okstra 0.220.1 → 0.221.0

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-deliverable.md

@@ -77,7 +77,7 @@ When the synthesised verdict is `FAIL` and the lead minor fix does not apply, th
 **Entry.** Every blocking finding of the round meets all of these, or the run ends `FAIL` as before:
 
 1. A verifier cited where it is (`path:line`) and what the correct result is.
-2. The fix stays inside this stage's `plannedPaths` or files the executor already changed.
+2. The fix stays inside this stage's `plannedPaths` or files the executor already changed. A `FILE-SIZE:` finding also allows the new files the split creates beside the oversized one, so it always meets this rule.
 3. It needs no new plan step, dependency, schema, migration, or config of record — a finding that does is a plan change: end the run `FAIL` and route by `prompts/lead/phase-routing.md`.
 
 Changing a test's expected value is allowed here when the finding shows the oracle is wrong, because the verifiers re-verify the fix.
@@ -85,12 +85,13 @@ Changing a test's expected value is allowed here when the finding shows the orac
 **Procedure for round `<N>`.**
 
 1. Record the stage HEAD as `<base>` (`git rev-parse HEAD` in the stage worktree).
-2. Write the executor instruction with `okstra correction prompt --run-manifest <path> --round <N> --role executor --base <base> --finding <F-id> [--finding <F-id> ...]` into a file under the run's `state/`, then materialize it with `okstra agent-prompt materialize` — `--audience implementation-executor`, `--assignment-ref initial/<executor worker id>`, `--dispatch-kind correction-r<N>`, a new `--invocation-id` ending `-correction-r<N>-<executor worker id>`, and a result path `<executor worker id>-worker-correction-r<N>-implementation-<seq>.md`. Build a jobs file with `okstra agent-prompt jobs --dispatch-kind correction-r<N>`, dispatch it alone with `okstra team dispatch --jobs-file <path> --dispatch-kind correction-r<N>`, and settle it with `okstra team await`.
+2. Write the executor instruction with `okstra correction prompt --run-manifest <path> --round <N> --role executor --base <base> --stage-base <stage base> --finding <F-id> [--finding <F-id> ...]` into a file under the run's `state/`, then materialize it with `okstra agent-prompt materialize` — `--audience implementation-executor`, `--assignment-ref initial/<executor worker id>`, `--dispatch-kind correction-r<N>`, a new `--invocation-id` ending `-correction-r<N>-<executor worker id>`, and a result path `<executor worker id>-worker-correction-r<N>-implementation-<seq>.md`. Build a jobs file with `okstra agent-prompt jobs --dispatch-kind correction-r<N>`, dispatch it alone with `okstra team dispatch --jobs-file <path> --dispatch-kind correction-r<N>`, and settle it with `okstra team await`.
+   `--stage-base` (the carry's `stageCommitRange.base`) adds a `FILE-SIZE:<path>` finding for each file the stage diff leaves over the 400-line limit, computed by `okstra correction file-size`; a `FILE-SIZE-ADVISORY:` line (the 300-line target) never opens or joins a round; a round may hold only those findings, and `findingIds` records them by that id. Leave out a convergence finding id that restates a `FILE-SIZE:` line, or the executor reads it twice.
 3. Do the same for every verifier with `--role verifier`, `--audience implementation-verifier`, its own `initial/<verifier worker id>` assignment, and result `<verifier worker id>-worker-correction-r<N>-implementation-<seq>.md`; dispatch the verifiers in one batch without the executor.
 4. Converge the re-verification results the way the initial round was converged, restarting Phase 5.5 with `okstra convergence seed ... --restart-from-round0`.
 5. No re-verification verdict is `FAIL`: the round `result` is `pass` and the run continues to persistence with the post-fix head. Otherwise `result: fail`; start round `<N+1>` if the cap allows and the entry rules still hold, or end the run `FAIL`.
 
-**Enforced:** `scripts/okstra_ctl/dispatch_core.py` `_validate_correction_rounds` (via `correction_round.validate_correction_dispatch`) refuses a round past the cap, a verifier dispatch before that round's executor returned an `ok` result, a second executor fix in the same round, and round `<N+1>` before round `<N>` was re-verified. `validators/validate-run.py` `_validate_correction_rounds` (blocking) fails a report whose `correctionRounds` differ from the correction rounds the run dispatched, whose rounds are not 1, 2 in order, whose `result` contradicts its verdicts, or whose `verifierResults` are not the last round's verdicts. The entry rules are instructions only.
+**Enforced:** `scripts/okstra_ctl/dispatch_core.py` `_validate_correction_rounds` (via `correction_round.validate_correction_dispatch`) refuses a round past the cap, a verifier dispatch before that round's executor returned an `ok` result, a second executor fix in the same round, and round `<N+1>` before round `<N>` was re-verified. `validators/validate-run.py` `_validate_correction_rounds` (blocking) fails a report whose `correctionRounds` differ from the correction rounds the run dispatched, whose rounds are not 1, 2 in order, whose `result` contradicts its verdicts, or whose `verifierResults` are not the last round's verdicts. The entry rules are instructions only. `okstra stage-done` (`scripts/okstra_ctl/stage_done.py` `_check_file_size`) refuses to settle a stage whose carry range breaks the 400-line file-size limit and names the `--stage-base` to pass, so a size violation no verifier reported still reaches a correction round, or ends the run `FAIL` when no round is left.
 
