execution_mutation_audit.py`) — a stage whose every gate passed still lands as a failed run. The same holds for the conformance results `<task_root>/qa/result-*.json`: you may run a conformance script to check your work, but the verifier records every result, including an earlier stage's result that your rewrite of its script made stale. When the approved plan tells you to write one, leave it and name it in your result as a plan step the verifier owns.
+- **Verifier gates are not yours to run (BLOCKING).** The self-mock detector (`validators/detect_self_mock.py`) belongs to the implementation verifier and is never delegated to you (`_implementation-verifier.md` §"Self-mock detection"). The coding-conventions preflight names it as the enforcement behind the no-self-mocking principle — that names who will check your diff, not a command for you to run. You MUST NOT invoke it and MUST NOT write `<task_root>/qa/self-mock-*.json`; running it early does not pre-satisfy the gate, because the verifier runs it again under its own duty. **Enforced:** that sidecar is not among the paths your attempt's `writePolicy.artifactPolicy.allowedPaths` carries, so the write audit closes the attempt as `error` with `artifact-root change exceeds batch policy union` (`scripts/okstra_ctl/execution_mutation_audit.py`) — a stage whose every gate passed still lands as a failed run. The same holds for the conformance results `<task_root>/qa/result-*.json`: you may run a conformance script to check your work — whatever it writes (a baseline capture, build logs) goes under `<task_root>/qa/output/`, the one qa directory besides `qa/scripts/` your attempt may write — but the verifier records every result, including an earlier stage's result that your rewrite of its script made stale. When the approved plan tells you to write one, leave it and name it in your result as a plan step the verifier owns.
 - **An external Tier 3 non-PASS does NOT withhold the carry evidence.** A Tier 3 entry whose `requires` include `http`, `external`, or `db` is advisory. Its FAIL, MISSING, no result, startup failure, or credential / network / service absence gets recorded honestly — exact command, exit code, output tail, marked `ADVISORY` in `Validation evidence` — and you emit the carry evidence anyway. Only Tier 1 and Tier 2 failures withhold it. Withholding on an external result is what actually blocks the stage: the carry file is the only thing that can mark a stage `done`, the verifier re-runs that same command from the host (where a call your sandbox could not complete often passes), and a stage the verifier then PASSes can never be closed because its evidence was never written.
 - **Reverse link (BLOCKING).** The runtime already appended a `status:"started"` row for this stage before the run began. The terminal row belongs to the lead's post-stage persistence and is verdict-gated — `status:"done"` with `carry_path` on a non-`FAIL` verdict, `status:"failed"` on `FAIL` (`_implementation-deliverable.md` §"Lead post-stage persistence").
 - **No PR / push in this phase.** This run produces local commits, carry sidecar evidence, verifier results, and the implementation final report only. Push and PR creation belong exclusively to the later `release-handoff` phase after `final-verification` returns `accepted`.

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-verifier.md

@@ -48,7 +48,15 @@ Verifier obtains the QA command set from exactly two declared sources, in order
 
 ### Execution rule
 
-Tier 1 commands run verbatim first. Then every Tier 2 entry runs once. Then the Tier 3 stage conformance script (below) runs once. Then the self-mock detector (below) runs once whenever the diff changed a test file. Each command runs in the worktree cwd, and is recorded in the worker result with its exact command line, exit code, and the tail of stdout/stderr. Substituting or paraphrasing a Tier 1 command is forbidden (see Verifier-specific forbidden actions below).
+Tier 1 commands run verbatim first. Then every Tier 2 entry runs once. Then the Tier 3 stage conformance script (below) runs once. Then the self-mock detector (below) runs once whenever the diff changed a test file. Those last two are run by the stage QA owner only (next section). Each command runs in the worktree cwd, and is recorded in the worker result with its exact command line, exit code, and the tail of stdout/stderr. Substituting or paraphrasing a Tier 1 command is forbidden (see Verifier-specific forbidden actions below).
+
+### Stage QA owner
+
+Every verifier of this stage runs in the same worktree at the same time. Two checks change that worktree while they run: a Tier 3 conformance script may build into it (`.next/`, `dist/`) or bind fixed ports, and the self-mock detector's mutation probe rewrites production sources in place (cosmic-ray) or replaces a report file inside the worktree (Stryker). Run concurrently, they corrupt each other's result and the other verifiers' test runs (observed 2026-09-26, fontsninja-v3-site dev-11054 stage 1: `next build` + `next start -p 3000` + a proxy on 8889 from three verifiers at once).
