okstra 0.214.1 → 0.216.0

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.214.1",
-  "builtAt": "2026-10-06T14:25:05.491Z",
+  "package": "0.216.0",
+  "builtAt": "2026-10-15T14:08:59.435Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/bin/lib/okstra/cli.sh

@@ -24,7 +24,10 @@ collect_required_arguments() {
   prompt_for_required_argument TASK_GROUP "Task Group"
   prompt_for_required_argument TASK_ID "Task ID"
   prompt_for_required_argument TASK_TYPE "Task Type"
-  if [[ "$TASK_TYPE" != "release-handoff" ]]; then
+  if [[ "$TASK_TYPE" == "discussion" ]]; then
+    # discussion 은 brief 대신 시작 입력을 받는다 — prepare 가 입력 문서를 만든다.
+    prompt_for_required_argument DISCUSSION_START "Discussion start (link, short description, or this task's key)"
+  elif [[ "$TASK_TYPE" != "release-handoff" ]]; then
     # release-handoff 는 brief 가 없다 — prepare 가 검증 보고서 인용 input 을 생성.
     prompt_for_required_argument BRIEF_PATH "Task Brief Path"
   fi
@@ -175,6 +178,10 @@ while [[ $# -gt 0 ]]; do
       BRIEF_PATH="$(require_option_value --task-brief "${2-}")"
       shift 2
       ;;
+    --discussion-start)
+      DISCUSSION_START="$(require_option_value --discussion-start "${2-}")"
+      shift 2
+      ;;
     --directive)
       DIRECTIVE="$(require_option_value --directive "${2-}")"
       shift 2
@@ -249,7 +256,7 @@ while [[ $# -gt 0 ]]; do
           printf '  hint: did you mean --task-id?\n' >&2
           ;;
       esac
-      printf '  valid options: --render-only --resume-clarification --yes --role-count --role-model --lead-provider --lead-model --claude-model --codex-model --antigravity-model --worker-model --report-writer-provider --report-writer-model --lead-runtime --executor --critic --related-tasks --work-category --task-type --project-id --project-root --task-group --task-id --task-brief --directive --base-ref --fix-cycle --clarification-response --selected-direction --task-key --approved-plan --approve --implementation-option --stage --stages --qa-waiver --no-plan-verification -h|--help\n' >&2
+      printf '  valid options: --render-only --resume-clarification --yes --role-count --role-model --lead-provider --lead-model --claude-model --codex-model --antigravity-model --worker-model --report-writer-provider --report-writer-model --lead-runtime --executor --critic --related-tasks --work-category --task-type --project-id --project-root --task-group --task-id --task-brief --discussion-start --directive --base-ref --fix-cycle --clarification-response --selected-direction --task-key --approved-plan --approve --implementation-option --stage --stages --qa-waiver --no-plan-verification -h|--help\n' >&2
       usage
       exit 1
       ;;

package/runtime/bin/lib/okstra/globals.sh

@@ -39,6 +39,8 @@ BASE_REF=""
 RELATED_TASKS_RAW=""
 TASK_TYPE=""
 BRIEF_PATH=""
+# discussion 전용: brief 자리에 들어가는 시작 입력(링크·짧은 설명·이 task 의 key).
+DISCUSSION_START=""
 PROJECT_ID=""
 TASK_GROUP=""
 TASK_ID=""

package/runtime/bin/lib/okstra/interactive.sh

@@ -145,7 +145,9 @@ autofill_from_manifest() {
   fi
   # release-handoff 는 brief 입력이 없다 (prepare 가 검증 보고서 인용 input 을
   # 생성) — task-type autofill 이후에 판정해야 하므로 순서가 위와 바뀌면 안 된다.
-  if [[ -z "$BRIEF_PATH" && -n "$manifest_brief" && "$TASK_TYPE" != "release-handoff" ]]; then
+  # discussion 의 매니페스트 brief 는 prepare 가 만든 입력 문서라 다시 넘기지 않는다.
+  if [[ -z "$BRIEF_PATH" && -n "$manifest_brief" && "$TASK_TYPE" != "release-handoff" \
+    && "$TASK_TYPE" != "discussion" ]]; then
     BRIEF_PATH="$manifest_brief"
     printf 'autofill: brief-path from task-manifest.json: %s\n' "$BRIEF_PATH" >&2
   fi
@@ -159,7 +161,11 @@ missing_required_arguments_summary() {
   [[ -z "$TASK_ID" ]] && missing+=("<task-id>")
   [[ -z "$TASK_TYPE" ]] && missing+=("<task-type>")
   # release-handoff 는 brief 입력이 없다 — prepare 가 input 문서를 생성한다.
-  [[ -z "$BRIEF_PATH" && "$TASK_TYPE" != "release-handoff" ]] && missing+=("<brief-path>")
+  if [[ "$TASK_TYPE" == "discussion" ]]; then
+    [[ -z "$DISCUSSION_START" ]] && missing+=("<discussion-start>")
+  elif [[ -z "$BRIEF_PATH" && "$TASK_TYPE" != "release-handoff" ]]; then
+    missing+=("<brief-path>")
+  fi
 
   if (( ${#missing[@]} == 0 )); then
     printf '%s' ""