 ## Self-review pass before finalising the report (the Okstra lead runs this; do not delegate it)
 

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-executor.md

@@ -92,6 +92,7 @@ template's check; that template is gone.
   The file MUST NOT exist before the run starts (overwrite is refused — see `--force-stage` non-goal). **Enforced:** `validators/validate-run.py` `_validate_stage_carry_sidecar_exists` fails a run that declares `stageSidecarEvidence` without the file on disk. Transcribing the JSON into the report is not the same as writing it: `consumers` treats the carry file as the source of truth for marking the stage `done`, so a missing file leaves the stage permanently incomplete and blocks every dependent stage with a `PrepareError` — while this run reports success.
 - **Verifier gates are not yours to run (BLOCKING).** The self-mock detector (`validators/detect_self_mock.py`) belongs to the implementation verifier and is never delegated to you (`_implementation-verifier.md` §"Self-mock detection"). The coding-conventions preflight names it as the enforcement behind the no-self-mocking principle — that names who will check your diff, not a command for you to run. You MUST NOT invoke it and MUST NOT write `<task_root>/qa/self-mock-*.json`; running it early does not pre-satisfy the gate, because the verifier runs it again under its own duty. **Enforced:** that sidecar is not among the paths your attempt's `writePolicy.artifactPolicy.allowedPaths` carries, so the write audit closes the attempt as `error` with `artifact-root change exceeds batch policy union` (`scripts/okstra_ctl/execution_mutation_audit.py`) — a stage whose every gate passed still lands as a failed run. The same holds for the conformance results `<task_root>/qa/result-*.json`: you may run a conformance script to check your work — a baseline capture or `--compare` target goes under `<task_root>/qa/baseline/` and anything else it writes (build logs, measurements) under `<task_root>/qa/output/`, the only qa directories besides `qa/scripts/` your attempt may write — but the verifier records every result, including an earlier stage's result that your rewrite of its script made stale. When the approved plan tells you to write one, leave it and name it in your result as a plan step the verifier owns.
 - **An external Tier 3 non-PASS does NOT withhold the carry evidence.** A Tier 3 entry whose `requires` include `http`, `external`, or `db` is advisory. Its FAIL, MISSING, no result, startup failure, or credential / network / service absence gets recorded honestly — exact command, exit code, output tail, marked `ADVISORY` in `Validation evidence` — and you emit the carry evidence anyway. Only Tier 1 and Tier 2 failures withhold it. Withholding on an external result is what actually blocks the stage: the carry file is the only thing that can mark a stage `done`, the verifier re-runs that same command from the host (where a call your sandbox could not complete often passes), and a stage the verifier then PASSes can never be closed because its evidence was never written.
+- **File size: aim for 300 lines, never exceed 400 (BLOCKING at 400).** Each threshold is broken the same three ways — a new file over it, an existing file taken past it, a file already over it that grows by any net line — counted in physical lines. Breaking 400 is a blocking finding; breaking only 300 is an advisory recommendation the verifiers record. Put a new responsibility — a group of functions, a class, a `describe` block — in a new module or test file beside the existing one instead of appending, and when a file would pass 400, split it by responsibility; never compress code or drop comments to meet the number. Lockfiles, data (JSON / YAML), Markdown, fixtures, snapshots, generated and vendored files are exempt, as are languages okstra has no coding preflight for. Check with `okstra correction file-size --base <stage-base>` before you emit the carry evidence; it writes nothing, so you may run it. **Enforced:** every verifier runs the same command and reports each `FILE-SIZE:` line (400) as a blocking finding and each `FILE-SIZE-ADVISORY:` line (300) as a recommendation, and `okstra stage-done` (`scripts/okstra_ctl/stage_done.py` `_check_file_size`) refuses to settle a stage whose carry range still breaks 400, so the stage goes to a correction round.
 - **Reverse link (BLOCKING).** The runtime already appended a `status:"started"` row for this stage before the run began. The terminal row belongs to the lead's post-stage persistence and is verdict-gated — `status:"done"` with `carry_path` on a non-`FAIL` verdict, `status:"failed"` on `FAIL` (`_implementation-deliverable.md` §"Lead post-stage persistence").
 - **No PR / push in this phase.** This run produces local commits, carry sidecar evidence, verifier results, and the implementation final report only. Push and PR creation belong exclusively to the later `release-handoff` phase after `final-verification` returns `accepted`.
 

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-self-check.md

@@ -17,6 +17,7 @@ fails, fix it or surface the violation — do not claim done on a failing item.
 
 - diff-review done: the `Pre-commit diff review sweep` ran over the full diff and its `Coverage:` footer is in your audit sidecar — every changed file named, with each applied rule set carrying its outcome (`clean` or `fixed <n>`). No footer, or entries with no outcome → the sweep is unfinished; do not claim done.
 - functions: every new/edited function ≤50 effective lines, single purpose — cite the longest function's actual line count, not "all under 50"
+- file size: no source or test file this diff adds or grows ends over 400 physical lines, and no file already over 400 grew — paste the output of `okstra correction file-size --base <stage-base>`; it must end `QA-RESULT: PASS`. Aim for 300: for each `FILE-SIZE-ADVISORY:` line it prints, split the file or say why not. A responsibility that would push a file over goes into its own new module or test file
 - conventions: applied the routed pack + project patterns (name which ones)
 - names & comments: names say what, comments say why; no obvious-restatement comments; no truthful-name violations
 - verification: ran the actual build/test — paste the exact command line and its real exit code / output tail, never a paraphrased "tests pass"

package/runtime/python/okstra_ctl/phases/implementation/instructions/_implementation-verifier.md

