okstra 0.207.1 → 0.209.0

package/runtime/schemas/convergence-groups-v2.0.schema.json

@@ -89,6 +89,13 @@
           "type": "array",
           "minItems": 1,
           "items": { "$ref": "#/$defs/SourceItem" }
+        },
+        "cellRefs": {
+          "description": "Coverage-census cells this finding answers (grouping Markdown `Cells:`). Optional: a finding outside the census has none.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^C-\\S+$" }
         }
       }
     },

package/runtime/skills/okstra-explain-flow/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: okstra-explain-flow
+description: Explain a product business flow across related projects, including inbound and outbound dependencies, business rules, states, errors, before/after changes, risks and side effects. Query or retry shared business explanations independently of okstra-run.
+---
+
+# Explain a Business Flow
+
+Use the user's business name or question as the investigation input. If the project is ambiguous, resolve the intended project before investigating. A task, brief, prior analysis or implementation is not required.
+
+Run the shared runtime from the project:
+
+```sh
+okstra explain-flow --question "<the user's business question>" --report-language <reader language> --host-runtime <current host runtime>
+```
+
+Use `claude-code`, `codex`, or the configured external host identifier. The runtime owns operation/model resolution, auditable invocation preparation, provider execution, source snapshots, validated result publication, shared knowledge and reports. Do not dispatch an unaudited replacement investigator or rerun an entire task when only an explanation failed.
+
+For relevant stored knowledge:
+
+```sh
+okstra explain-flow knowledge --query "<business question>"
+```
+
+For a failed or partial explanation:
+
+```sh
+okstra explain-flow rerun --execution <execution-id>
+```
+
+If the original task checkout has been removed, add `--source-root <available checkout>` to the retry. Preserve the original execution and its baseline.
+
+For current status:
+
+```sh
+okstra explain-flow status --execution <execution-id>
+```
+
+Read the returned human report. Explain the business findings, verified scope and gaps in the user's language. Link the returned report paths; do not assemble a guessed path. Distinguish static source inspection from actual execution evidence, expected changes, historical source versions and unresolved conflicts. Never report missing access as no impact.
+
+The investigation reads source, configuration, test bodies and explicitly supplied existing results. Its policy forbids executing tests, starting services, deploying, migrating or editing investigated projects. The report distinguishes that policy and the before/after source audit from an enforced write boundary. A report and a shared fact use the same accepted evidence. New runs retain prior reports and source baselines.
+
+Enforcement: `business_flow.engine` validates the result schema, source evidence and source stability before contribution; `agent.invocation` verifies standalone completion; `business_flow.store` preserves claim provenance and source versions. These behaviors are covered by `tests/run/test_business_flow.py` and existing invocation/JSON-boundary contract tests.

package/runtime/skills/okstra-inspect/facets/history.md

@@ -59,10 +59,9 @@ Builds a fresh run — new run-seq, new manifest, new report — using parameter
    - `taskType` → `--task-type`
    - `taskBriefPath` → `--task-brief`
 3. Optional arguments (include only when present in source):
-   - `Workers` → `--workers` (comma-separated provider ids; the projection already folds roster slot ids like `codex-verifier` down to their provider, so pass the line verbatim and never hand-assemble it from a roster)
-   - `relatedTasks` → `--related-tasks`
-   - model overrides → `--claude-model`, `--codex-model`, `--antigravity-model`
-   - for `taskType: implementation`: `teamContract.executor.provider` → `--executor <claude|codex|antigravity>` when different from `claude`.
+   - each `Role count` line → one `--role-count <role>=<N>` (only roles whose count can change appear)
+   - each `Role model` line → one `--role-model <role>=<provider>/<model>`, in the printed order (pass the values verbatim; never rebuild them from a roster)
+   - `Related tasks` → `--related-tasks`
 4. **`taskType: implementation` only — resolve `--base-ref`:** do not inspect the worktree registry. Omit `--base-ref` to reuse an existing registration. If the launch reports that no worktree is registered and a base is required, ask the user before retrying.
 5. Display the assembled command:
    ```bash
@@ -72,7 +71,8 @@ Builds a fresh run — new run-seq, new manifest, new report — using parameter
      --task-id <task-id> \
      --task-type <task-type> \
      --task-brief <brief-path> \
-     --workers <worker-list>
+     --role-count <role>=<N> \
+     --role-model <role>=<provider>/<model>
    ```
 6. Once the user confirms, execute it.
 