+
+Your prompt carries a `**Stage QA owner:**` anchor naming one worker id. If that id is yours (the `<id>` in your `**Model:** <id> worker` line), you run Tier 3 and the self-mock detector as the two sections below describe. Otherwise you run neither and write neither sidecar; each section says what to record instead. A prompt with no such anchor predates this rule: run both yourself.
+
+**Enforced:** the anchor is generated (`scripts/okstra_ctl/worker_prompt_policy.py` `stage_qa_owner`, the first verifier in roster order). If the owner is never dispatched, no sidecar is written and the existing gates report it: a missing conformance result is BLOCKING for an `io`-only entry and ADVISORY for an external one (`scripts/okstra_ctl/conformance.py` `decide_conformance_gate`), and a missing self-mock sidecar blocks when the diff changed a test file (`validators/validate-run.py` `_validate_selfmock`). Nothing checks which verifier's log holds the commands.
 
 ### Tier 3 — stage conformance scripts
 
@@ -75,6 +83,7 @@ lock the core, gate, and accepted-report behavior respectively.
 An `io`-only non-PASS remains BLOCKING. Manifest/schema/source-mutation defects
 also remain contract violations.
 
+- **Owner only.** This section is the stage QA owner's (§ Stage QA owner above). A verifier that is not the owner runs no `runCommand`, writes no `result-*.json`, logs `conformance: owned by <worker-id> — not run`, and judges Tier 3 only from the diff and the manifest entry (declaration, `requires` coverage).
 - **Source.** The conformance manifest is `<task_root>/qa/conformance-manifest.json` (the directory is the `TASK_QA_PATH` token). This run's stage conformance entry is the manifest `entries[]` item whose `stageKey` equals this run's stageKey — `<task-id>-stage-<N>`, where `<N>` is the injected Stage number. Find that one entry. Also run every other entry whose `script` appears in this stage's `plannedPaths`: this stage rewrote that script, so the result its own stage recorded is stale, and you write that entry's result sidecar exactly as below. Ignore the rest (other stages are run by their own implementation runs or by final-verification).
 - **Exemption / waiver → do NOT run.** If the entry carries an `exemption` (or a user `waiver`), the verifier does NOT execute the script. It records the fact and the reason (`exemption.reason` / `waiver.reason` + `waiver.acknowledgedBy`) in the Read-only command log AND writes the result sidecar reflecting the skip. An `exemption` passes outright. An external-advisory waiver is reported as `ADVISORY` with `conditional=false`; only an `io`-only blocking waiver is conditional. An empty `requires` list cannot be waived; it is declaration/contract trouble and remains BLOCKING. No script runs in either permitted waiver case.
 - **Otherwise run `runCommand` in the worktree cwd.** Execute the entry's `runCommand` verbatim from the worktree cwd. Inject env from `<PROJECT_ROOT>/.okstra/project.json`'s `qaEnv` (replica DB DSN / app base URL / env file — declared in Phase 4e). This is a **replica / test environment only** path — never run it against shared / staging / prod, identical to the DB real-execution gate principle above.
@@ -96,6 +105,7 @@ also remain contract violations.
 
 A green suite does not prove a test exercises the unit it names — a test that stubs its own SUT passes forever, including after the real implementation is deleted. The static detector is the machine half of the **Self-mocking** blocking check below, and running it is the verifier's own duty: it is never delegated to the executor and never inferred from the executor's evidence.
 
+- **Owner only.** The detector is the stage QA owner's (§ Stage QA owner above). A verifier that is not the owner does not run it and writes no `self-mock-*` file; it logs `self-mock detector: owned by <worker-id> — not run` and still performs the **Self-mocking** blocking check below by reading the changed tests.
 - **Trigger.** This run's diff changed at least one **test** file. Enumerate the changed files with `git diff --name-only <base>...HEAD` from the worktree cwd — the same enumeration the static review's Scope rule uses — then keep only the paths the gate itself treats as tests: `*.spec.*`, `*.test.*`, a `test_`-prefixed basename, a `_test.` suffixed basename, or any path segment `test/` or `tests/`. Pass nothing else; non-test files are excluded. Exclude `tests/fixtures/self_mock/**` as well — those are the detector's own deliberately self-mocked fixtures, which `validate-run.py` also excludes from the trigger, so feeding them in would manufacture a `FAIL` the gate then blocks on. No changed test file → no run and no sidecar; the gate is vacuous by design.