@@ -214,13 +214,14 @@ Re-running commands proves the diff *builds and passes*; it does NOT prove the d
   - **Non-separating test data:** two scenarios whose setup values and assertions are identical, so a wrong implementation passes both; or new test tooling added in this diff (mock, state setter, repository branch) that no test calls.
   - **Effect claimed under its own mock:** a test presented as covering an effect whose producing path is replaced by a mock inside that same test. The mock's presence in the harness is not evidence the branch behind it works.
   - **Single-caller abstraction (KISS):** an abstraction layer this diff introduces — a helper module, a strategy / factory / builder, an indirection or wrapper layer, an interface or abstract base — that has exactly one caller after the change, where inlining it at that call site would be simpler. The rule is `overview.md` core principle 2: name the second caller now, or inline. Four exits are legitimate and each must **cite its evidence**: the approved plan declares it (a `testSeams[]` boundary or a variation-point extraction — cite the plan step); the project declares `architecture.style = hexagonal` and this is a port at the domain boundary (a port with one adapter is the normal shape, not a violation); it breaks a real import cycle (name both modules); or its single caller is the public API of a published package. Absent one of those, cite `path:line` and recommend the inlined shape. Do NOT raise this on a function extracted purely to bring a body under the 50-line cap — that is principle 5 doing its job — nor on a pre-existing abstraction this diff merely edits.
+  - **File-size limit (every verifier, not only the stage QA owner):** run `okstra correction file-size --base <base>` from the worktree cwd and log it in the `Read-only command log`. Each `FILE-SIZE:<path>:401 <before>-><after>` line it prints is a blocking finding cited exactly as printed — a new file over 400 lines, a file the diff took past 400, or a file already over 400 the diff grew. Recommended fix: move whole responsibilities into new modules or test files beside it. The command writes nothing and its result is the same for every verifier, so the finding converges and the lead sends it to a correction round. Each `FILE-SIZE-ADVISORY:<path>:301` line (the 300-line target, same three conditions) goes under the advisory findings below, not here. Do not judge size yourself: a file it does not print is not a finding (lockfiles, data, Markdown, fixtures, snapshots, generated files and languages without a coding preflight are exempt by `scripts/okstra_ctl/file_size_cap.py` `capped_path`).
   - **Caller-less identifier (YAGNI / orphan):** an identifier this diff leaves with zero callers — either newly added and never called (a speculative parameter, an optional config object, a "future-proof" hook, an exported helper whose only caller is hypothetical), or pre-existing code orphaned because this diff removed its last caller. Grep the identifier across the whole repository rather than the diff alone; a hit inside its own declaration, its own test, or a commented-out line is not a caller. Two exits are legitimate and must be **stated with their evidence**, never assumed: an identifier the approved plan reserves for a named later stage (cite the plan step), and a contract point something other than project code calls (a framework entrypoint, an implemented interface method, a migration hook, the public API of a published package — cite the caller or the registration). Anything else is work no requirement asked for: recommend deleting it, or folding an added parameter back into its single call site. A caller-less identifier is the one YAGNI violation that survives a green pipeline unchanged, which is why it grades here rather than as a recommendation.
-- **Advisory findings (recorded as recommendations; verdict MAY still PASS):** function >50 effective lines, a single body mixing read+write stages, weak readability, a missing-but-non-critical outcome assertion, weak-but-not-misleading names, priority-between-inputs policy inlined in a service condition instead of a named domain function, an error message asserting a cause the code never observed, a memory / concurrency / batching change with no test pinning the bound it claims, or (hexagonal overlay only) a service dependency this diff adds or modifies that injects a concrete adapter instead of a port — record it with the port sketch; advisory only while the project has not declared `architecture.style = hexagonal`, since that declaration — and only that one — promotes exactly this item to blocking per the declared-style bullet above, while a declared `layered` binds dependency direction instead and leaves this item advisory; an existing convention of concrete injections does not convert this one to `clean`, it is the debt the rule pays down. These land in the verifier result as `should-fix` / `nit` recommendations, not as a `FAIL`.
+- **Advisory findings (recorded as recommendations; verdict MAY still PASS):** each `FILE-SIZE-ADVISORY:` line from the file-size command (a file over the 300-line target but within 400), function >50 effective lines, a single body mixing read+write stages, weak readability, a missing-but-non-critical outcome assertion, weak-but-not-misleading names, priority-between-inputs policy inlined in a service condition instead of a named domain function, an error message asserting a cause the code never observed, a memory / concurrency / batching change with no test pinning the bound it claims, or (hexagonal overlay only) a service dependency this diff adds or modifies that injects a concrete adapter instead of a port — record it with the port sketch; advisory only while the project has not declared `architecture.style = hexagonal`, since that declaration — and only that one — promotes exactly this item to blocking per the declared-style bullet above, while a declared `layered` binds dependency direction instead and leaves this item advisory; an existing convention of concrete injections does not convert this one to `clean`, it is the debt the rule pays down. These land in the verifier result as `should-fix` / `nit` recommendations, not as a `FAIL`.
 - **Output.** Every finding — blocking or advisory — is a structured item in the verifier's worker result (`path:line`, rule, severity, suggested fix) so it carries into Phase 5.5 convergence and the final report. A blocking hit sets the verifier verdict to `FAIL` with the rule cited, using the same verdict machinery as the Discrepancy rule above. The Okstra lead MUST NOT silently downgrade a cited blocking finding to advisory during synthesis; an override requires a concrete cited reason, exactly as for the Discrepancy rule.
 
 ### Fix-run incremental scope (applies when the profile carries a "Fix-Run Carry" block)
 
-A correction-round re-verification (`--dispatch-kind correction-r<N>`, a "Correction Round" block in the task instructions) takes the same scope: the block's findings and the correction diff it names, with every validation command re-run.
+A correction-round re-verification (`--dispatch-kind correction-r<N>`, a "Correction Round" block in the task instructions) takes the same scope: the block's findings and the correction diff it names, with every validation command re-run. The file-size command is the exception: run it against the stage base, never the round's base, because a file the round did not touch keeps the violation the initial diff made.
 
 A fix run re-verifies a stage whose previous run already passed a full static
 sweep and failed only on cited blocking findings. Re-sweeping the whole stage

package/runtime/python/okstra_ctl/phases/implementation_option_selection/profile.md

@@ -39,4 +39,4 @@
 
 Record candidate validity, unresolved user decisions, and explicitly classified technical facts. The lead chooses the next phase under `## implementation-option-selection` in `prompts/lead/phase-routing.md`.
 
