okstra 0.220.1 → 0.222.0

package/runtime/python/okstra_ctl/report_synthesis_packet.py

@@ -14,6 +14,7 @@ from typing import Any, Mapping
 from okstra_token_usage.blocks import accounting_workers
 
 from .analysis_packet import reference_source_extracts
+from .correction_round import correction_convergence_states
 from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
 from .phases.implementation_option_selection.authoring import (
     requirement_instructions as selection_requirement_instructions,
@@ -251,6 +252,17 @@ class ReportSynthesisPacket:
             ]
         if self.task_type == "implementation-planning":
             return self._planning_requirement_instructions()
+        if self.task_type == "implementation" and any(
+            source.label.startswith(f"{CONVERGENCE_STATE_LABEL} (correction-r")
+            for source in self.sources
+        ):
+            return [
+                "Each `Convergence state (correction-r<N>)` source is correction round N's "
+                "re-convergence of the verifiers' re-verification; the plain `Convergence "
+                "state` is the initial round's. Describe the stage's open findings from the "
+                "last round's re-convergence, not the initial one; report what each round "
+                "fixed through `implementation.correctionRounds`.",
+            ]
         if self.task_type != "implementation-option-selection":
             return []
         return selection_requirement_instructions(
@@ -371,6 +383,7 @@ _SOURCE_FIELDS = (
     ("Final report schema", "orchestrator", "instructionSet", "finalReportSchemaPath", True),
     ("Convergence state", "convergence", "run", "convergenceStatePath", True),
 )
+CONVERGENCE_STATE_LABEL = "Convergence state"
 
 
 _READ_CHUNK_BYTES = 16_000
@@ -514,7 +527,7 @@ def _source_markdown(
         brief = next((item.content.strip() for item in sources if item.label == "Task brief"), "")
         if len(brief.encode("utf-8")) >= _SHARED_TEXT_MIN_BYTES:
             content = content.replace(brief, 'Read the complete "Source: Task brief" above.')
-    if source.label == "Convergence state":
+    if source.label.startswith(CONVERGENCE_STATE_LABEL):
         content = _convergence_view(content)
         if content != source.content.rstrip("\n"):
             view = [
@@ -815,6 +828,14 @@ def _source_specs(
                 path = str(Path(instruction_set) / "final-report-schema.json")
         if path or required:
             specs.append((label, owner, path, required))
+        if label == CONVERGENCE_STATE_LABEL and path:
+            specs.extend(
+                (f"{CONVERGENCE_STATE_LABEL} ({scope})", owner,
+                 _relative(project_root, round_final), True)
+                for scope, round_final in correction_convergence_states(
+                    _resolve(project_root, path)
+                )
+            )
     if carried_source:
         specs.append((CARRIED_STAGES_LABEL, "orchestrator", carried_source, True))
     specs.extend(_user_response_specs(project_root, narrative_path))

package/runtime/python/okstra_ctl/run.py

@@ -23,6 +23,7 @@ from okstra_ctl.phases.implementation_planning.validation import validate_select
 from .phases.technical_verification.entry import (
     prepare_technical_verification_input,
     materialize_technical_input_packet,
+    technical_evidence_packet_block,
 )
 
 from argparse import (
@@ -55,6 +56,7 @@ from .phases.implementation_planning.entry import (
 )
 from . import fix_cycles
 from .analysis_packet import build_analysis_packet
+from .mcp_servers import NO_MCP_SERVERS_LINE, prepare_mcp
 from .coverage_census import (
     CensusError,
     census_filename,
@@ -3051,6 +3053,16 @@ def _write_instruction_set_sources(
         ),
         coverage_census_text=coverage_census_text,
         has_selected_direction=(instruction_set / "selected-direction.json").is_file(),
+        mcp_servers_text=(
+            "" if ctx.get("AVAILABLE_MCP_SERVERS", NO_MCP_SERVERS_LINE) == NO_MCP_SERVERS_LINE
+            else ctx["AVAILABLE_MCP_SERVERS"]
+        ),
+        technical_evidence_text=(
+            technical_evidence_packet_block(
+                Path(inp.clarification_response_path), Path(ctx["PROJECT_ROOT"]),
+            )
+            if inp.clarification_response_path else ""
+        ),
     )
     if inp.task_type == "technical-verification":
         packet += materialize_technical_input_packet(
@@ -3358,10 +3370,11 @@ def _maybe_open_fix_cycle(inp: PrepareInputs, task_root: Path, existing: dict,
             f"{', '.join(fix_cycles.FIX_CYCLE_ENTRY_PHASES)})에서만 허용됩니다: "
             f"{inp.task_type}")
     workflow = existing.get("workflow") or {}
-    if workflow.get("lastCompletedPhase") != "release-handoff":
+    if not fix_cycles.delivery_completed(workflow):
         raise PrepareError(
-            "--fix-cycle yes 는 release-handoff 까지 완료된 task 에만 허용됩니다 "
-            "(workflow.lastCompletedPhase 확인)")
+            "--fix-cycle yes 는 release-handoff 로 전달까지 끝난 task 에만 허용됩니다 "
+            "(workflow.lastCompletedPhase 가 release-handoff 이고, skip·미전달 stage 로 "
+            "다음 phase 가 release-handoff 로 남아 있지 않아야 함)")
     brief_text = Path(inp.brief_path).read_text(encoding="utf-8")
     fix_cycles.append_opened(
         task_root, target_report=str(existing.get("latestReportRecordPath", "")),
@@ -3373,7 +3386,8 @@ def _record_fix_cycle_events(inp: PrepareInputs, ctx: dict) -> str:
     """fix-cycles.jsonl 의 lazy-close → opened → run 기록. cycle id 반환.
 