 - **Run the detector once, in the worktree cwd**, one `--test-file` per changed test file:
   ```bash
@@ -158,7 +168,7 @@ Tier 3 external-advisory discrepancies are excluded from this promotion: preserv
 
 ### Read-only command log (per verifier)
 
-The worker result MUST contain a `Read-only command log` block listing every command executed during the verifier run with its exact invocation and exit code, in execution order — including the Tier 3 conformance `runCommand` (or the exemption/waiver skip note when no script ran). No source-mutating command may appear in this block; the only permitted mutations are a Tier 3 conformance script writing to its `qaEnv` replica datastore and the self-mock detector writing its own `<task_root>/qa/self-mock-*.json` sidecar — both are artifact-directory writes, both are logged like any other command, and neither touches the worktree source, so the verifier runs them without hesitation. This log is copied into the final report's verifier result section verbatim.
+The worker result MUST contain a `Read-only command log` block listing every command executed during the verifier run with its exact invocation and exit code, in execution order — including the Tier 3 conformance `runCommand` (or, when no script ran, the exemption/waiver skip note or the not-the-owner note), and the self-mock detector invocation (or the not-the-owner note). No source-mutating command may appear in this block; the only permitted mutations are a Tier 3 conformance script writing to its `qaEnv` replica datastore and the self-mock detector writing its own `<task_root>/qa/self-mock-*.json` sidecar — both are artifact-directory writes, both are logged like any other command, and neither touches the worktree source, so the verifier runs them without hesitation. This log is copied into the final report's verifier result section verbatim.
 
 **Enforced:** `_validate_verifier_command_log_is_read_only` in `validators/validate-run.py` scans every `verifierResults[].readOnlyCommandLog` for mutation modes (`--fix`, `--write`, `gofmt -w`, `jest -u`, snapshot/golden updates, `cargo insta accept`, a non-`no` `INSTA_UPDATE`, and a trailing `|| true`) and fails the run. Check-only forms (`--check`, `--check-only`) pass.
 
@@ -207,7 +217,8 @@ diff re-buys wall-clock without new information, so the static scope narrows —
 the command re-run does not:
 
 - **Command re-run stays full.** Every Tier 1/2/3 command from the plan's
-  validation set runs end-to-end exactly as in a first run. QA-RESULT gating
+  validation set runs end-to-end exactly as in a first run (Tier 3 and the self-mock
+  detector by the stage QA owner only, as in a first run). QA-RESULT gating
   (`validate-run.py` Tier 3) is unchanged.
 - **Static design & test-quality sweep narrows to the fix diff.** Enumerate
   `git diff <prev-head>..HEAD` (the `Previous run HEAD` line of the Fix-Run

package/runtime/python/okstra_ctl/phases/implementation_option_selection/profile.md

@@ -14,7 +14,7 @@
   - Apply the shared reporter-confirmation precondition exactly as written. Unresolved `intent-check:` and `conversion-block:` rows use `Blocks=next-phase`.
   - Treat each stable brief end-state ID as a required evaluation target. A missing ID is a preparation failure; do not invent a replacement requirement.
 - Worker direction-selection procedure:
-  - In `candidate-comparison` mode, produce candidate, supporting and contradicting evidence, criterion scores, and requirement mappings. For every candidate, state one feasibility verdict — `feasible`, `not-feasible`, or `uncertain` — with a one-sentence rationale and the strongest counterevidence, each citing inspected evidence. The report's `feasibilityVotes` row for this worker is built from that statement, so a candidate without one leaves the writer nothing but another worker's words.
+  - In `candidate-comparison` mode, produce candidate, supporting and contradicting evidence, criterion scores, and requirement mappings. For every candidate, state one feasibility verdict — `feasible`, `not-feasible`, or `uncertain` — with a rationale and the strongest counterevidence, each citing inspected evidence. Write the rationale as long as the argument needs: say why each cited finding supports the verdict, not only which findings do. The report's `feasibilityVotes` row for this worker is built from that statement, so a candidate without one leaves the writer nothing but another worker's words.
   - In `candidate-comparison` mode only, submit at most three candidates. A candidate must be feasible from inspected evidence, not from an assumed future change.
   - In `preselected-validation` mode, receive one preselected direction from the lead and validate its evidence, counterevidence, criterion scores, and requirement mappings, and state the same feasibility verdict with its rationale and counterevidence. The worker must not generate new candidates.