package/runtime/bin/lib/okstra/usage.sh

@@ -3,7 +3,7 @@
 usage() {
   cat >&2 <<USAGE_EOF
 usage:
-  $DISPLAY_COMMAND_NAME [--render-only] [--yes] [--no-plan-verification] --task-type <task-type> [--role-count <role>=<N>] [--role-model <role>=<provider/model>] [--lead-provider <provider>] [--lead-model <model>] [--worker-model provider=model,...] [--report-writer-provider <provider>] [--report-writer-model <model>] [--lead-runtime <host-id-or-alias>] [--executor claude|codex|antigravity] [--critic off|claude|codex|antigravity|grok|kimi] [--related-tasks taskA,taskB] --project-id <project-id> [--project-root <path>] --task-group <task-group> --task-id <task-id> --task-brief <brief-path> [--directive <directive>] [--fix-cycle <yes|no>]
+  $DISPLAY_COMMAND_NAME [--render-only] [--yes] [--no-plan-verification] --task-type <task-type> [--role-count <role>=<N>] [--role-model <role>=<provider/model>] [--lead-provider <provider>] [--lead-model <model>] [--worker-model provider=model,...] [--report-writer-provider <provider>] [--report-writer-model <model>] [--lead-runtime <host-id-or-alias>] [--executor claude|codex|antigravity] [--critic off|claude|codex|antigravity|grok|kimi] [--related-tasks taskA,taskB] --project-id <project-id> [--project-root <path>] --task-group <task-group> --task-id <task-id> (--task-brief <brief-path> | --discussion-start <start-input>) [--directive <directive>] [--fix-cycle <yes|no>]
 
 summary:
   $DISPLAY_TOOL_NAME prepares a task-keyed instruction bundle. The standalone launcher defaults to an interactive Claude session; in-host skills keep the current registered host session as the native lead.
@@ -23,6 +23,8 @@ required arguments:
   --task-id            Stable task identifier inside the task group. Example: login-error-analysis
   --task-type          Task type. Also selects prompts/profiles/<task-type>.md
   --task-brief        Task brief file path. Relative paths are resolved against the target project root.
+  --discussion-start   Replaces --task-brief for --task-type discussion: a ticket or project link, a short
+                       description, or this task's key to continue its discussion in a new research cycle.
 
 optional arguments:
   --project-root       Absolute path to the target project root. Resolution order when omitted:

package/runtime/bin/okstra.sh

@@ -185,6 +185,7 @@ okstra execution summary:
   task group: ${TASK_GROUP}
   task id: ${TASK_ID}
   task brief: ${BRIEF_PATH}
+  discussion start: ${DISCUSSION_START:-None}
   directive: ${DIRECTIVE:-None}
   clarification response: ${CLARIFICATION_RESPONSE_PATH:-None}
   selected direction: ${SELECTED_DIRECTION_PATH:-None}
@@ -216,8 +217,13 @@ PY_ARGS=(
   --task-group "$TASK_GROUP"
   --task-id "$TASK_ID"
   --task-type "$TASK_TYPE"
-  --task-brief "$BRIEF_PATH"
 )
+# discussion 은 brief 를 받지 않는다(prepare 가 --task-brief 를 거부한다) — 시작 입력이 그 자리다.
+if [[ "$TASK_TYPE" == "discussion" ]]; then
+  PY_ARGS+=(--discussion-start "$DISCUSSION_START")
+else
+  PY_ARGS+=(--task-brief "$BRIEF_PATH")
+fi
 [[ -n "${DIRECTIVE-}" ]] && PY_ARGS+=(--directive "$DIRECTIVE")
 [[ -n "${FIX_CYCLE-}" ]] && PY_ARGS+=(--fix-cycle "$FIX_CYCLE")
 for role_count in "${ROLE_COUNTS[@]-}"; do

package/runtime/prompts/duties/discussion-worker.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": "1.0",
+  "id": "discussion-worker",
+  "roleId": "analyser",
+  "responsibilities": [
+    "Research the discussion subject and hand the user and the other participants the evidence, assumptions and alternative directions the decision depends on, without making the decision that belongs to the user."
+  ],
+  "requiredConduct": [
+    "Address the subject and the question the facilitator confirmed with the user; read the shared discussion record, including every user answer, before researching; give each claim its evidence location; state each alternative's requirements, exclusions and risks; and name the questions only the user can answer."
+  ],
+  "decisionPrinciples": [
+    "Separate factual claims about the code or external sources, which evidence can settle, from intent, scope, priority and acceptable risk, which only the user can settle. Resolve by inspection what the evidence answers and raise the rest as a user question. Prefer a falsifiable claim over a broad impression."
+  ],
+  "authorityAndBoundaries": [
+    "Research and argue; do not decide. Do not edit sources, write implementation plans or file-change specifications, or start follow-up tasks. A user decision recorded in the discussion record stands until the user changes it."
+  ],
+  "evidenceStandards": [
+    "Support each factual claim with evidence that bears on it directly and cite the inspected location. State when evidence is indirect, incomplete or contradicted, and what the research could not reach."
+  ],
+  "collaborationContract": [
+    "Reason independently and keep a minority position whose evidence is stronger. When another participant's claim is refuted or confirmed, say by which evidence. Leave cross-participant synthesis and the questions put to the user to the facilitator."
+  ],
+  "completionCriteria": [
+    "The confirmed question has an explicit answer or a stated reason why it has none; every factual claim carries evidence; every alternative carries its requirements, exclusions and risks; and every open user question is listed."
+  ],
+  "prohibitions": [
+    "Do not present an assumption as a fact, infer the user's intent from a fact check, repeat an earlier claim as new without new evidence, or drop a contested position to reach consensus."
+  ],
+  "blockedStateReporting": [
+    "Name the evidence or input that was unavailable, what was attempted, and which part of the question therefore has no researched answer."
+  ]
+}