package/runtime/skills/okstra-run/SKILL.md

@@ -205,7 +205,7 @@ That is the entire interactive flow. The wizard handles:
 - base-ref pick + git rev-parse validation (skipped when reusing an active worktree),
 - `implementation`-only sub-flow: approved-plan path (frontmatter `approved: true` check) + stage pick (`auto` = the earliest incomplete stage whose dependencies are satisfied, or a specific stage number). Implementer slots use role-count / role-model like every other role (`executor` is only a compatibility alias for `implementer`). When an approved plan is selected and a `## PLAN DECISION` sidecar carrying `Status: approved`, exported from the report — matching the plan on source-report·seq — is detected in that run's sibling `user-responses/`, the approve-confirm step expands to 3 options (`yes_apply` recommended: approve + apply the option as exported / `yes` approve only / `no` abort) — `yes_apply` validates the option against the plan's `optionCandidates` before applying it via the existing approval·option path,
 - `release-handoff`-only sub-flow: after the approved plan auto-resolves, a `handoff_stage_pick` multi-select — choose the eligible stages to open a PR for, one PR per stage; the result goes out as render-args' `stages` key (csv; empty takes every eligible stage),
-- launch selection after identity/worktree steps: one screen per static role, in profile order. A role that can run several instances (`max > 1`) is a checkbox step `role-models:<role>` (`multi: true`) — the number of models checked is the number of instances, there is no separate count question; the label states the profile range and recommended count, every executable candidate is listed on that one screen (defaults first, the recommended set flagged), and when the list exceeds the host's native checkbox limit the runtime either splits it into several checkbox questions on one `pick_group` screen (interaction plan `native-group`; the question steps are `role-models:<role>#1`, `#2`, … and the answer is one JSON object keyed by them, each value a CSV) when the host's native question group holds every option, or returns the interaction plan `numbered-multi` — render the whole list, never a shortlist or pages. An optional role (`min = 0`, e.g. critic) carries a `추가 안 함` row. A fixed single role (`min = max = 1`, e.g. report-writer) is a single pick `role-model:<role>:1`, and a role capped at one model (`max = 1`, e.g. critic) is a single pick on its `role-models:<role>` step; both split the same way when they exceed the native option limit — the tabs are checkbox questions, the answer is the same keyed JSON object, and the wizard rejects a screen whose tabs together name more than one value. current-session lead is this session and is listed on the confirmation summary, not as a wizard step. The wizard does not fork on defaults-vs-customize, does not show a provider roster multi-pick, and does not offer a separate implementer-provider pick. Dynamic verifiers are not chosen at launch. `--workers` is compatibility-only, not a launch picker. Repeated `--role-count` / `--role-model` tokens on `renderArgv` are intentional,
+- launch selection after identity/worktree steps: one screen per static role, in profile order. A role that can run several instances (`max > 1`) is a checkbox step `role-models:<role>` (`multi: true`) — the number of models checked is the number of instances, there is no separate count question; the label states the profile range and recommended count, every executable candidate is listed on that one screen (defaults first, the recommended set flagged), and when the list exceeds the host's native checkbox limit the runtime either splits it into several checkbox questions on one `pick_group` screen (interaction plan `native-group`; the question steps are `role-models:<role>#1`, `#2`, … and the answer is one JSON object keyed by them, each value a CSV) when the host's native question group holds every option, or returns the interaction plan `numbered-multi` — render the whole list, never a shortlist or pages. An optional role (`min = 0`, e.g. critic) carries a `추가 안 함` row. A fixed single role (`min = max = 1`, e.g. report-writer) is a single pick `role-model:<role>:1`, and a role capped at one model (`max = 1`, e.g. critic) is a single pick on its `role-models:<role>` step; both split the same way when they exceed the native option limit — the tabs are checkbox questions, the answer is the same keyed JSON object, and the wizard rejects a screen whose tabs together name more than one value. current-session lead is this session and is listed on the confirmation summary, not as a wizard step. The wizard does not fork on defaults-vs-customize, does not show a provider roster multi-pick, and does not offer a separate implementer-provider pick. Dynamic verifiers are not chosen at launch. Repeated `--role-count` / `--role-model` tokens on `renderArgv` are intentional,
 - **resume-clarification (in-session equivalent)** — there is no separate mode or flag matching the shell's `okstra.sh --resume-clarification`; two steps of the standard flow carry out its substance. (1) `reuse_previous` (yes/no to reuse the previous run's settings — in `requirements-discovery` / `error-analysis` / `implementation-planning` / `project-analysis` / `feature-analysis` / `change-impact-analysis`, only when prior run-inputs exist): YES prefills role-count·role-model·directive·related-tasks at once (and, for the analysis types, the target and evidence inputs). (2) `clarification_pick`: a `revision-requested` analysis report for the selected analysis type is recommended first; otherwise the **task-type's own** previous `final-report` is auto-recommended as the carry-in input (for `technical-verification`, the `implementation-option-selection` report), falling back to the newest by mtime across all phases when absent — except for `implementation-planning` and `technical-verification`, which get no cross-phase fallback. The approved plan is never recommended here. The same run's `user-responses/` sidecar (answers the user filled in) is attached alongside. The chosen path is passed to prepare as `--clarification-response` — the user makes the sidecar via the report's `Export user response`, places it in `runs/<task-type>/user-responses/`, and re-runs the same phase,
 - **re-verification scope (`reverify_scope_pick`, `implementation-planning` clarification re-runs only)** — asked right before `confirm` when the re-run is narrowable **or** an answered `C-NNN` traces to no stage. When every answered id traces to a stage: 3 options — `auto` (recommended — leave it to the lead's `okstra incremental-scope` decision) / `full` (re-verify every stage) / Enter directly (a stage-number CSV, validated against the prior report's Stage Map). When an id is unlinked, `auto` is omitted and the user names stages or picks `full`; that unlinked id does not freeze the run at full. The answer goes out as `--reverify-scope` and reaches the lead prompt as the `REVERIFY_SCOPE_MODE` / `REVERIFY_SCOPE_STAGES` tokens; it shapes that CLI's inputs rather than replacing the decision. The confirmation block's `reverify-scope` line names unlinked ids as needing stage numbers, not as a forced full re-run,
 - `release-handoff` PR template override + persist scope,
@@ -271,7 +271,7 @@ Before invoking it, follow the active host relay's execution-permission guidance
 
