okstra 0.208.0 → 0.209.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.208.0",
+  "version": "0.209.0",
   "description": "Host-aware multi-provider cross-verification orchestrator runtime and agent skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.208.0",
-  "builtAt": "2026-10-03T18:34:52.807Z",
+  "package": "0.209.0",
+  "builtAt": "2026-10-04T02:14:38.425Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/lead/okstra-lead-contract.md

@@ -608,7 +608,7 @@ For every other task type:
 
 When the host native picker is available and two of those rows could apply, ask with that picker (recommended first). Do not end the turn after the status dump.
 
-When the `report-finalize` result carries `censusWarnings`, add one line to the reply with the unverdicted coverage-census cell count per worker (`unverdicted`), or name the `auditProblem`. It is a warning: it changes neither the recommendation nor the next command.
+When the `report-finalize` result carries `censusWarnings`, add one line to the reply with the unverdicted coverage-census cell count per worker (`unverdicted`), or name the `auditProblem`. It is a warning: it changes neither the recommendation nor the next command. When it carries `businessFlowWarnings`, add one line naming each failed business-flow execution's `mode` and `error`; the business-flow step is optional, so this is also a warning only.
 
 **Cite run-artifact paths, do not assemble them.** The `report-finalize` result's `reportPaths` carries this run's `humanReport`, `reportRecord`, `teamState`, and `renderFullCopy` command, each already rooted at the project (`.okstra/tasks/<task-group>/<task-id>/runs/...`). Every other run-artifact path the reply cites — the resume command among them — comes from the launch prompt's `## Manifests` / `## Run Paths` lists, which are rooted the same way. A path you compose from a `runs/<task-type>/...` pattern instead is identical across every task of that task-type, so it names no task and does not resolve from the project root either.
 

package/runtime/python/okstra_ctl/cmux.py

@@ -379,8 +379,8 @@ def plan_worker_height_resize(
     return None
 
 
-def shim_free_login_path() -> str:
-    """The user's login PATH with cmux's per-surface CLI shims removed.
+def shim_free_worker_path() -> str:
+    """The lead's inherited PATH with cmux's per-surface CLI shims removed.
 
     A cmux pane execs its command through `login … bash --noprofile --norc`, so
     none of the user's shell rc runs and PATH is cmux's own short list. What that
@@ -389,14 +389,23 @@ def shim_free_login_path() -> str:
     CLIs — and where a provider cmux does not know has no entry at all, which is
     a plain exit 127 inside the worker wrapper.
 
-    Restoring the login shell's PATH and dropping the shim entries gives the
-    wrapper what it would see in an ordinary terminal, which is what its own
-    `command -v <cli>` check expects. Nothing here is provider-specific, so
-    adding a provider does not touch this path.
+    The base is the PATH the lead process inherited, because the cli-wrapper
+    runtime (and every automatic retry, which always runs there) spawns with it.
+    A pane that resolved PATH from the login shell instead could pick another
+    install of the same CLI: on 2026-10-04 (fontsninja-v3-site dev-11118) the
+    login shell put Homebrew's codex 0.153.4 first, which rejects `gpt-6.1-sol`,
+    while the lead's PATH found nvm's 0.160.0, so every first attempt failed and
+    every retry passed. The login shell's PATH is the fallback when the inherited
+    one is empty after filtering.
     """
-    entries = _login_shell_path().split(os.pathsep)
+    path = _without_shims(os.environ.get("PATH", ""))
+    return path or _without_shims(_login_shell_path())
+
+
+def _without_shims(path_value: str) -> str:
     return os.pathsep.join(
-        entry for entry in entries if entry and SHIM_DIR_MARKER not in entry
+        entry for entry in path_value.split(os.pathsep)
+        if entry and SHIM_DIR_MARKER not in entry
     )
 