package/runtime/prompts/lead/convergence.md

@@ -49,9 +49,8 @@ Configure this in the `convergence` block of `task-manifest.json`. If the block
 | Setting | Default | Description |
 |------|--------|------|
 | `enabled` | `true` | If `false`, skip the convergence loop and use the existing consensus/divergence method |
-| `maxRounds` | phase-aware: `1` for `requirements-discovery`, `2` otherwise (range 1–3) | Maximum number of re-verification rounds. Discovery's routing/missing-input outputs gain little from a second round; other phases (especially `error-analysis`) keep `2`. Lead resolves the effective value when the manifest omits the key and records it in `config.effectiveMaxRounds` of the convergence state artifact. |
-| `verificationMode` | `"lightweight"` | `"lightweight"` or `"full-reanalysis"` |
-| `adversarial` | phase-aware: `true` for `requirements-discovery` / `error-analysis` / `implementation-option-selection` / `implementation-planning` / `project-analysis` / `feature-analysis` / `change-impact-analysis`, `false` otherwise | When `true`, Phase 5.5 runs in **adversarial mode** (see §"Adversarial Verification Mode"): verifiers actively try to refute each finding, the burden of proof sits on the claim, and `verificationMode` is forced to `"full-reanalysis"` scoped to the finding's cited evidence. Resolved by `scripts/okstra_ctl/render.py` `_build_convergence_block` and recorded in `config.adversarial` of the convergence state artifact. |
+| `maxRounds` | `2` (range 1–3) | Maximum number of re-verification rounds. A second round runs only for a finding whose first round produced no usable vote or a tie the critic decides (§"Adversarial classification"); with `1`, a tie is `contested`. Lead resolves the effective value when the manifest omits the key and records it in `config.effectiveMaxRounds` of the convergence state artifact. |
+| `adversarial` | `true` | Always `true`: every phase runs Phase 5.5 in **adversarial mode** (see §"Adversarial Verification Mode") — verifiers actively try to refute each finding, the burden of proof sits on the claim, and `verificationMode` is `"full-reanalysis"` scoped to the finding's cited evidence. `okstra convergence prepare-groups` writes both values regardless of the task manifest, and `seed` refuses a grouping with `adversarial: false` (**Enforced:** `_parse_config` in `scripts/okstra_ctl/convergence_engine.py`). |
 
 **Auto-disable rule (BLOCKING).** Convergence requires ≥2 analyser workers to produce a meaningful consensus tally. When the run's selected roster (`resultContract.workerRoles`) holds fewer than 2 analyser workers — the user selected one analyser, or `release-handoff` (zero analyser workers, lead-only) — the lead MUST treat `convergence.enabled` as `false` for that run regardless of manifest configuration, skip Phase 5.5, and record `finalState: "converged"` with `totalRounds: 0`, `round2SkippedReason: "auto-disabled"`, an empty `roundHistory`, and an explanatory note in `config` (e.g. `"autoDisabled": "fewer-than-two-analysers"`). An `implementation-planning` run with one planner still runs the plan-body verification round; that planner's single vote settles each item (`plan-body-verification` (the absolute path in **Okstra Runtime Resources**), "A one-analyser roster"). **Enforced:** `scripts/okstra_ctl/convergence_engine.py` `seed_working_state` stops with `auto-disabled` below two analysis workers, and `validators/validate-run.py` `single_verifier_advisories` records the missing cross-model check as an advisory.
 
@@ -81,7 +80,7 @@ Nothing about the census stops a run. A missing cell, a missing result, a single
 
 ## Convergence Algorithm
 
-**Majority definition (BLOCKING).** "Majority" means *strictly greater than half* of the non-error votes for that finding (`verification-error` votes are excluded from both numerator and denominator). Ties — including the 1-AGREE / 1-DISAGREE case in a two-analyser roster — are NOT a majority: in intermediate rounds the finding is **carried forward**; in the final executed round the finding is classified `contested`. In adversarial mode a tie whose DISAGREE carries `counter-evidence` does not carry forward — it is classified `contested` in that round (§"Adversarial Verification Mode"). This rule applies identically to the plan-body verification round (`plan-body-verification` (the absolute path in **Okstra Runtime Resources**)) where the same verdict tokens are reused.
+**Majority definition (BLOCKING).** "Majority" means *strictly greater than half* of the counted votes for that finding: the verifiers' non-error votes plus the origin worker's implicit SURVIVES (`verification-error` votes are excluded). A tie is NOT a majority: it goes to the critic when one is rostered and is `contested` otherwise (§"Adversarial classification"). The plan-body verification round (`plan-body-verification` (the absolute path in **Okstra Runtime Resources**)) keeps its own rule, which counts only verifier votes.
 
 **Enforced:** the engine owns the classifier and replays it — `scripts/okstra_ctl/convergence_engine.py` `validate_final_state` recomputes each finding's expected final classification from its recorded votes and rejects the state when the persisted value differs, and `finalize` runs that same check before it writes, so a tie scored as a consensus never reaches the artifact. `okstra convergence validate` is the same call on demand. Nothing re-derives the majority rule outside the engine; a second implementation would only drift from it.
 