 Analysis sidetracks therefore forward wizard-owned tokens such as `--analysis-target "<value>"` and `--evidence-inputs "<value>"` when they are present. These are examples of the verbatim token rule, not a separate hard-coded argument list.
 
-Step 3's empty-answer and escaping rules apply verbatim: every flag in `renderArgv` whose following value is the empty string MUST still be passed explicitly (e.g. `--workers ""`, `--directive ""`) — the wizard's intent is always "flag present with empty value", even where prepare's default happens to be the same empty value.
+Step 3's empty-answer and escaping rules apply verbatim: every flag in `renderArgv` whose following value is the empty string MUST still be passed explicitly (e.g. `--related-tasks ""`, `--directive ""`) — the wizard's intent is always "flag present with empty value", even where prepare's default happens to be the same empty value.
 
 `renderArgv` already contains exactly one `--lead-runtime <host-runtime>` pair. Do not add or replace it. Do not enumerate a fixed provider list in this skill because the wizard and role model pool own the ordered tokens.
 

package/runtime/templates/reports/business-flow.template.md

@@ -0,0 +1,106 @@
+# {{ flow.title }}
+
+{{ flow.summary }}
+
+- Mode: `{{ execution.request.mode }}`
+- Status: `{{ execution.status }}`
+- Execution: `{{ execution.id }}`
+{% if execution.request.baseline %}
+- Before-state explanation: `{{ execution.request.baseline }}`
+{% endif %}
+
+## Business terms
+{% for row in flow.terms %}
+- **{{ row.term }}**: {{ row.meaning }}
+{% endfor %}
+
+## Business steps
+{% for step in flow.steps %}
+### {{ loop.index }}. {{ step.title }}
+
+{{ step.purpose }}
+
+- Projects: {{ step.projectIds | join(', ') }}
+{% for field in ['inputs', 'outputs', 'rules', 'states', 'failures', 'retries', 'recovery', 'risks', 'sideEffects'] %}
+
+#### {{ field }}
+{% for value in step[field] %}
+- {{ value }}
+{% endfor %}
+{% endfor %}
+{% if step.before %}
+
+Before: {{ step.before }}
+{% endif %}
+{% if step.after %}
+
+After: {{ step.after }}
+{% endif %}
+
+Claim keys: {{ step.factKeys | join(', ') }}
+{% endfor %}
+
+## Related projects
+
+| From | To | Relationship | Business data | Claim keys |
+|---|---|---|---|---|
+{% for row in flow.relationships %}
+| {{ row.from | cell }} | {{ row.to | cell }} | {{ row.kind | cell }} | {{ row.data | cell }} | {{ row.factKeys | join(', ') | cell }} |
+{% endfor %}
+
+## Business facts and evidence
+{% for fact in flow.facts %}
+### {{ fact.key }}
+
+{{ fact.value }}
+
+Evidence level: `{{ fact.level }}`
+{% for evidence in fact.evidence %}
+
+- `{{ evidence.projectId }}:{{ evidence.path }}:{{ evidence.line }}-{{ evidence.endLine }}`
+
+```text
+{{ evidence.excerpt }}
+```
+{% endfor %}
+{% for receipt in fact.get('executionEvidence', []) %}
+- Existing execution record: `{{ receipt }}`
+{% endfor %}
+{% endfor %}
+
+## Source comparison
+{% for row in execution.changes %}
+- {{ row.projectId }}: {% if row.baselineAvailable %}baseline available{% else %}no comparison baseline{% endif %}
+{% for path in row.paths %}