-When `--clarification-response` carries a technical-verification report, read its source comparison, experiment plans, results and logs. Check that the tested environment matches current code, then author fresh feasibility votes. Do not directly convert a supported result into a feasible candidate, remove unrelated uncertainties or treat a failed or unrun probe as compatibility proof. Preserve the user's pilot scope and any deferred production rollout.
+When `--clarification-response` carries a technical-verification report, read its source comparison, experiment plans, results and logs. The analysis packet's `## Technical Verification Evidence` section names the result record and the experiment directory (rendered by `okstra_ctl.phases.technical_verification.entry.technical_evidence_packet_block`). Check that the tested environment matches current code, then author fresh feasibility votes. Do not directly convert a supported result into a feasible candidate, remove unrelated uncertainties or treat a failed or unrun probe as compatibility proof. Preserve the user's pilot scope and any deferred production rollout.

package/runtime/python/okstra_ctl/phases/implementation_planning/authoring.py

@@ -733,6 +733,23 @@ _DIR_SNAPSHOT_OWNED_NOTE = (
     "planner-fixable DISAGREE that asks to edit these four fields.\n"
 )
 
+# 구현 executor 는 소스 트리의 실 IO 테스트를 첫 편집 전에 거부한다. 계획이 그런
+# step 을 승인받으면 stage 가 변경 0 으로 멈춘다(2026-10-18 dev-11374 실측).
+_REAL_IO_STEP_NOTE = (
+    "\nReal-IO placement: this step must not create, edit, or run a test that "
+    "opens a real database connection, makes a real network call, or talks to "
+    "a real external service inside the project source test tree (`src/**`, "
+    "`test/**`, `tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, "
+    "`*.e2e-spec.*`), and its PASS must not depend on a reachable database or "
+    "service. The implementation executor refuses such a step before any edit. "
+    "Real-backend checks belong only in the stage's `Conformance tests:` "
+    "declaration, which the implementation run writes under "
+    "`<task_root>/qa/scripts/`, never commits, and treats as advisory. If this "
+    "step breaks the rule, vote DISAGREE(b) with Fixability planner-fixable and "
+    "name the real-IO test path or command. A test whose collaborator is "
+    "stubbed is not real IO.\n"
+)
+
 
 def _step_coordinate(payload: object, field: str) -> int | None:
     if not isinstance(payload, Mapping):
@@ -1022,6 +1039,8 @@ def _prompt(args: argparse.Namespace) -> str:
         rows.append(_render_prior_steps(item, all_items))
         if item_id.startswith("P-Prep-"):
             rows.append(_PREP_OWNERSHIP_NOTE)
+        if item_id.startswith("P-Step-"):
+            rows.append(_REAL_IO_STEP_NOTE)
         if item_id == "P-Dir-1":
             rows.append(_DIR_SNAPSHOT_OWNED_NOTE)
         split = _render_analyser_split(

package/runtime/python/okstra_ctl/phases/implementation_planning/instructions/plan-body-verification.md

@@ -316,6 +316,20 @@ from both numerator and denominator, and never converted to `DISAGREE`. Voting `
 dependency-missing command instead manufactures a defect the planner cannot fix by editing the plan,
 which is what sends the item into a self-fix round that can only paper over it.
 
+## Real-IO test in a committed step
+
+A `P-Step-*` item that creates, edits, or runs a test opening a real database connection, a real
+network call, or a real external service inside the project source test tree (`src/**`, `test/**`,
+`tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, `*.e2e-spec.*`), or whose `PASS` depends on a
+reachable database or service, is `DISAGREE(b)` with `planner-fixable`. The implementation executor
+refuses that step before its first edit (`_implementation-executor.md` "Real-IO test isolation"), so
+the stage would end with zero changes. The planner's fix is a stubbed-collaborator unit test in the
+step plus the stage's `Conformance tests:` declaration for the real-backend check. A test whose
+collaborator is stubbed is not real IO. **Enforced:** the rule reaches each verifier on every
+`P-Step-*` item through `okstra plan-items prompt`
+(`okstra_ctl.phases.implementation_planning.authoring._REAL_IO_STEP_NOTE`); the vote itself is
+verifier judgement.
+
 ## Mode constraint
 
 Plan-body verification only supports **lightweight mode** (defined in `prompts/lead/convergence.md` §"Verification Mode"). `full-reanalysis` is not meaningful here because the "original source materials" for a plan item are the worker's own analysis plus the lead-mediated synthesis — there is no independent ground truth to re-read. The manifest's top-level `verificationMode` is ignored for this round; lightweight is always used.