@@ -129,7 +128,7 @@ Follow this protocol exactly:
 1. Run `okstra convergence seed --groups <groups> --run-manifest <current-run-manifest> --work-state <work> --final-state <final> --migration-dir <state/migrations>` for a v2 worker roster. `--run-manifest` must be the exact current manifest named by the groups document's `runManifestPath`; a previous run from the same task is not interchangeable. `seed` refuses a grouping that cites a worker whose initial attempt the mutation audit discarded (`contract-failed-unattributed`, `mutation-present-unresolved`) — the result file is still on disk, but the ledger says it was never accepted. Re-dispatch that worker as a new invocation and cite the new result, or leave it out of the grouping. **Enforced:** `discarded_worker_errors` in `scripts/okstra_ctl/convergence_provenance.py`, called by `_seed`. Omit the flag for a legacy v1 roster. A `reuse-final` action means validate the existing final and continue to Phase 6. `create-work`, `resume-work`, and `restart-round0` continue with planning.
 2. Run `okstra convergence plan-round --work-state <work> --plan <round-plan>`. This is read-only with respect to the working state. Its stdout JSON carries `round` and `inputQueueSize`; on a `dispatch` plan the round's `PROGRESS: phase-5.5-convergence round=<N> queue=<count>` line copies those two values — never count the queue by hand. **Enforced:** `_plan_round` in `scripts/okstra_ctl/convergence.py`, `tests/run/test_convergence_cli.py`.
 3. Every plan carries `dispatchable`: `true` on an `action: "dispatch"` plan, `false` on an `action: "finalize"` plan. When the plan action is `dispatch`, create exactly one reverify prompt for each `dispatches[]` row and dispatch it through the selected runtime adapter. Its findings are exactly that row's `findingIds`.
-4. Run `okstra convergence collect-results --plan <round-plan> --mode <adversarial|collaborative> --result <worker>=<path>… --run-manifest <current-run-manifest> --output convergence-round-<N>-results-<task-type>-<seq>.json`. Each planned worker's terminal outcome and `durationMs` come from the manifest's attempt ledger, not from the lead: an attempt still `started` refuses the collect — run `okstra team await` first so the attempt closes — and a worker whose attempt did not close `ok` cannot contribute a vote even if its result file exists. **Enforced:** `_dispatch_rows_from_manifest` in `scripts/okstra_ctl/convergence.py`. Then run `okstra convergence apply-round --work-state <work> --plan <round-plan> --results <round-results>`.
+4. Run `okstra convergence collect-results --plan <round-plan> --result <worker>=<path>… --run-manifest <current-run-manifest> --output convergence-round-<N>-results-<task-type>-<seq>.json`. Each planned worker's terminal outcome and `durationMs` come from the manifest's attempt ledger, not from the lead: an attempt still `started` refuses the collect — run `okstra team await` first so the attempt closes — and a worker whose attempt did not close `ok` cannot contribute a vote even if its result file exists. **Enforced:** `_dispatch_rows_from_manifest` in `scripts/okstra_ctl/convergence.py`. Then run `okstra convergence apply-round --work-state <work> --plan <round-plan> --results <round-results>`.
 5. Repeat `plan-round` and `apply-round` until the plan action is `finalize`. A `finalize` plan is **never dispatched**: it carries `dispatchable: false`, an empty `dispatches[]`, and a `note` naming the next command. Its `round` is only the `<N>` in `convergence-round-<N>-plan-<task-type>-<seq>.json` — not a round to run — so do not open reverify workers for it. **Enforced:** `okstra convergence apply-round` refuses a non-dispatch plan and returns the gate's closing reason with the remedy (`scripts/okstra_ctl/convergence_engine.py` `apply_round_results`).
 6. When the coverage critic is enabled, convert its verification batch to the canonical `dispatches[]` / `gaps[]` result shape and run `okstra convergence apply-critic-gaps --work-state <work> --results <critic-results>` exactly once. The reducer, not the lead, merges verified gaps.
 7. Run `okstra convergence finalize --work-state <work> --output <final>`.
@@ -175,17 +174,15 @@ The executable source is `scripts/okstra_ctl/convergence_engine.py`; `okstra con
 
 ## Verification Mode
 
-### Lightweight (Default)
+Finding convergence always uses scoped full re-analysis: the verifier re-opens the evidence each finding cites (§"Adversarial Verification Mode" → Scoped full-reanalysis).
 
-Decide solely on the findings and evidence other reviewers present; do not reanalyze the original code or data. Fast and cost-effective, but accuracy drops when evidence is insufficient.
+### Lightweight (plan-body verification only)
 
-### Full Re-analysis (opt-in)
-
-Use each finding as a guide but reanalyze the original code/data yourself. High accuracy at 2–3× the cost and time.
+Decide solely on the findings and evidence other reviewers present; do not reanalyze the original code or data. Only the plan-body verification round uses this mode.
 
 ## Adversarial Verification Mode
 
-Active only when `config.adversarial == true` (default for `requirements-discovery`, `error-analysis`, `implementation-option-selection`, `implementation-planning`, `project-analysis`, `feature-analysis`, and `change-impact-analysis`; see §"Configuration"); when `false`, every rule in this section is inert and the collaborative behaviour elsewhere in this contract applies unchanged. In adversarial mode the verifier's job inverts: instead of confirming a peer's finding, the verifier **tries to break it**, and the burden of proof sits on the claim — a finding survives only if refutation attempts fail.
+Every phase runs in this mode. In adversarial mode the verifier's job inverts: instead of confirming a peer's finding, the verifier **tries to break it**, and the burden of proof sits on the claim — a finding survives only if refutation attempts fail.
 
 ### Read-only analysis task contract
 
@@ -219,33 +216,32 @@ Each `disagree` vote records a new field `disagreeBasis`:
 
 A `disagree` with `disagreeBasis == null` is a contract violation in adversarial mode — every refutation must state which of the two grounds it rests on. **Enforced:** `_validate_adversarial_disagree_carries_a_basis` in `validators/validate-run.py` fails such a vote when `config.adversarial` is set; non-adversarial rounds are out of scope because their verdict semantics differ. Bare "I disagree" without re-inspection is not allowed. If capability, credential, network, or service state prevents that inspection, the verdict is `UNVERIFIABLE`, persisted as `verification-error`; verifier failure is never converted to `DISAGREE` or `burden-not-met`. A live/external claim without `evidenceArtifacts` remains schema-valid, but a verifier that needs the missing artifact and cannot independently access the source MUST answer `UNVERIFIABLE` with a non-empty explanation.
 
-### Adversarial classification (replaces the §"Convergence Algorithm" per-round classifier when `adversarial == true`)
+### Adversarial classification
 