   - Do not produce detailed file lists, stage maps, execution commands, or a plan approval request.

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -163,7 +163,7 @@ Plan for the actual worktree layout before approval. Shared documentation direct
         unavailable environment is a user-owned follow-up, never a plan approval or
         later run blocker. `requires=[]` and `requires=[io]` remain blocking.
         Remote IO should also declare `external`.
-      Layout split (not this phase's writes): executable scripts (conformance + any real-IO test) live under `<task_root>/qa/scripts/`; data sidecars (`conformance-manifest.json`, `result-*.json`) stay at the `qa/` root. The implementer writes the scripts and the manifest entry. Only the implementation verifier writes `result-*.json`, including the result of an earlier stage's entry whose script this stage rewrites, so a step never assigns a result file to the implementer and never lists one in `plannedPaths`. This declaration is enforced at four layers: `validators/validate-implementation-plan-stages.py` check **S11** forces every stage to carry one of the two lines; at the planning boundary `scripts/okstra_ctl/phases/implementation_planning/plan_body.py` `_validate_planning_conformance_declared` accepts a well-formed `Conformance tests:` line even when the script file and manifest entry are absent (malformed `requires` still fails); the matching `implementation` stage run that inherited `Conformance tests:` fails closed when the script file is missing (`_validate_conformance`); and the manifest JSON structure — including each entry's `script` living under `qa/scripts/` and a `runCommand` that does not change cwd — is enforced by `validate_conformance_manifest` when the implementer writes the entry.
+      Layout split (not this phase's writes): executable scripts (conformance + any real-IO test) live under `<task_root>/qa/scripts/`; data sidecars (`conformance-manifest.json`, `result-*.json`) stay at the `qa/` root. A step that runs a script writing its own files (a baseline capture, a `--compare` target, build logs) points those paths at `<task_root>/qa/output/`: it is the only other qa directory the implementer's write audit accepts, and any other qa path discards the attempt (`scripts/okstra_ctl/write_policy.py` `_role_qa_artifact_paths`; observed 2026-09-26, dev-11054 stage 1, `qa/baseline/`). The implementer writes the scripts and the manifest entry. Only the implementation verifier writes `result-*.json`, including the result of an earlier stage's entry whose script this stage rewrites, so a step never assigns a result file to the implementer and never lists one in `plannedPaths`. This declaration is enforced at four layers: `validators/validate-implementation-plan-stages.py` check **S11** forces every stage to carry one of the two lines; at the planning boundary `scripts/okstra_ctl/phases/implementation_planning/plan_body.py` `_validate_planning_conformance_declared` accepts a well-formed `Conformance tests:` line even when the script file and manifest entry are absent (malformed `requires` still fails); the matching `implementation` stage run that inherited `Conformance tests:` fails closed when the script file is missing (`_validate_conformance`); and the manifest JSON structure — including each entry's `script` living under `qa/scripts/` and a `runCommand` that does not change cwd — is enforced by `validate_conformance_manifest` when the implementer writes the entry.
     - `### Stage Exit Contract` — predicted added/modified files, newly exposed identifiers/types/endpoints, downstream-usable resources.
     - `### Stage Validation` — pre / mid / post exact commands or observable outcomes for this stage only.
       - **Run-executable only (BLOCKING).** A `validationChecklist` row that carries `stageRefs` gates that stage's carry, so it MUST be executable by the implementation run itself — no deployment, no manual walk-through, no observation "by hand", no credentials the run does not hold. The implementation phase forbids deploys and holds no deploy credentials, so such a row can never pass and blocks a stage with zero code defects (observed: dev-10341 VC-013/VC-014). Manual or deployed-environment verification belongs in the brief's `External Gates` and final-verification's user-owned external QA — record it there without `stageRefs`. **Enforced:** `okstra_ctl.implementation_direction.validate_selected_direction_plan` (`stage_validation_executability_errors`) rejects stage-gating rows whose observation text requires a manual or deployed-environment step.

package/runtime/python/okstra_ctl/phases/technical_verification/profile.md

@@ -12,7 +12,7 @@
 1. Read the frozen technical input linked in the analysis packet. Preserve the source hash, candidate IDs and fact identities. `resolve_technical_verification_input` enforces same-task source ownership, schema validity, eligible technical facts and unresolved user-decision gates.
 2. Before executing a probe, write its plan under `experiments/<seq>/<worker-id>/`: hypothesis, procedure, commands, confirming and rejecting signals, environment, and inconclusive criteria. Retain the plan with the evidence.