+  - `{{ path }}`
+{% endfor %}
+{% endfor %}
+
+## Shared knowledge versions and conflicts
+{% for claim in claims %}
+- `{{ claim.key }}`: {{ claim.value }} ({{ claim.level }}; {{ claim.status }})
+  - Claim: `{{ claim.id }}`; producers: {{ claim.producers }}
+{% for projectId, state in claim.sourceStates.items() %}
+  - Source: `{{ projectId }}` at `{{ state.head }}`; fingerprint: `{{ state.digest }}`
+{% endfor %}
+{% endfor %}
+
+## Investigation limits
+
+Policy: `{{ execution.readOnlyAudit.policy }}`; enforced boundary: `{{ execution.readOnlyAudit.boundary }}`; audit coverage: `{{ execution.readOnlyAudit.coverage }}`.
+{% for surface in execution.readOnlyAudit.unobserved %}
+- Unobserved: {{ surface }}
+{% endfor %}
+{% if execution.get('reconciliation') %}
+- Reinvestigation: `{{ execution.reconciliation.executionId }}` ({{ execution.reconciliation.status }})
+{% endif %}
+
+## Unverified segments
+{% for gap in flow.gaps %}
+- {{ gap }}
+{% endfor %}
+
+## Unresolved business questions
+{% for question in flow.questions %}
+- {{ question }}
+{% endfor %}

package/runtime/templates/reports/html/base.template.html

@@ -44,6 +44,17 @@
   </header>
   <main id="main-content" data-report-role="human-main">
     {% block human_content %}{% endblock %}
+    {% if businessFlow | default([]) %}
+    <section data-report-section="business-flow">
+      <h2>Business Flow Explanations</h2>
+      {% for row in businessFlow %}
+      <p>{{ row.mode }}: {{ row.status }}. {{ row.summary }}</p>
+      <ul>{% for kind, path in row.reports.items() %}<li><a href="{{ path }}">{{ kind }}</a></li>{% endfor %}</ul>
+      {% if row.error %}<p>Explanation error: {{ row.error }}</p>{% endif %}
+      {% if row.id %}<p>Retry: <code>okstra explain-flow rerun --execution {{ row.id }}</code></p>{% endif %}
+      {% endfor %}
+    </section>
+    {% endif %}
     {% if endStates %}
     <section data-report-section="brief-end-states">
       <h2>{{ t('base.brief-end-states') }}</h2>
@@ -54,9 +65,11 @@
       </table>
     </section>
     {% endif %}
-    {% if crossVerification.get("consensus") or crossVerification.get("differences") %}
+    {% set no_cross_model_check = taskType != "release-handoff" and (crossVerification.get("roundHistory") or {}).get("round2SkippedReason") == "single-analyser-only" %}
+    {% if crossVerification.get("consensus") or crossVerification.get("differences") or no_cross_model_check %}
     <section data-report-section="cross-check">
       <h2>{{ t('base.cross-check') }}</h2>
+      {% if no_cross_model_check %}<p class="section-lede">{{ t('base.no-cross-model-check') }}</p>{% endif %}
       {% if crossVerification.get("consensus") %}
       <h3>{{ t('base.agreed-across-workers') }}</h3>
       <div class="summary-grid">{% for row in crossVerification.consensus %}<article class="summary-card" id="id-xv-{{ row.id }}"><p class="eyebrow">{{ row.id | inline_code }}</p><h3>{{ row.statement | inline_code }}</h3><p class="evidence-refs">{{ t('macros.layout.evidence') }} {{ row.evidence | inline_code }}</p></article>{% endfor %}</div>