-`verification-error` votes are excluded from numerator and denominator exactly as in the collaborative classifier. For each finding `F` in the queue at a round:
+`verification-error` votes are excluded from the tally. The origin worker does not vote, but it holds its own finding, so the tally counts it as one SURVIVES. For each finding `F` in the queue at a round:
 
 ```text
-disagrees    = [v for v in non-error votes if v.verdict == "disagree"]
-hard_refutes = [v for v in disagrees if v.disagreeBasis == "counter-evidence"]
-all_others_disagree = (every non-discoverer non-error vote is "disagree")
-
-IF len(disagrees) == 0:
-    resolve F as "partial-consensus" if SUPPLEMENT/caveat votes are a majority of
-    non-error votes, otherwise "full-consensus"
-ELIF all_others_disagree:
-    resolve F as "worker-unique"    # only the discoverer still holds it
-ELIF len(hard_refutes) >= 1:
-    # an evidence-backed refute exists and the roster is split → the claim is disputed
+votes     = non-error votes of this round, plus the previous round's votes when F was tied there
+disagrees = [v for v in votes if v.verdict == "disagree"]
+survives  = 1 + (len(votes) - len(disagrees))      # the 1 is the origin worker
+
+IF votes is empty:
+    carry F forward; at the LAST executed round classify it "unverified"
+ELIF any disagree has disagreeBasis == "counter-evidence":
     resolve F as "contested" IN THIS ROUND; F leaves the queue
-ELIF burden-not-met disagrees are a majority of non-error votes (per the Majority definition in the Convergence Algorithm section):
-    carry F forward; at the LAST executed round classify it "contested"
-ELSE:
-    # a lone weak (burden-not-met) doubt against an otherwise-surviving claim
-    resolve F as "partial-consensus"
+ELIF survives > len(disagrees):
+    resolve F as "full-consensus" when there is no disagree and SURVIVES-WITH-CAVEAT
+    votes are not a majority of votes; otherwise "partial-consensus"
+ELIF len(disagrees) > survives:
+    resolve F as "worker-unique"
+ELSE (tie):
+    critic rostered     → carry F forward; the next round dispatches F to the critic only
+    no critic rostered  → resolve F as "contested" IN THIS ROUND
 ```
 
-`contested` stays terminal (per §"Scope and Terminology") and is reached by two routes. A finding split on `burden-not-met` doubt alone is carried forward through intermediate rounds and labelled `contested` at the last executed round; a finding carrying a `counter-evidence` hard refute is labelled `contested` in the round that refute lands and leaves the queue there. For `requirements-discovery` (`effectiveMaxRounds = 1`) the two routes coincide — the single round IS the last round. The final-classifier block of §"Convergence Algorithm" honours this: its first branch classifies an adversarially carried-forward finding `contested` regardless of the AGREE tally, so the two sections cannot assign the same finding different labels.
+The tie round's votes stay in the tally when the critic votes, so the critic's vote breaks the tie. Two analysers produce a tie whenever the one verifier refutes; three analysers produce a tie only when one verifier refutes and the other's vote is unusable. A tie whose critic round never ran (round limit) or returned no usable vote is `contested` at finalize. **Enforced:** `classify_finding_round` and `_finding_outcome` in `scripts/okstra_ctl/convergence_engine.py`; `plan_next_round` routes a tied finding to the worker named by `config.tieBreaker`, which `seed` sets to the grouping's single `critic`-audience worker or `null`.
 
-Design intent: one `counter-evidence` refute denies a claim consensus (it cannot rise above `contested` however many others AGREE). Because that refute is permanent, re-dispatching the finding buys nothing — the verifier gets no new information and re-casts the same refute, so the round is spent by construction. The refute therefore settles the finding where it lands, and the finding is reported under `## 6.2 Differences` exactly as a last-round `contested` finding is. A lone `burden-not-met` doubt does not sink an otherwise-surviving claim — only a majority of them does; that doubt IS resolvable by another round, so it still carries forward. When every non-discoverer refutes (all_others_disagree) the finding is worker-unique regardless of refute basis — only the discoverer still holds it. A caveat is weighed the same way a weak doubt is: with zero disagrees, SUPPLEMENT lands partial-consensus only when caveats are a **majority** of the non-error votes. A single verifier's scope note does not by itself deny a claim the rest of the roster passed cleanly — the caveat is still recorded in the dissent log either way, so the majority rule changes the label, never the record. (The collaborative classifier is more permissive still: there SUPPLEMENT counts as full agreement at any count.)
+Design intent: one `counter-evidence` refute denies a claim consensus however many others SURVIVE. Because that refute is permanent, re-dispatching the finding buys nothing, so the refute settles the finding where it lands, and the finding is reported under `## 6.2 Differences`. A `burden-not-met` doubt is weighed by the majority. A tie is not sent back to the same analysers — they have no new information — but to the critic, a verifier outside the analyser panel. A caveat is weighed by majority: with zero disagrees, SURVIVES-WITH-CAVEAT lands partial-consensus only when caveats are a **majority** of the votes; the caveat is recorded in the dissent log either way.
 
 ## Re-verification Dispatch
 
@@ -266,7 +262,14 @@ materialize` with `--audience
 reverification-worker`, `--assignment-ref reverify/<workerId>`,
 `--source-role-execution-ref
 <sourceRoleExecutionRef>`, the exact `--worker-id`, `--dispatch-kind
-reverify-r<N>`, and the authorized prompt/result/audit paths. Do not derive the
+reverify-r<N>`, and the authorized prompt/result/audit paths. A row whose
+`worker` is `critic-worker` is a tie round: it takes the run's critic assignment
+(`--assignment-ref critic/scope`, or `critic/acceptance` on `final-verification`)
+instead of `reverify/<workerId>`, everything else unchanged, and its result is
+named `critic-worker-reverify-r<N>-<task-type>-<seq>.md`. **Enforced:**
+`okstra_ctl.worker_prompt_policy.is_critic_verification` admits that pair, and
+`convergence_store._validate_dynamic_verifier_request` admits a critic source
+only for a plan-body or finding re-verification round. Do not derive the
 source role execution from `workerId`, provider, model, or execution-label
 text. A legacy v1 run omits `--source-role-execution-ref`; the materializer
 keeps its legacy read-only identity resolution for that schema version. The
@@ -374,12 +377,9 @@ Reverify prompts MUST NOT inject the Phase 2 `[Required reading]` clause:
 
 **Enforced:** `_validate_reverify_prompt_suppresses_required_reading` in `validators/validate-run.py` fails any `*-reverify-r*.md` prompt containing the clause.
 