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -147,7 +147,8 @@ Plan for the actual worktree layout before approval. Shared documentation direct
       **Pick the cases by distinct outcome, not by line coverage.** When the stage writes or reconciles state, its meaningfully different outcomes are usually more than three — normal success, target already in the desired state (resume), existing data reused rather than created, a conflicting concurrent state, target absent, and mid-way failure with rollback. Enumerate the ones this stage actually implements and route them across the three lines (the `boundary` line is where resume / already-done / reuse belongs; `failure` carries conflict, absence, and rollback), naming each in the cell rather than collapsing them into "edge input". An implemented outcome with no declared case is a coverage gap the executor will not backfill.
   - **Per-stage subsections** (`## 5.5.<i> Stage <i>: <title>` for each `i`), each containing the four required subsections:
     - `### Carry-In` — for `depends-on (none)`: task-brief only. Otherwise: each depended-on stage's static exit contract + runtime sidecar path `runs/<impl-key>/carry/stage-<i>.json` placeholder.
-    - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the paths this step may write as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary. Read-only checks use `plannedPaths: []`; their working directory belongs in the command, not the write ledger. Never declare the repository or worktree root. Planning assembly and correction preflight enforce this through `write_policy.planned_path_declaration_errors`.** `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
+    - `### Stepwise Execution Order` — bite-sized table with `step | action | files | command | outcome | expected`. `outcome` is one word — `PASS` or `FAIL` — and `expected` is the sentence saying what that looks like here; a verdict written inside the sentence is not read as one. The `files` cell lists each touched path in full and `<PROJECT_ROOT>`-relative — never ellipsis-abbreviated (`…` / `...`), which does not resolve and is rejected by plan-body verification as a kind-b path mismatch. **The narrative row additionally carries `plannedPaths`: the paths this step may write as an array, one repository-relative path per entry, with no globs, exclusions, counts or commentary. Read-only checks use `plannedPaths: []`; their working directory belongs in the command, not the write ledger. Never declare the repository or worktree root. Planning assembly and correction preflight enforce this through `write_policy.planned_path_declaration_errors`.** **File size:** the implementation run aims for 300 physical lines per source and test file and enforces 400 — a new file over 400, an existing file taken past 400, and a file already over 400 that grows are blocking findings the executor must split in a correction round; the same conditions at 300 are advisory. When a step would add code or tests to a file near or over 300 lines (`wc -l`), plan a new module or test file for that responsibility in `plannedPaths` instead of appending to the existing one. **Enforced at implementation, not here:** `okstra correction file-size` (`scripts/okstra_ctl/file_size_cap.py`), re-run by `okstra stage-done`. `files` is the sentence a reader sees; `plannedPaths` is the ledger report assembly preserves and the implementer write policy enforces. When a step legitimately covers a set too large to enumerate, split it or name the directory the set lives under. **Effective row count ≤ 8** (excluding header / divider / blank). Each step is one cohesive, self-contained change. **TDD ordering is MUST, not a preference:** the **first** effective step's `action` cell MUST start with the literal `RED:` and describe the failing test(s) that capture this stage's `Acceptance` **and the three declared `Test case (success|boundary|failure)` lines** (`outcome` = `FAIL`); at least one later `action` cell MUST start with the literal `GREEN:` and describe the minimal implementation that makes it pass (`outcome` = `PASS`); an optional refactor step starts with `REFACTOR:`. **Exemption:** doc-only / config-only / pure-rename stages with no observable runtime behaviour may omit RED/GREEN by declaring one line `TDD exemption: <reason>` in the stage section. A stage that is truthfully none of those three declares `TDD exemption: user-bypass — <the user's words>`, which holds only while the user has granted it for that stage with `okstra prepare --tdd-bypass "<stage>:<reason>"` — never file the nearest of the three instead. Validator S10c enforces RED-first + GREEN; the `outcome` cell agreeing with its prefix is a schema conditional. S10e rejects an unsupported exemption reason and a `user-bypass` with no user grant (`validators/validate-implementation-plan-stages.py`).
+    - **Real-IO tests stay out of the plan's committed steps (BLOCKING).** A step never creates, edits, or runs a test that opens a real database connection, makes a real network call, or talks to a real external service inside the project source test tree (`src/**`, `test/**`, `tests/**`, `**/__tests__/**`, `*.spec.*`, `*.test.*`, `*.e2e-spec.*`), and no step's `PASS` depends on a reachable database or service. The implementation executor refuses such a step before its first edit (`_implementation-executor.md` "Real-IO test isolation"), so a plan that contains one stops the stage with zero changes (observed 2026-10-18, dev-11374: a live-MySQL `test/font-pairing.e2e-spec.ts` planned in steps 1, 4 and 5). The committed RED/GREEN steps test the adapter with its injected collaborator stubbed — the exact query text, its replacements, and the returned rows — and run without any backend. Real-backend verification is declared only as this stage's `Conformance tests:` line below (`requires=[db|http|external]`): the implementation run writes that script under `<task_root>/qa/scripts/`, runs it against a local or replica backend when one is reachable, never commits it, and records a non-PASS or unreachable backend as advisory. Read a brief line such as `verify: integration test against a test database` as that conformance declaration, not as a committed test. Do not plan a shared real-DB guard, a test DDL fixture, or an edit to an existing real-IO suite in source to support it. **Enforced:** every `P-Step-*` item of the §5.5.9 plan-body round carries this rule to its verifiers (`okstra_ctl.phases.implementation_planning.authoring._REAL_IO_STEP_NOTE`), which vote `DISAGREE(b)` on a step that breaks it; no path pattern tells a mocked test from a live one, so no validator checks it.
     - **The `command` cell runs inside an okstra task worktree, not a bare checkout (BLOCKING).** okstra provisions `.okstra`, the configured sync entries (`.project-docs`, `.claude`, …), and — for `implementation` — a nested `stage-<N>/` worktree into the tree the step executes in. Two consequences bind every command you write:
       - **Clean-tree assertions use `okstra worktree-status --check-clean`.** A bare `git status --porcelain` is never empty there, so an assertion built on one fails on okstra's scaffolding rather than on the stage's work. The okstra command asks the same question over source paths only and exits 1 when dirty, so it stands alone as a step's assertion: `okstra worktree-status --check-clean`. Validator S13 rejects the bare form. Do not add a `git tag stage-<N>-exit` to the step. Stage completion records the commit in the consumer ledger without creating or moving git tags.
       - **Never read an `.okstra/` artifact back out of a git object.** `.okstra/**` is gitignored and never committed — the executor aborts a commit that stages an ignored path and the verifier reports a committed `.okstra` path as a branch defect — so `git cat-file -e <tag>:.okstra/…`, `git show <tag>:.okstra/…`, and every variant of that read can never resolve, at any tag, in any stage. A later stage that needs a QA artifact reads it from the working tree or receives it through the carry sidecar / verifier result; do not design a stage contract around one being reachable from a tag. Validator S12 rejects the read.

package/runtime/python/okstra_ctl/phases/technical_verification/entry.py

@@ -98,3 +98,40 @@ def materialize_technical_input_packet(payload_json: str, run_root: Path, seq: s
         "- Read the input before planning experiments; copy each fact identity verbatim into results.\n"
         + "\n```json\n" + payload_json + "\n```\n"
     )
+
+
+def technical_evidence_packet_block(source: Path, project_root: Path) -> str:
+    """carry-in 이 시험 결과 기록이면 후속 비교 워커가 읽을 증거 위치를 렌더한다.
+
+    clarification carry-in 은 §1 행만 싣고 원문은 `Source report:` 한 줄로만
+    가리키므로, 이 블록이 없으면 워커는 시험 결과와 로그에 닿지 못한다.
+    """
+    from okstra_ctl.path_resolve import relative_to_project_root
+    from okstra_ctl.phases.technical_verification.validation import REPORT_NAME_RE
+
+    match = REPORT_NAME_RE.fullmatch(source.name)
+    if match is None or not source.is_file():
+        return ""
+    data = load_owned_object_snapshot(
+        source, artifact="technical verification result"
+    ).value
+    if (data.get("header") or {}).get("taskType") != "technical-verification":
+        return ""
+    experiments = source.parent.parent / "experiments" / match[1]
+    lines = [
+        "## Technical Verification Evidence",
+        "",
+        "The clarification response is a technical-verification record. Apply"
+        " `Technical evidence loop` in `## Phase Focus Extract`: read each"
+        " check's plan, commands and logs below before authoring a fresh"
+        " feasibility vote.",
+        "",
+        f"- Result record: `{relative_to_project_root(source, project_root)}`",
+        "- Experiment plans and logs:"
+        f" `{relative_to_project_root(experiments, project_root)}/`",
+    ]
+    for check in (data.get("technicalVerification") or {}).get("checks") or []:
+        lines.append(
+            f"- `{check.get('id')}` on `{check.get('candidateId')}`: {check.get('status')}"
+        )
+    return "\n".join(lines)