 3. Create a separate source copy in that directory. Record the source commit and any uncommitted input differences. Read the project and task worktree as inputs; perform source edits, installations and builds only in your own copy. Do not share writable dependency directories or use real credentials. Use synthetic local accounts for request-boundary experiments.
-4. Preserve the baseline lockfile. When the hypothesis needs a deliberate dependency change, retain the resulting lockfile and diff, then use a frozen install against that experimental lockfile. Record command, working directory, stdout/stderr and exit code in run-local logs. Distinguish infrastructure failure from a falsified compatibility claim.
+4. Phase 7 removes every `node_modules` and `.next` directory under the run directory, so evidence must not live inside them. Preserve the baseline lockfile. When the hypothesis needs a deliberate dependency change, retain the resulting lockfile and diff, then use a frozen install against that experimental lockfile. Record command, working directory, stdout/stderr and exit code in run-local logs. Distinguish infrastructure failure from a falsified compatibility claim.
 5. Classify each fact as `supported`, `refuted`, `inconclusive` or `not-run` using the declared signals. A zero exit code alone does not establish compatibility. Record limitations and all failed or unavailable probes.
 6. During convergence, inspect plans and logs; rerun disputed probes in a separate copy when feasible. An independent report is not a substitute for command evidence.
 

package/runtime/python/okstra_ctl/process_group.py

@@ -0,0 +1,118 @@
+"""CLI 워커 프로세스 그룹의 메모리 상한과 종료 뒤 잔여 프로세스 정리.
+
+워커가 실행한 빌드는 워커와 같은 프로세스 그룹에 들어간다(`worker_runner` 가
+`start_new_session=True` 로 띄운다). fontsninja-v3-site 에서 Turbopack PostCSS 워커가
+57GB, `next build` 가 78GB 까지 커져 커널 패닉(watchdog timeout)이 났고, 본 프로세스가
+죽은 뒤에도 PostCSS 워커가 남아 계속 커졌다(2026-09-27).
+"""
+from __future__ import annotations
+
+import os
+import signal
+import subprocess
+from pathlib import Path
+
+from okstra_project.dirs import okstra_home, project_json_path
+
+from .json_boundary import JsonBoundaryError, load_owned_object
+
+CONFIG_KEY = "workerMemoryCapMb"
+# 이 프로젝트의 정상 `next build` 는 5.4–5.6GB 였다. 상한은 그보다 넉넉하되, 물리
+# 메모리가 작은 기기에서는 절반을 넘지 않게 한다.
+_DEFAULT_CEILING_BYTES = 8 * 1024 ** 3
+
+
+class MemoryCapConfigError(ValueError):
+    pass
+
+
+def physical_memory_bytes() -> int:
+    return os.sysconf("SC_PAGE_SIZE") * os.sysconf("SC_PHYS_PAGES")
+
+
+def memory_cap_bytes(project_root: Path, global_config_path: Path | None = None) -> int:
+    """워커 그룹 RSS 합계 상한. 0 은 감시하지 않음.
+
+    프로젝트 `.okstra/project.json` → `~/.okstra/config.json` → 기본값 순서다.
+    """
+    for label, path in (
+        ("project", project_json_path(project_root)),
+        ("global", global_config_path or okstra_home() / "config.json"),
+    ):
+        value = _configured_cap_mb(label, path)
+        if value is not None:
+            return value * 1024 ** 2
+    return min(_DEFAULT_CEILING_BYTES, physical_memory_bytes() // 2)
+
+
+def _configured_cap_mb(label: str, path: Path) -> int | None:
+    if not path.is_file():
+        return None
+    try:
+        payload = load_owned_object(path, artifact=f"{label} configuration")
+    except JsonBoundaryError as exc:
+        raise MemoryCapConfigError(f"{label} config is unreadable: {path}") from exc
+    value = payload.get(CONFIG_KEY) if isinstance(payload, dict) else None
+    if value is None:
+        return None
+    if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+        raise MemoryCapConfigError(
+            f"{CONFIG_KEY} must be a non-negative integer (MB), got {value!r}: {path}")
+    return value
+
+
+def group_rss_bytes(pgid: int) -> int:
+    """프로세스 그룹 `pgid` 에 속한 프로세스들의 RSS 합계."""