-Lightweight reverify does not require the original `analysis-packet.md`, `analysis-profile.md`, `task-brief.md`, or instruction set. Its complete input is the receiving worker's current engine-planned `findingIds` batch and the evidence embedded in those findings.
+A reverify does not require the original `analysis-packet.md`, `analysis-profile.md`, `task-brief.md`, or instruction set. Its complete input is the receiving worker's current engine-planned `findingIds` batch, the evidence those findings cite, and the origin item and audit sidecar the rendered prompt names. Including the clause forces workers to re-read the entire instruction-set per round per worker (3 workers × 2 rounds × 5+ files in the worst case) for no quality gain.
 
-- **Lightweight mode**: the clause directly contradicts the "Do NOT re-analyze the original source materials" instruction below. Including it forces workers to re-read the entire instruction-set per round per worker (3 workers × 2 rounds × 5+ files in the worst case) for no quality gain.
-- **Full-reanalysis mode**: workers DO need to re-read source materials, but only the analysis-worker file list (no `final-report-template.md`). If lead chooses to inject a reading clause here, it MUST mirror the audience-scoped enumeration in [okstra-lead-contract](./okstra-lead-contract.md) Phase 2 (no template).
-
-This is the single largest avoidable cost in `requirements-discovery`, `error-analysis`, `implementation-option-selection`, and `implementation-planning` runs. Treat as mandatory.
+This is the single largest avoidable cost in convergence. Treat as mandatory.
 
 ## Conditional reference reading
 
@@ -390,61 +390,17 @@ avoiding unused examples; queue and dispatch validators still enforce execution.
 
 | Current operation | Additional section to read |
 |---|---|
-| Diagnosing a rejected verifier prompt | The reference prompt matching the selected verification mode |
+| Diagnosing a rejected verifier prompt | Adversarial Re-verification Prompt |
 | `config.critic.enabled` is true | Coverage critic pass, including its shared dispatch procedure |
 | An enabled critic uses acceptance mode for `final-verification` | Acceptance critic pass as well as the shared Coverage critic dispatch procedure |
 
 Read the matching sections before their dispatch. A disabled critic needs neither
-critic section. Generated prompts retain the selected mode's instructions even
-when the lead does not read the example text.
-
-### Lightweight Re-verification Prompt
-
-Rendered by `okstra convergence reverify-prompt` when `config.adversarial` is false; the block below is the reference shape, and the rendered body additionally carries each finding's `**Origin item**` and `**Origin audit sidecar**` lines.
-
-```
-## Instructions
-
-**Rendered by:** okstra convergence reverify-prompt
-
-Perform re-verification for <task-key> (round <N>).
-
-Review the following findings discovered by other workers.
-For EACH finding, respond with exactly one verdict:
-
-- **AGREE**: The finding is valid based on the evidence presented
-- **DISAGREE**: The finding is incorrect or unsupported (explain briefly why)
-- **SUPPLEMENT**: The finding is valid AND you have additional supporting evidence or context
-- **UNVERIFIABLE**: Capability, credential, network, or service state prevents you
-  from checking this finding. Explain the unavailable capability; do not substitute DISAGREE.
-
-Do NOT re-analyze the original source materials. Judge based on the evidence provided.
-
-## Findings to verify
-
-### F-001: <one-line summary>
-**Origin**: <worker role>
-**Evidence**: <file paths, line numbers, reasoning from origin worker>
-
-### F-002: <one-line summary>
-**Origin**: <worker role>
-**Evidence**: <...>
-
-## Response format
-
-For each finding, respond as:
-
-### F-001
-**Verdict**: AGREE | DISAGREE | SUPPLEMENT | UNVERIFIABLE
-**Explanation** (required for every verdict, AGREE included): <2-3 sentences>
-
-### F-002
-**Verdict**: ...
-```
+critic section. Generated prompts carry the adversarial instructions even when
+the lead does not read the example text.
 