package/runtime/python/okstra_ctl/phases/technical_verification/validation.py

@@ -10,6 +10,8 @@ from okstra_ctl.implementation_direction import validate_task_artifact_path
 from okstra_ctl.json_boundary import load_owned_object_snapshot
 from okstra_ctl.technical_verification_facts import TechnicalVerificationError
 
+REPORT_NAME_RE = re.compile(r"final-report-technical-verification-(\d{3,})\.data\.json")
+
 
 def _check_execution_evidence(
     check: Mapping[str, Any], project_root: Path, run_root: Path, seq: str
@@ -51,9 +53,7 @@ def validate_technical_verification_report(
     """발행·최종 검증에서 같은 사실 집합과 실제 시험 산출물을 대조한다."""
     if (data.get("header") or {}).get("taskType") != "technical-verification":
         return []
-    match = re.fullmatch(
-        r"final-report-technical-verification-(\d{3,})\.data\.json", report_path.name
-    )
+    match = REPORT_NAME_RE.fullmatch(report_path.name)
     if match is None:
         return ["technical verification report must use its canonical record path"]
     run_root = report_path.parent.parent

package/runtime/python/okstra_ctl/render.py

@@ -26,7 +26,7 @@ import sys
 from collections.abc import Mapping
 from pathlib import Path
 
-from okstra_project.dirs import TASK_MANIFEST_FILENAME, OKSTRA_DIR_NAME, project_json_path
+from okstra_project.dirs import TASK_MANIFEST_FILENAME
 
 # phase 시퀀스 / 기본 next-phase 매핑의 SSOT 는 workflow 모듈이다. 과거
 # render_task_manifest 가 동일한 리스트/딕셔너리를 로컬에 중복 정의했는데,
@@ -50,6 +50,8 @@ from .registry.provider_registry import default_provider_registry
 from .path_hints import compact_active_run_context, hydrate_run_context
 from .paths import task_timeline_file
 from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
+from .mcp_servers import load_declarations as load_mcp_declarations
+from .mcp_servers import render_block as render_mcp_block
 from .report_contract import CURRENT_REPORT_SCHEMA_VERSION
 from .report_language import resolve_report_language
 from .validation_contract import CURRENT_VALIDATION_CONTRACT_VERSION
@@ -2509,54 +2511,11 @@ def render_task_index(template_path: str, output_path: str, ctx: dict) -> None:
 # --------------------------------------------------------------------------- #
 
 
-_NO_MCP_SERVERS_LINE = (
-    f"- No MCP servers are declared in `{OKSTRA_DIR_NAME}/project.json`'s "
-    "`mcpServers` array. Treat MCP tools as unavailable for this run. To enable "
-    "them, add entries shaped `{name, description, tools, notes?}` to that array "
-    "and re-render the bundle."
-)
-
-
 def build_available_mcp_servers_block(project_root: Path) -> str:
-    """Render the `## Available MCP Servers` first bullet from project.json.
-
-    The MCP server list used to be hardcoded for one specific environment.
-    It now comes from the project's okstra project.json (`mcpServers` array),
-    so each user/project declares the MCP surface available to their
-    lead+workers. Missing file or empty array yields a generic "none declared"
-    fallback.
-    """
-    config_path = project_json_path(project_root)
-    try:
-        raw = load_owned_object(config_path, artifact="project config")
-    except JsonBoundaryError:
-        return _NO_MCP_SERVERS_LINE
-    servers = raw.get("mcpServers") if isinstance(raw, dict) else None
-    if not isinstance(servers, list) or not servers:
-        return _NO_MCP_SERVERS_LINE
-    lines: list[str] = []
-    for entry in servers:
-        if not isinstance(entry, dict):
-            continue
-        name = str(entry.get("name", "")).strip()
-        if not name:
-            continue
-        description = str(entry.get("description", "")).strip()
-        tools = entry.get("tools") or []
-        notes = str(entry.get("notes", "")).strip()
-        parts = [f"`mcp__{name}`"]
-        if description:
-            parts.append(description)
-        if isinstance(tools, list) and tools:
-            tool_names = ", ".join(
-                f"`{str(t).strip()}`" for t in tools if str(t).strip()
-            )
-            if tool_names:
-                parts.append(f"Tools: {tool_names}")
-        if notes:
-            parts.append(notes)
-        lines.append("- " + ". ".join(parts) + ".")
-    return "\n".join(lines) if lines else _NO_MCP_SERVERS_LINE
+    """provider 판정 없이 렌더한다. prepare 는 판정한 블록을 ctx 로 넘기므로
+    이 경로는 prepare 를 거치지 않는 렌더 호출자만 쓴다."""
+    declarations, _problems = load_mcp_declarations(project_root)
+    return render_mcp_block(declarations)
 
 
 # --------------------------------------------------------------------------- #

package/runtime/python/okstra_ctl/report_language.py

@@ -1,10 +1,9 @@
 """Report-language resolution — the one place the precedence lives.
 