package/runtime/templates/reports/html/business-flow.template.html

@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html lang="{{ execution.request.report_language }}">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>{{ flow.title }}</title><style>{{ css | safe }}</style></head>
+<body><main>
+<h1>{{ flow.title }}</h1><p>{{ flow.summary }}</p>
+<p>Mode: <code>{{ execution.request.mode }}</code> · Status: <code>{{ execution.status }}</code></p>
+{% if execution.request.baseline %}<p>Before-state explanation: <code>{{ execution.request.baseline }}</code></p>{% endif %}
+<h2>Business terms</h2><dl>{% for row in flow.terms %}<dt>{{ row.term }}</dt><dd>{{ row.meaning }}</dd>{% endfor %}</dl>
+<h2>Business steps</h2>
+{% for step in flow.steps %}
+<section id="step-{{ loop.index }}"><h3>{{ loop.index }}. {{ step.title }}</h3><p>{{ step.purpose }}</p><p>Projects: {{ step.projectIds | join(', ') }}</p>
+{% for field in ['inputs', 'outputs', 'rules', 'states', 'failures', 'retries', 'recovery', 'risks', 'sideEffects'] %}
+<h4>{{ field }}</h4><ul>{% for value in step[field] %}<li>{{ value }}</li>{% endfor %}</ul>
+{% endfor %}
+{% if step.before %}<p>Before: {{ step.before }}</p>{% endif %}{% if step.after %}<p>After: {{ step.after }}</p>{% endif %}
+<p>Claim keys: {{ step.factKeys | join(', ') }}</p></section>
+{% endfor %}
+<h2>Related projects</h2><table><thead><tr><th>From</th><th>To</th><th>Relationship</th><th>Business data</th><th>Claim keys</th></tr></thead><tbody>
+{% for row in flow.relationships %}<tr><td>{{ row.from }}</td><td>{{ row.to }}</td><td>{{ row.kind }}</td><td>{{ row.data }}</td><td>{{ row.factKeys | join(', ') }}</td></tr>{% endfor %}
+</tbody></table>
+<h2>Business facts and evidence</h2>
+{% for fact in flow.facts %}<section><h3>{{ fact.key }}</h3><p>{{ fact.value }}</p><p>Evidence level: <code>{{ fact.level }}</code></p>
+{% for evidence in fact.evidence %}<p><code>{{ evidence.projectId }}:{{ evidence.path }}:{{ evidence.line }}-{{ evidence.endLine }}</code></p><pre><code>{{ evidence.excerpt }}</code></pre>{% endfor %}
+{% for receipt in fact.get('executionEvidence', []) %}<p>Existing execution record: <code>{{ receipt }}</code></p>{% endfor %}</section>{% endfor %}
+<h2>Source comparison</h2><ul>{% for row in execution.changes %}<li>{{ row.projectId }}: {% if row.baselineAvailable %}baseline available{% else %}no comparison baseline{% endif %}<ul>{% for path in row.paths %}<li><code>{{ path }}</code></li>{% endfor %}</ul></li>{% endfor %}</ul>
+<h2>Unverified segments</h2><ul>{% for gap in flow.gaps %}<li>{{ gap }}</li>{% endfor %}</ul>
+<h2>Shared knowledge versions and conflicts</h2><ul>{% for claim in claims %}<li>{{ claim.key }}: {{ claim.value }} ({{ claim.level }}; {{ claim.status }})<ul><li>Claim: <code>{{ claim.id }}</code>; producers: {{ claim.producers }}</li>{% for projectId, state in claim.sourceStates.items() %}<li>Source: {{ projectId }} at <code>{{ state.head }}</code>; fingerprint: <code>{{ state.digest }}</code></li>{% endfor %}</ul></li>{% endfor %}</ul>
+<h2>Investigation limits</h2><p>Policy: {{ execution.readOnlyAudit.policy }}; enforced boundary: {{ execution.readOnlyAudit.boundary }}; audit coverage: {{ execution.readOnlyAudit.coverage }}.</p><ul>{% for surface in execution.readOnlyAudit.unobserved %}<li>Unobserved: {{ surface }}</li>{% endfor %}</ul>
+{% if execution.get('reconciliation') %}<p>Reinvestigation: <code>{{ execution.reconciliation.executionId }}</code> ({{ execution.reconciliation.status }})</p>{% endif %}
+<h2>Unresolved business questions</h2><ul>{% for question in flow.questions %}<li>{{ question }}</li>{% endfor %}</ul>
+</main></body></html>