+    try:
+        output = subprocess.run(
+            ["ps", "-A", "-o", "pgid=,rss="],
+            capture_output=True, text=True, check=True,
+        ).stdout
+    except (OSError, subprocess.CalledProcessError):
+        return 0
+    total_kb = 0
+    for row in output.splitlines():
+        fields = row.split()
+        if len(fields) == 2 and fields[0] == str(pgid) and fields[1].isdigit():
+            total_kb += int(fields[1])
+    return total_kb * 1024
+
+
+def kill_group(pgid: int) -> bool:
+    """그룹에 남은 프로세스를 SIGKILL 한다. 보낼 대상이 있었으면 True."""
+    try:
+        os.killpg(pgid, signal.SIGKILL)
+    except ProcessLookupError:
+        return False
+    return True
+
+
+class MemoryWatch:
+    """주기적으로 그룹 RSS 를 재고, 상한을 넘으면 그룹을 죽인다."""
+
+    interval_seconds = 2.0
+
+    def __init__(self, cap_bytes: int) -> None:
+        self.cap_bytes = cap_bytes
+        self.exceeded_bytes = 0
+        self._next_sample = 0.0
+
+    def check(self, pgid: int, now: float) -> bool:
+        """상한을 넘어 그룹을 죽였으면 True."""
+        if not self.cap_bytes or self.exceeded_bytes or now < self._next_sample:
+            return False
+        self._next_sample = now + self.interval_seconds
+        rss = group_rss_bytes(pgid)
+        if rss <= self.cap_bytes:
+            return False
+        self.exceeded_bytes = rss
+        kill_group(pgid)
+        return True
+
+    def failure(self) -> str:
+        mb = 1024 ** 2
+        return (
+            f"memory-cap exceeded: worker process group used {self.exceeded_bytes // mb} MB, "
+            f"cap {self.cap_bytes // mb} MB ({CONFIG_KEY} in .okstra/project.json "
+            "or ~/.okstra/config.json)"
+        )

package/runtime/python/okstra_ctl/render.py

@@ -2787,8 +2787,12 @@ def inject_lead_prompt_computed_tokens(ctx: dict) -> None:
             "`shutdown_workers`, `record_lead_event`, and `collect_usage` only "
             "through its mapping.\n"
             "- Do not call a primitive documented by an unselected adapter.\n"
-            "- Record the adapter-required Phase 3 state and emit the canonical "
-            "`PROGRESS: phase-3-team-create ...` checkpoint before dispatch.\n"
+            "- Record the adapter-required Phase 3 state. When team-state has "
+            "no `teamCreate` yet, do not append `phase-3-team-create`: the "
+            "first `team dispatch` (cmux-pane run) or `worker-dispatch` writes "
+            "the implicit-team marker, records the checkpoint and prints the "
+            "line to emit. Otherwise append `PROGRESS: phase-3-team-create ...` "
+            "before dispatch.\n"
             f"{adapter_setup_block}\n"
             "- The run manifest is authoritative for concurrent-run metadata, "
             "dispatch backend, and artifact paths."

package/runtime/python/okstra_ctl/report_assembly.py

@@ -163,12 +163,21 @@ def _clarifications(
         _clarification_row(row, activity_by_id, path)
         for row in active
     ]
-    rows.extend(_carried_clarification_rows(ledger, {row.get("id") for row in rows}, path))
+    superseded = {
+        cid
+        for row in active
+        if isinstance(row.get("resolutionInput"), Mapping)
+        for cid in row.get("supersedes") or []
+    }
+    rows.extend(_carried_clarification_rows(
+        ledger, {row.get("id") for row in rows}, path, superseded,
+    ))
     return rows
 
 
 def _carried_clarification_rows(
     ledger: Mapping[str, Any], seen_ids: set[object], path: Path,
+    superseded: set[str],
 ) -> list[dict[str, Any]]:
     """이월 결정은 active 질문이 아니다. 이번 런 활동 원장을 요구하지 않는다."""
     carried = ledger.get("carriedDecisions")
@@ -188,7 +197,13 @@ def _carried_clarification_rows(
         cid = decision.get("id")
         if cid in seen:
             continue
-        rows.append(_carried_clarification_row(decision))
+        row = _carried_clarification_row(decision)
+        if cid in superseded:
+            # 다음 run 의 seed 는 `obsolete` 행을 이월하지 않는다. `answered` 로
+            # 남기면 대체된 답과 대체한 답이 함께 이월된다.
+            row["status"] = "obsolete"
+            row.pop("resolution", None)
+        rows.append(row)
         seen.add(cid)
     return rows