-Two surfaces need the answer and must agree: the `**Report Language:**` line
-both dispatchers stamp into the report-writer prompt, and `reportLanguage` in
-the run manifest, which report assembly copies into `meta.reportLanguage` and
-the HTML renderer reads. When only the prompt called this, a project could ask
-for `ko`, get a Korean-instructed writer, and still ship an English report.
+Prepare calls this once and freezes the answer as `reportLanguage` in the run
+manifest. Both report-writer dispatch paths stamp that manifest value as the
+`**Report Language:**` line, and report assembly copies it into
+`meta.reportLanguage`, so a config edit after prepare cannot split the two.
 
 The value is a language tag (`en`, `ko`, `fr`, `pt-BR`, …). The report writer
 authors the report prose in that language; nothing here knows any particular

package/runtime/python/okstra_ctl/run.py

@@ -23,6 +23,7 @@ from okstra_ctl.phases.implementation_planning.validation import validate_select
 from .phases.technical_verification.entry import (
     prepare_technical_verification_input,
     materialize_technical_input_packet,
+    technical_evidence_packet_block,
 )
 
 from argparse import (
@@ -55,6 +56,7 @@ from .phases.implementation_planning.entry import (
 )
 from . import fix_cycles
 from .analysis_packet import build_analysis_packet
+from .mcp_servers import NO_MCP_SERVERS_LINE, prepare_mcp
 from .coverage_census import (
     CensusError,
     census_filename,
@@ -3051,6 +3053,16 @@ def _write_instruction_set_sources(
         ),
         coverage_census_text=coverage_census_text,
         has_selected_direction=(instruction_set / "selected-direction.json").is_file(),
+        mcp_servers_text=(
+            "" if ctx.get("AVAILABLE_MCP_SERVERS", NO_MCP_SERVERS_LINE) == NO_MCP_SERVERS_LINE
+            else ctx["AVAILABLE_MCP_SERVERS"]
+        ),
+        technical_evidence_text=(
+            technical_evidence_packet_block(
+                Path(inp.clarification_response_path), Path(ctx["PROJECT_ROOT"]),
+            )
+            if inp.clarification_response_path else ""
+        ),
     )
     if inp.task_type == "technical-verification":
         packet += materialize_technical_input_packet(
@@ -4055,6 +4067,20 @@ def _prepare_user_authorization(inp: PrepareInputs) -> dict:
     return record
 
 
+def _prepare_mcp_block(
+    project_root: Path, plan: AssignmentPlan, brief_path: Path,
+) -> str:
+    brief_text = brief_path.read_text(encoding="utf-8") if brief_path.is_file() else ""
+    prepared = prepare_mcp(
+        project_root,
+        (assignment.provider_id for assignment in plan.assignments),
+        brief_text,
+    )
+    for warning in prepared.warnings:
+        print(f"prepare: {warning}", file=sys.stderr)
+    return prepared.block
+
+
 def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
     """Produce a complete okstra task bundle on disk. See module docstring."""
     user_authorization = _prepare_user_authorization(inp)
@@ -4326,6 +4352,9 @@ def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
         "DYNAMIC_EXECUTION_ROLES_JSON": json.dumps(
             dynamic_roles, ensure_ascii=False,
         ),
+        "AVAILABLE_MCP_SERVERS": _prepare_mcp_block(
+            project_root, assignment_plan, inp.brief_path,
+        ),
     })
     refresh_run_context_snapshot(ctx)
     if lead_runtime == "codex":

package/runtime/python/okstra_ctl/stage_done.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -23,6 +24,7 @@ from .consumers import (
     carry_head_commit,
     read_consumers,
 )
+from .file_size_cap import file_size_violations
 from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
 from .paths import RunRef
 from .stage_reopen import resolve_planned_stage
@@ -49,6 +51,34 @@ def _read_carry(carry_file: Path, stage: int) -> dict:
     return carry
 
 
+def _check_file_size(project_root: Path, carry: dict, head: str) -> str:
+    """Refuse to settle a stage whose diff breaks the file-size limit; return what was checked.
+
+    Verifiers report the limit from `okstra correction file-size`; this re-runs it so a stage
+    a verifier did not check still reaches the correction round instead of landing. A range
+    git cannot read is reported in the output, not refused: the limit is a code-quality rule
+    and must not strand a stage whose verdict already passed.
+    """
+    rng = carry.get("stageCommitRange")
+    base = rng.get("base") if isinstance(rng, dict) else None
+    if not base:
+        return "not checked: the carry has no stageCommitRange.base"
+    try:
+        violations = [
+            v for v in file_size_violations(project_root, str(base), head) if v.blocking
+        ]
+    except subprocess.CalledProcessError as exc:
+        return f"not checked: git: {exc.stderr.decode(errors='replace').strip()}"
+    if violations:
+        raise StateError(
+            "the stage diff breaks the 400-line file-size limit:\n"
+            + "\n".join(v.line() for v in violations)
+            + f"\nRun a correction round (`okstra correction prompt ... --base {head} "
+            f"--stage-base {base}`) so the executor splits these files, or end the run FAIL "
+            "with `okstra stage-fail` when no round is left.", stage="file-size")
+    return f"pass: {base}..{head}"
+
+
 def _supersede(target: Path, rows: list[dict], stage: int) -> Path:
     """Move the sidecar of the run that first settled a reopened stage aside, unchanged."""
     settled = [r for r in rows if r.get("stage") == stage and r.get("status") == "done"]
@@ -76,6 +106,7 @@ def done_stage(
     identity, plan_run_root = resolve_planned_stage(project_root, task_key, stage)
     carry = _read_carry(carry_file, stage)
     head = carry_head_commit(carry)
+    file_size_cap = _check_file_size(project_root, carry, head)
     report = report if report.is_absolute() else project_root / report
     try:
         report_rel = report.relative_to(RunRef.from_report_path(report).run_dir).as_posix()
@@ -118,6 +149,7 @@ def done_stage(
         "supersededCarryPath": str(superseded) if superseded else "",
         "reportPath": report_rel,
         "consumersPath": str(plan_run_root / "consumers.jsonl"),
+        "fileSizeCap": file_size_cap,
     }
 
 
@@ -131,11 +163,13 @@ canonical sidecar `runs/implementation/carry/stage-<N>.json`, then appends the
 `done` row with that carry path, the report path relative to its run directory,
 the carry's head and the completion time. A reopened stage's previous sidecar
 is moved to `carry/superseded/stage-<N>-from-<task-type>-<seq>.json` first.
-Refuses a carry for another stage, a failed carry, and a stage already done at
-another head. Re-running with the same carry writes nothing new.
+Refuses a carry for another stage, a failed carry, a stage already done at
+another head, and a carry whose stageCommitRange diff leaves a source or test
+file over the 400-line limit (`okstra correction file-size`). Re-running with the
+same carry writes nothing new.
 