 ### Adversarial Re-verification Prompt
 
-Used instead of the lightweight/full-reanalysis prompt when `config.adversarial == true`. Rendered by `okstra convergence reverify-prompt`; the block below is the reference shape, and the rendered body additionally carries each finding's `**Origin item**` and `**Origin audit sidecar**` lines. The required anchor headers (§"Required reverify-prompt anchor headers") are identical. The `[Required reading]` clause is suppressed; only the cited-evidence paths of the items under attack are injected (see §"Adversarial Verification Mode" → Scoped full-reanalysis).
+The reverify prompt for every phase. Rendered by `okstra convergence reverify-prompt`; the block below is the reference shape, and the rendered body additionally carries each finding's `**Origin item**` and `**Origin audit sidecar**` lines. The required anchor headers (§"Required reverify-prompt anchor headers") are identical. The `[Required reading]` clause is suppressed; only the cited-evidence paths of the items under attack are injected (see §"Adversarial Verification Mode" → Scoped full-reanalysis).
 
 ```
 ## Instructions
@@ -504,50 +460,6 @@ When persisting votes, map SURVIVES→`agree`, SURVIVES-WITH-CAVEAT→`supplemen
 
 UNVERIFIABLE is **not** `verification-error`. A verifier that opened the evidence and could not check it participated in the round; a `verification-error` is a verifier that failed to answer. The classifier counts only non-error votes, so folding the two shrinks the participating roster without saying so — a round where one analyser answers UNVERIFIABLE throughout would read as a two-way cross-check while reporting three voters. **Enforced:** `okstra convergence collect-results` applies this mapping (`okstra_ctl.verdict_blocks.ADVERSARIAL_VERDICTS`); do not transcribe votes by hand.
 
-### Full Re-analysis Re-verification Prompt
-
-```
-## Instructions
-
-**Rendered by:** okstra convergence reverify-prompt
-
-Perform deep re-verification for <task-key> (round <N>).
-
-Independently verify the following findings by examining the original materials.
-Use each finding as a starting point, NOT as a confirmed conclusion.
-If capability, credential, network, or service state prevents access to evidence
-needed for a finding, you MUST answer UNVERIFIABLE with a non-empty explanation.
-You MUST NOT answer DISAGREE merely because access or reproduction failed;
-UNVERIFIABLE is persisted as `verification-error` and excluded from consensus.
-
-**Enforced:** `scripts/okstra_ctl/convergence_engine.py` `_VERDICTS` accepts the verdict as `verification-error`, and `classify_collaborative_round` drops those votes before counting consensus.
-
-## Task bundle paths
-- Instruction set: <instruction-set path>
-- Task brief: <task-brief path>
-- Analysis material: <analysis-material path>
-- Reference expectations: <reference-expectations path>
-
-## Findings to verify
-
-### F-001: <one-line summary>
-**Origin**: <worker role>
-**Original evidence**: <file paths, line numbers>
-
-### F-002: <one-line summary>
-**Origin**: <worker role>
-**Original evidence**: <...>
-
-## Response format
-
-For each finding:
-
-### F-001
-**Verdict**: AGREE | DISAGREE | SUPPLEMENT | UNVERIFIABLE
-**Your evidence**: <your independent evidence trail with file paths and line numbers>
-**Explanation**: <detailed analysis>
-```
-
 ## Convergence State Artifact
 
 Save it to `runs/<task-type>/state/convergence-<task-type>-<seq>.json`.
@@ -558,10 +470,10 @@ Save it to `runs/<task-type>/state/convergence-<task-type>-<seq>.json`.
   "taskKey": "<task-key>",
   "config": {
     "enabled": true,
-    "adversarial": false,
+    "adversarial": true,
     "maxRounds": 2,
     "effectiveMaxRounds": 2,
-    "verificationMode": "lightweight"
+    "verificationMode": "full-reanalysis"
   },
   "findings": [
     {
@@ -616,9 +528,9 @@ Save it to `runs/<task-type>/state/convergence-<task-type>-<seq>.json`.
 
 Schema rules:
 
-- `schemaVersion`: literal string `"1.4"` for all new runs — both adversarial and collaborative. Historical readers accept `"1.0"` / `"1.1"` / `"1.2"` / `"1.3"` unchanged and never rewrite those artifacts during validation. v1.3 added the strict coverage-critic ledger and the rejection of unknown top-level fields; v1.4 adds the `unverified` classification and its `finalClassificationCounts.unverified` key. Work-state remains v1.0.
+- `schemaVersion`: literal string `"1.4"` for all new runs. Historical readers accept `"1.0"` / `"1.1"` / `"1.2"` / `"1.3"` unchanged and never rewrite those artifacts during validation. v1.3 added the strict coverage-critic ledger and the rejection of unknown top-level fields; v1.4 adds the `unverified` classification and its `finalClassificationCounts.unverified` key. Work-state remains v1.0.
 - `config.adversarial`: boolean. `true` when this run used adversarial verification (default for `requirements-discovery` / `error-analysis` / `implementation-option-selection` / `implementation-planning` / `project-analysis` / `feature-analysis` / `change-impact-analysis`). When `true`, `config.verificationMode` is `"full-reanalysis"` (scoped) and every `disagree` vote carries a non-null `disagreeBasis`.
-- `config.effectiveMaxRounds`: the integer the lead actually used after resolving the phase-aware default (`1` for `requirements-discovery`, `2` otherwise). It may be lower than `config.maxRounds` — a phase-aware default that resolves below the manifest ceiling is the normal case — but never higher. **Enforced:** `scripts/okstra_ctl/convergence_engine.py` `_parse_config` raises `ConvergenceContractError` on `effectiveMaxRounds > maxRounds`, so a state carrying that pair cannot be loaded, and `plan_next_round` finalizes with reason `max-rounds-reached` once the executed rounds reach the effective budget rather than dispatching another one. `totalRounds` is therefore bounded by construction, not by a later re-count.
+- `config.effectiveMaxRounds`: the integer the lead actually used after resolving the default (`2`). It may be lower than `config.maxRounds` — a phase-aware default that resolves below the manifest ceiling is the normal case — but never higher. **Enforced:** `scripts/okstra_ctl/convergence_engine.py` `_parse_config` raises `ConvergenceContractError` on `effectiveMaxRounds > maxRounds`, so a state carrying that pair cannot be loaded, and `plan_next_round` finalizes with reason `max-rounds-reached` once the executed rounds reach the effective budget rather than dispatching another one. `totalRounds` is therefore bounded by construction, not by a later re-count.
 - `findings[].ticketIds`: array of ticket keys from Phase 4 grouping (parsed per the Round 0 step 5 rule). It is empty when the phase does not require ticket tagging; `"unknown"` is not a ticket key and must not be synthesized.
 - `findings[].rounds[].votes.<worker>.verdict`: enum, one of `agree | disagree | supplement | verification-error`. Lower-case tokens; map upper-case AGREE/DISAGREE/SUPPLEMENT verdicts emitted by workers to their lower-case form and map the input alias `unverifiable` to persisted `verification-error`. The latter represents either a terminal non-result dispatch or a completed dispatch that could not verify a particular finding (§"Worker failure handling in reverify"). Every vote has a non-empty `explanation`.
 - `findings[].rounds[].votes.<worker>.disagreeBasis`: enum `counter-evidence | burden-not-met | null`. Non-null only when `verdict == "disagree"` AND `config.adversarial == true`; `null` (or absent, treated as null) otherwise. See §"Adversarial Verification Mode".
@@ -635,7 +547,7 @@ Schema rules:
 
 ## Coverage critic pass
 
-Runs when `convergence.critic.enabled == true`. Critic is opt-in on `requirements-discovery`, `error-analysis`, `implementation-planning`, and `final-verification` (role `min` 0, `recommended`/`max` 1; the user chooses whether to add the slot and picks the model). A run without a critic slot renders `enabled: false` and skips this pass. For `final-verification` the critic runs in a different mode — see §"Acceptance critic pass (final-verification)". This pass targets **scope in both directions** — findings that are missing (coverage) and work the findings propose that no requirement asked for (over-scope) — distinct from convergence, which targets **agreement quality** among the findings already raised. The pass keeps its `coverage` mode id and `gaps` vocabulary for both halves; the two are told apart by each candidate's `category`, so no schema or reducer distinguishes them. In `implementation-planning` the same critic slot also settles plan-body analyser 1-1 splits as `critic-worker`.
+Runs when `convergence.critic.enabled == true`. Critic is opt-in on `requirements-discovery`, `error-analysis`, `implementation-planning`, and `final-verification` (role `min` 0, `recommended`/`max` 1; the user chooses whether to add the slot and picks the model). A run without a critic slot renders `enabled: false` and skips this pass. For `final-verification` the critic runs in a different mode — see §"Acceptance critic pass (final-verification)". This pass targets **scope in both directions** — findings that are missing (coverage) and work the findings propose that no requirement asked for (over-scope) — distinct from convergence, which targets **agreement quality** among the findings already raised. The pass keeps its `coverage` mode id and `gaps` vocabulary for both halves; the two are told apart by each candidate's `category`, so no schema or reducer distinguishes them. In `implementation-planning` the same critic slot also settles plan-body analyser 1-1 splits as `critic-worker`, and in every phase it breaks finding ties as `critic-worker` (§"Adversarial classification").
 
 ### When
 
@@ -741,14 +653,15 @@ The asymmetry is deliberate and runs the opposite way from the coverage half: a
 
 The `final-verification` phase uses the same fresh one-shot `redispatch_worker` pattern and the same dispatch timing as §"Coverage critic pass" §"When" (provider + `config.critic.modelExecutionValue` from the `convergence.critic` block; critic is opt-in — the pass is skipped when the run resolved no critic; same model-unresolved skip rule) — the delivered work the critic inspects is likewise fixed before the reverify round starts. Only the prompt, the verification semantics, and the output sink differ — final-verification's findings are defects/blockers, so the critic acts as an **acceptance devil's advocate** (find reasons NOT to accept), and its candidate blockers are NEVER dropped (that would suppress real defects).
 
-Before that call, write the acceptance-only task instructions and run `okstra
+Before that call, write the output of `okstra convergence critic-prompt
+--run-manifest <run-manifest>` verbatim as the task instructions and run `okstra
 agent-prompt materialize` with `--audience acceptance-critic`,
 `--assignment-ref critic/acceptance`, `--worker-id acceptance` (the run-input
 Worker Roster line), and `--dispatch-kind critic`. **The final-verification 96-nonblank-line prompt-body
 cap applies to this dispatch too** — `resolve_prompt_plan` exempts a critic from
 the analysis equality group, not from the cap. The anchors and the duty contract
 account for roughly 51 of those lines, so the instructions you write have a
-budget of about 45 nonblank lines; the §Prompt text below is 20 and fits. Adding
+budget of about 45 nonblank lines; the rendered body omits the Round 0 list to fit. Adding
 your own restatement of the run's findings on top of it is what overruns the cap
 (measured 117 on 2026-09-10, dev-10642-15 final-verification 001). Verify the returned `metadataPath`, dispatch only the
 returned `promptPath`, and select `hostModelValue` for a native host or
@@ -758,6 +671,8 @@ delivery was observed.
 
 ### Prompt
 
+The mandate `critic-prompt` renders for `final-verification` (it adds the delivery-mode header, the analysis packet line, the analyser result lines and the `### [AC-NNN]` candidate format):
+
 ```
 Challenge acceptance for <task-key>. The delivered work is about
 to be judged for acceptance. Your ONLY job is to find reasons it should NOT be
@@ -776,6 +691,13 @@ so explicitly.
 ### Verification — confirm-or-downgrade (BLOCKING)
 