package/runtime/templates/reports/html/i18n/en.json

@@ -172,6 +172,7 @@
     "elapsed": "Elapsed",
     "evidence-ledger": "Evidence ledger",
     "cross-check": "Worker agreement and dissent",
+    "no-cross-model-check": "No cross-model check ran: fewer than two analysis workers were selected, so no other model verified these findings.",
     "agreed-across-workers": "Agreed across workers",
     "workers-disagreed": "Workers disagreed",
     "source": "Source",

package/runtime/templates/reports/html/i18n/ko.json

@@ -172,6 +172,7 @@
     "elapsed": "소요 시간",
     "evidence-ledger": "근거 대장",
     "cross-check": "작업자 합의와 이견",
+    "no-cross-model-check": "교차 모델 검증을 하지 않았습니다. 분석 작업자를 두 명 미만으로 골라 다른 모델이 이 결과를 검증하지 않았습니다.",
     "agreed-across-workers": "작업자 간 합의",
     "workers-disagreed": "작업자 간 이견",
     "source": "출처",

package/runtime/templates/worker-prompt-preamble.md

@@ -40,9 +40,18 @@ Every analysis result starts with YAML frontmatter containing the task identity,
 3. Safe or Reasonable Areas
 4. Uncertain Points
 5. Recommended Next Actions
-6. Specialization Lens (optional, additive only)
+6. Coverage Verdicts (when the packet carries `## Coverage Census`)
+7. Specialization Lens (optional, additive only)
 
-Every item has a worker-local ID and file:line evidence where code evidence exists. Sections 1–5 are the common core: feasibility, requirement interpretation, hidden assumptions, alternatives, and execution risk. Section 6 is the only legal home for specialization and is not consensus input.
+Every item has a worker-local ID and file:line evidence where code evidence exists. Sections 1–5 are the common core: feasibility, requirement interpretation, hidden assumptions, alternatives, and execution risk. Section 7 is the only legal home for specialization and is not consensus input.
+
+Section 6 judges every cell of the packet's `## Coverage Census`, one line per cell, using the cell id verbatim:
+
+- `- <cell-id>: clean — <path:line evidence>`
+- `- <cell-id>: finding <worker-local ID>` — the ID of an item in sections 1–5
+- `- <cell-id>: n/a — <reason>`
+
+A cell with no line, a `clean` without a `path:line` citation, an `n/a` without a reason, or a `finding` naming an ID your result does not contain counts as unjudged. The lead sends unjudged cells back to you once, in a `census-gapfill` dispatch; whatever stays unjudged after it is reported as a coverage warning. That dispatch narrows this contract: write only Findings (the new items its verdicts point to, or `- none`) and Coverage Verdicts for the cells it lists. When the packet has no `## Coverage Census`, omit section 6.
 
 ## Return message to the lead
 

package/runtime/validators/checks/validate-prompt-metadata-01.py

@@ -22,30 +22,30 @@ def validate_prompt_contract(
     worker_ids: list[str],
     prompt_dir: str,
     prompt_map: object,
-    required_worker_roles: object,
+    worker_role_rows: object,
 ) -> None:
     if not prompt_dir:
         errors.append(f"{prefix} is missing worker prompt directory metadata")
     if not isinstance(prompt_map, dict):
         errors.append(f"{prefix} worker prompt map is missing or invalid")
         prompt_map = {}
-    if not isinstance(required_worker_roles, list):
-        errors.append(f"{prefix} requiredWorkerRoles is missing or invalid")
-        required_worker_roles = []
+    if not isinstance(worker_role_rows, list):
+        errors.append(f"{prefix} workerRoles is missing or invalid")
+        worker_role_rows = []
 
     expected_dir_prefix = prompt_dir.rstrip("/") + "/" if prompt_dir else ""
     for worker_id in worker_ids:
         if worker_id not in prompt_map:
             errors.append(f"{prefix} worker prompt map is missing selected worker: {worker_id}")
 