 Output: JSON { ok, taskKey, stage, headCommit, carryPath, supersededCarryPath,
-reportPath, consumersPath }. Exit 1 on a refusal, 2 when
+reportPath, consumersPath, fileSizeCap }. Exit 1 on a refusal, 2 when
 PROJECT_ROOT cannot be resolved.
 """
 

package/runtime/skills/_fragments/wizard-lead-takeover.md

@@ -1,6 +1,6 @@
 ## Step 6: Take over as Okstra lead
 
-Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it.
+Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it. The run manifest's `reportLanguage` sets the language of okstra report artifacts; a host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not override it, and the lead never tells the report writer to use another language.
 
 Then proceed through the phases exactly as the lead prompt directs (Phase 1 context → Phase 2+ worker dispatch → final synthesis → final report).
 

package/runtime/skills/_fragments/wizard-relay-protocol.md

@@ -20,8 +20,8 @@ On `ok: false`, re-prompt with the same `current.step` using the error message.
 The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object, including the runtime-generated navigation and completion options. If the entry is absent, stop instead of inventing a host function or falling back silently. Use the explicit `Legacy text relay compatibility` mapping only when the preflight response has no `relayContract`.
 
 - `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
-- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
-- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the host's selected-labels string unchanged (labels may contain `, `; the wizard decodes it against the option list); submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; a single-select step value is the selected option value, and a multi-select step value is the host's selected-labels string unchanged, not a JSON array.
 - `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
 - `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
 - `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.

package/runtime/skills/okstra-discussion/SKILL.md

@@ -47,8 +47,8 @@ On `ok: false`, re-prompt with the same `current.step` using the error message.
 The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object, including the runtime-generated navigation and completion options. If the entry is absent, stop instead of inventing a host function or falling back silently. Use the explicit `Legacy text relay compatibility` mapping only when the preflight response has no `relayContract`.
 
 - `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
-- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
-- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the host's selected-labels string unchanged (labels may contain `, `; the wizard decodes it against the option list); submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; a single-select step value is the selected option value, and a multi-select step value is the host's selected-labels string unchanged, not a JSON array.
 - `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
 - `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
 - `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.
@@ -290,7 +290,7 @@ You can delete the literal state-file path after this point — its job is done.
 <!-- BEGIN FRAGMENT: wizard-lead-takeover -->
 ## Step 6: Take over as Okstra lead
 
-Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it.
+Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it. The run manifest's `reportLanguage` sets the language of okstra report artifacts; a host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not override it, and the lead never tells the report writer to use another language.
 
 Then proceed through the phases exactly as the lead prompt directs (Phase 1 context → Phase 2+ worker dispatch → final synthesis → final report).
 

package/runtime/skills/okstra-manager/SKILL.md

@@ -52,6 +52,7 @@ okstra manager view --manager-id <manager-id>
 
 `remove project`, `remove task`, `remove task-group` and `task remove-child` change nothing without `--confirm`; they print what would be removed (`Removed: no — dry run`). Run the command without `--confirm` first, show the user the listed project, path, tasks or kept children, and rerun with `--confirm` only after the user approves that exact target. These commands touch manager files only; project `.okstra/` state and briefs written by `task split` stay.
 
+- `task status` shows the snapshot as of `Synced at` with its `Sync age`; a child marked `changed since sync: yes` has a project task manifest written after that sync, so run `task sync` before reporting its state.
 - `remove project` unregisters the project and keeps its child tasks. `task status` shows them with `project linked: no`, the view marks them `unlinked`, and `task run` refuses them until the project is registered again with `new project`.
 - `task update` changes only the fields given and needs no confirmation. `new task` still refuses to change an existing task's objective, common brief or progress mode.
 

package/runtime/skills/okstra-run/SKILL.md

@@ -47,8 +47,8 @@ On `ok: false`, re-prompt with the same `current.step` using the error message.
 The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object, including the runtime-generated navigation and completion options. If the entry is absent, stop instead of inventing a host function or falling back silently. Use the explicit `Legacy text relay compatibility` mapping only when the preflight response has no `relayContract`.
 
 - `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
-- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
-- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the host's selected-labels string unchanged (labels may contain `, `; the wizard decodes it against the option list); submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; a single-select step value is the selected option value, and a multi-select step value is the host's selected-labels string unchanged, not a JSON array.
 - `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
 - `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
 - `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.
@@ -455,7 +455,7 @@ If `render-bundle` raises Step 5's concurrent-run conflict detection (concurrent
 <!-- BEGIN FRAGMENT: wizard-lead-takeover -->
 ## Step 6: Take over as Okstra lead
 
-Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it.
+Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it. The run manifest's `reportLanguage` sets the language of okstra report artifacts; a host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not override it, and the lead never tells the report writer to use another language.
 
 Then proceed through the phases exactly as the lead prompt directs (Phase 1 context → Phase 2+ worker dispatch → final synthesis → final report).
 

package/runtime/skills/okstra-setup/SKILL.md

@@ -174,6 +174,8 @@ matching section:
 - **F. declared architecture style** (`architecture.style`) — `hexagonal` /
   `layered` / `none`; hand-added, default `none`. Declaring one makes that
   architecture's placement rules binding in planning + verification.
+- **H. MCP servers** (`mcpServers`) — `okstra mcp add` declares a server,
+  `okstra mcp check` shows which provider CLIs reach it.
 
 ## Step 4: Verify