 Each candidate blocker is verified by the Phase 4 analysers — all of them, on the same roster rule as §"critic gaps" above; sharing the critic's provider name does not disqualify an analyser. Do NOT use the adversarial finding classifier's "uncertain → reject" rule here.
+
+1. Write the candidates as `{schemaVersion, taskKey, mode: "acceptance-devils-advocate", provider, modelExecutionValue, candidates[]}` with one `{candidateId, statement, severity, originEvidence}` per candidate, `candidateId` being the id in the critic's candidate heading (`### [AC-001]` or a plain `### AC-001 — …` from a critic dispatched before the rendered format).
+2. For each analyser, render `okstra convergence critic-verify-prompt --run-manifest <run-manifest> --gaps <that batch> --worker <worker>` and materialize it as a critic-gap verification row (`--dispatch-kind critic-verify`, `--assignment-ref reverify/<worker>`).
+3. Run `okstra convergence collect-acceptance-votes --run-manifest <run-manifest> --candidates <that batch> --result <worker>=<path>… --output <acceptance-batch>`; it marks a candidate `confirmed` when any analyser answers SURVIVES or SURVIVES-WITH-CAVEAT and `downgraded` otherwise.
+4. Pass that output to `apply-acceptance-critic` (§State).
+
+**Enforced:** `okstra_ctl.convergence_critic_verify_prompt.acceptance_verify_prompt_body` renders the instructions under the `critic-verify` signature that `validate_reverify_prompt` requires, and `convergence._collect_acceptance_votes` derives each verdict from the parsed votes.
 - Do NOT run `apply-critic-gaps` for this mode. That reducer implements coverage merge/drop semantics and rejects `acceptance-devils-advocate` input.
 - **Confirmed** (an analyser reproduces it or cites supporting evidence) → promote to a `## 5.8 Acceptance Blockers` row (keep severity + recommended follow-up phase).
 - **Not confirmed** (cannot reproduce, or evidence is weak) → **downgrade to a Residual Risk row — never drop it.** Record the escalation trigger so the user can re-judge a high-severity-but-unconfirmed candidate.