-    for worker in required_worker_roles:
+    for worker in worker_role_rows:
         if not isinstance(worker, dict):
-            errors.append(f"{prefix} requiredWorkerRoles contains a non-object entry")
+            errors.append(f"{prefix} workerRoles contains a non-object entry")
             continue
         worker_id = str(worker.get("workerId", "")).strip()
         prompt_relative = str(worker.get("promptPath", "")).strip()
         if not worker_id:
-            errors.append(f"{prefix} requiredWorkerRoles contains an entry without workerId")
+            errors.append(f"{prefix} workerRoles contains an entry without workerId")
             continue
         if not prompt_relative:
             errors.append(
@@ -54,7 +54,7 @@ def validate_prompt_contract(
             continue
         if prompt_map.get(worker_id) != prompt_relative:
             errors.append(
-                f"{prefix} worker prompt map does not match requiredWorkerRoles for {worker_id}"
+                f"{prefix} worker prompt map does not match workerRoles for {worker_id}"
             )
         if expected_dir_prefix and not prompt_relative.startswith(expected_dir_prefix):
             errors.append(
@@ -85,7 +85,7 @@ else:
         selected_workers,
         str(task_artifacts.get("workerPromptsDirectoryPath", "")).strip(),
         task_artifacts.get("workerPromptPathByWorkerId"),
-        task_manifest.get("resultContract", {}).get("requiredWorkerRoles"),
+        task_manifest.get("resultContract", {}).get("workerRoles"),
     )
 
     if (
@@ -167,7 +167,7 @@ else:
                             selected_workers,
                             run_prompt_dir,
                             run_manifest.get("workerPromptPathByWorkerId"),
-                            run_manifest.get("teamContract", {}).get("requiredWorkerRoles"),
+                            run_manifest.get("teamContract", {}).get("workerRoles"),
                         )
 
                         team_state_relative_path = str(

package/runtime/validators/validate-run.py

@@ -55,6 +55,7 @@ from okstra_ctl.phases.implementation_planning.guidance import (
     _validate_rerun_guidance as _validate_rerun_guidance,
     _validate_approval_guidance as _validate_approval_guidance,
 )
+from okstra_ctl.coverage_census import census_advisories, read_census_state
 from okstra_ctl.plan_approval import plan_is_approved as _report_already_approved
 from okstra_ctl.report_validation_identity import (
     _report_run_seq as _report_run_seq,
@@ -1248,18 +1249,18 @@ def extract_contract(
     if not isinstance(task_contract, dict):
         task_contract = {}
 
-    required_worker_roles = run_contract.get("requiredWorkerRoles")
-    if not isinstance(required_worker_roles, list):
-        required_worker_roles = task_contract.get("requiredWorkerRoles")
-    if not isinstance(required_worker_roles, list):
-        required_worker_roles = []
-        failures.append("requiredWorkerRoles is missing from run/task manifest")
+    worker_role_rows = run_contract.get("workerRoles")
+    if not isinstance(worker_role_rows, list):
+        worker_role_rows = task_contract.get("workerRoles")
+    if not isinstance(worker_role_rows, list):
+        worker_role_rows = []
+        failures.append("workerRoles is missing from run/task manifest")
 
-    optional_worker_roles = run_contract.get("optionalWorkerRoles")
-    if not isinstance(optional_worker_roles, list):
-        optional_worker_roles = task_contract.get("optionalWorkerRoles")
-    if not isinstance(optional_worker_roles, list):
-        optional_worker_roles = []
+    critic_role_rows = run_contract.get("criticRoles")
+    if not isinstance(critic_role_rows, list):
+        critic_role_rows = task_contract.get("criticRoles")
+    if not isinstance(critic_role_rows, list):
+        critic_role_rows = []
 
     lead_role = (
         run_contract.get("leadRole")
@@ -1273,7 +1274,7 @@ def extract_contract(
     if not isinstance(required_agent_status_entries, list):
         required_agent_status_entries = [lead_role] + [
             item.get("role", "")
-            for item in required_worker_roles
+            for item in worker_role_rows
             if isinstance(item, dict) and item.get("role")
         ]
 
@@ -1290,8 +1291,8 @@ def extract_contract(
             or task_contract.get("leadModelExecutionValue")
             or ""
         ),
-        "required_worker_roles": required_worker_roles,
-        "optional_worker_roles": optional_worker_roles,
+        "worker_role_rows": worker_role_rows,
+        "critic_role_rows": critic_role_rows,
         "required_agent_status_entries": [
             item
             for item in required_agent_status_entries
@@ -1460,7 +1461,7 @@ def _validate_initial_analysis_prompts(
         return
     run_manifest = data.get("runManifest") or {}
     team_contract = run_manifest.get("teamContract") or {}
-    selected_workers = team_contract.get("requiredWorkerRoles") or []
+    selected_workers = team_contract.get("workerRoles") or []
     selected_worker_ids = [
         str(worker.get("workerId") or "").strip()
         for worker in selected_workers
@@ -1598,6 +1599,30 @@ def _validate_cmux_workers_were_dispatched_by_okstra(
         )
 