 
@@ -783,7 +792,7 @@ def _surface_from_split_echo(stdout: str) -> str:
 
 def _exec_worker(surface_uuid: str, *, cwd: Path, command: Sequence[str]) -> None:
     line = worker_command_line(
-        cwd=cwd, argv=command, path_value=shim_free_login_path()
+        cwd=cwd, argv=command, path_value=shim_free_worker_path()
     )
     started = run_cmux(["respawn-pane", "--surface", surface_uuid, "--command", line])
     if started.returncode != 0:
@@ -939,11 +948,7 @@ def _pane_geometry(entry: dict[str, Any]) -> PaneGeometry:
 
 
 def _login_shell_path() -> str:
-    """PATH as the user's own login shell resolves it.
-
-    Falls back to the inherited PATH: a worker started with a shim-filtered
-    inherited PATH is still better than one started with cmux's bare list.
-    """
+    """PATH as the user's own login shell resolves it, or '' when it cannot run."""
     shell = os.environ.get("SHELL", "") or "/bin/sh"
     try:
         result = subprocess.run(
@@ -954,9 +959,9 @@ def _login_shell_path() -> str:
             check=False,
         )
     except (OSError, subprocess.SubprocessError):
-        return os.environ.get("PATH", "")
+        return ""
     if result.returncode != 0 or not result.stdout.strip():
-        return os.environ.get("PATH", "")
+        return ""
     return result.stdout.strip()
 
 

package/runtime/python/okstra_ctl/coverage_census.py

@@ -242,8 +242,15 @@ def _split_verdict_section(text: str) -> tuple[list[str], str]:
     )
     if start is None:
         return [], text
+    level = len(lines[start]) - len(lines[start].lstrip("#"))
+    # Subheadings (`### EB-001`) group the verdict lines; only a heading at the
+    # section's own level or above closes it.
     end = next(
-        (index for index in range(start + 1, len(lines)) if _HEADING_RE.match(lines[index])),
+        (
+            index for index in range(start + 1, len(lines))
+            if _HEADING_RE.match(lines[index])
+            and len(lines[index]) - len(lines[index].lstrip("#")) <= level
+        ),
         len(lines),
     )
     return lines[start + 1:end], "\n".join(lines[:start] + lines[end:])

package/runtime/python/okstra_ctl/phases/requirements_discovery/profile.md

@@ -24,6 +24,10 @@
   - task rejection-criteria: Which delivered outcome would the reporter reject?
   - task missing-materials: Which missing material blocks reliable routing?
   - task terminology: Which fuzzy or overloaded terms need one canonical form, and what decides it?
+  - task existing-reuse: Which existing code path, export, test seam or helper should this work reuse instead of adding a new one?
+  - task related-work: Which related, follow-up or blocking task does this work overlap, and which units stay in or out of this split?
+  - task input-consistency: Where do the brief, packet and recorded decisions contradict each other or the code?
+  - task shared-impact: Which shared type, model, package or consumer outside the stated scope does this change reach?
 - Primary focus areas:
   - classify the work as bugfix, feature, improvement, refactor, or ops
   - capture the reporter's **rejection criteria** — the delivered outcome that would make this work wrong or unacceptable — as a routing input. Consume it from the brief's `Desired Outcome` / `Out of Scope` / `Source Material` when present; when it is absent AND it would change the classification (e.g. bugfix vs feature) or the next-phase choice, raise it as one `decision` clarification row with `Evidence checked: none — reporter intent`. Never infer it — this is a reporter-intent signal, the mirror of improvement-discovery's `Anti-goals`

package/runtime/python/okstra_ctl/report_finalize.py

@@ -726,6 +726,16 @@ def run_finalize(
     for step in steps:
         if step["name"] == "business-flow":
             payload["businessProcess"] = step["result"]
+            # 선택 단계라 exitCode 는 0 이다. 실패를 중첩 JSON 에만 두면 리드가 못 본다.
+            failed = [
+                {"id": row.get("id", ""), "mode": row.get("mode", ""), "error": row.get("error", "")}
+                for row in step["result"].get("executions") or []
+                if isinstance(row, dict) and row.get("status") == "failed"
+            ]
+            if step["result"].get("error"):
+                failed.append({"id": "", "mode": "", "error": str(step["result"]["error"])})
+            if failed:
+                payload["businessFlowWarnings"] = failed
     census = _census_summary(ctx)
     if census is not None:
         payload["censusWarnings"] = census