 
+_CROSS_VERIFICATION_ROLES = frozenset({"analyser", "designer", "planner", "verifier"})
+
+
+def single_verifier_advisories(run_manifest: dict) -> list[str]:
+    """사용자가 한 명만 고른 교차 검증 역할은 다른 모델의 검증을 받지 않는다.
+
+    사용자 선택이므로 run 을 막지 않고, 사람이 보도록 advisory 로만 남긴다.
+    재검증 칸(`sourceRoleExecutionRef` 가 있는 동적 역할)은 세지 않는다.
+    """
+    counts: dict[str, int] = {}
+    for row in run_manifest.get("executionRoles") or []:
+        if not isinstance(row, dict) or row.get("sourceRoleExecutionRef"):
+            continue
+        role = row.get("role")
+        if role in _CROSS_VERIFICATION_ROLES:
+            counts[role] = counts.get(role, 0) + 1
+    return [
+        f"no cross-model check: only one {role} was selected, so no other "
+        "model verified its results"
+        for role, count in sorted(counts.items())
+        if count == 1
+    ]
+
+
 def validate_team_state(
     team_state: dict,
     project_root: Path,
@@ -1702,24 +1727,24 @@ def validate_team_state(
 
     expected_workers: dict[str, dict] = {}
     # 선택은 배정 전의 선택이다. 배정된 비평 역할도 결과 또는 생략 사유가
-    # 있어야 하므로 필수 역할과 같은 상태 검사를 거친다.
+    # 있어야 하므로 다른 선택 역할과 같은 상태 검사를 거친다.
     for worker in [
-        *contract["required_worker_roles"],
-        *contract.get("optional_worker_roles", []),
+        *contract["worker_role_rows"],
+        *contract.get("critic_role_rows", []),
     ]:
         if not isinstance(worker, dict):
-            failures.append("requiredWorkerRoles contains a non-object entry")
+            failures.append("workerRoles contains a non-object entry")
             continue
         role = str(worker.get("role", "")).strip()
         if not role:
-            failures.append("requiredWorkerRoles contains an entry without role")
+            failures.append("workerRoles contains an entry without role")
             continue
         expected_workers[role] = worker
 
     for role, expected in expected_workers.items():
         worker = by_role.get(role)
         if worker is None:
-            failures.append(f"missing required worker role: {role}")
+            failures.append(f"missing selected worker role: {role}")
             continue
 
         expected_worker_id = expected.get("workerId")
@@ -3120,6 +3145,7 @@ def validate_final_report_data(
         print(f"validate-run: warning: {warning}", file=sys.stderr)
     # Phase-agnostic: the coverage critic runs in every finding-producing phase.
     _validate_unverified_critic_gaps_recorded(data, failures)
+    _validate_census_coverage(data, manifest, project_root, failures)
     # Called here rather than from a task-type branch: four profiles raise
     # clarification rows, and the gate scopes itself by task type internally.
     _validate_clarification_options(data, failures)
@@ -4078,6 +4104,28 @@ def _normalize_report_contracts(raw_contracts: object) -> set[str]:
     }
 
 
+def _validate_census_coverage(
+    data: Mapping[str, Any],
+    manifest: Mapping[str, Any],
+    project_root: Path | None,
+    failures: list[str],
+) -> None:
+    """Coverage-census leftovers, reported and never blocking.
+
+    The user's rule for the census is that no cell state stops a run, so these
+    strings carry no `blocking_checks` fragment and `partition` files them as
+    `validate-run: advisory`.
+    """
+    if project_root is None:
+        return
+    state = read_census_state(project_root, manifest)
+    if state is None:
+        return
+    failures.extend(
+        census_advisories(state, data.get("missingInformation") or [])
+    )
+
+
 CRITIC_UNVERIFIED_SOURCE = "critic-unverified"
 
 
@@ -5853,6 +5901,7 @@ def main() -> int:
         failures.extend(autofix_messages)
     _validate_execution_identity_v2(run_manifest, failures)
     contract = extract_contract(run_manifest, task_manifest, failures)
+    advisories.extend(single_verifier_advisories(run_manifest))
     concurrent_run_authorized = bool(
         (run_manifest.get("concurrentRun") or {}).get("detected")
     )