     - lazy-close: open cycle 에 release-handoff run 이 부착됐고 디스크 manifest 의
-      lastCompletedPhase 가 release-handoff 면 닫는다. manifest 는 prepare 가
+      lastCompletedPhase 가 release-handoff 면 닫는다. 다음 phase 포인터가 다시
+      release-handoff 를 가리키면(skip·미전달 stage) 닫지 않는다. manifest 는 prepare 가
       이번 run 으로 재작성하기 *전* 값이어야 하므로 finalize 직전에 호출한다.
     - opened: --fix-cycle yes 일 때만. 완료 task + entry phase 미충족이면
       PrepareError.
@@ -3386,7 +3400,7 @@ def _record_fix_cycle_events(inp: PrepareInputs, ctx: dict) -> str:
 
     open_c = fix_cycles.open_cycle(fix_cycles.read_rows(task_root))
 
-    if open_c and workflow.get("lastCompletedPhase") == "release-handoff":
+    if open_c and fix_cycles.delivery_completed(workflow):
         rows = fix_cycles.read_rows(task_root)
         handoff_attached = any(
             r.get("event") == "run" and r.get("cycle") == open_c["cycle"]
@@ -4055,6 +4069,20 @@ def _prepare_user_authorization(inp: PrepareInputs) -> dict:
     return record
 
 
+def _prepare_mcp_block(
+    project_root: Path, plan: AssignmentPlan, brief_path: Path,
+) -> str:
+    brief_text = brief_path.read_text(encoding="utf-8") if brief_path.is_file() else ""
+    prepared = prepare_mcp(
+        project_root,
+        (assignment.provider_id for assignment in plan.assignments),
+        brief_text,
+    )
+    for warning in prepared.warnings:
+        print(f"prepare: {warning}", file=sys.stderr)
+    return prepared.block
+
+
 def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
     """Produce a complete okstra task bundle on disk. See module docstring."""
     user_authorization = _prepare_user_authorization(inp)
@@ -4326,6 +4354,9 @@ def prepare_task_bundle(inp: PrepareInputs) -> PrepareOutputs:
         "DYNAMIC_EXECUTION_ROLES_JSON": json.dumps(
             dynamic_roles, ensure_ascii=False,
         ),
+        "AVAILABLE_MCP_SERVERS": _prepare_mcp_block(
+            project_root, assignment_plan, inp.brief_path,
+        ),
     })
     refresh_run_context_snapshot(ctx)
     if lead_runtime == "codex":

package/runtime/python/okstra_ctl/stage_done.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -23,6 +24,7 @@ from .consumers import (
     carry_head_commit,
     read_consumers,
 )
+from .file_size_cap import file_size_violations
 from .json_boundary import JsonBoundaryError, load_owned_object, write_owned_object_atomic
 from .paths import RunRef
 from .stage_reopen import resolve_planned_stage
@@ -49,6 +51,34 @@ def _read_carry(carry_file: Path, stage: int) -> dict:
     return carry
 
 
+def _check_file_size(project_root: Path, carry: dict, head: str) -> str:
+    """Refuse to settle a stage whose diff breaks the file-size limit; return what was checked.
+
+    Verifiers report the limit from `okstra correction file-size`; this re-runs it so a stage
+    a verifier did not check still reaches the correction round instead of landing. A range
+    git cannot read is reported in the output, not refused: the limit is a code-quality rule
+    and must not strand a stage whose verdict already passed.
+    """
+    rng = carry.get("stageCommitRange")
+    base = rng.get("base") if isinstance(rng, dict) else None
+    if not base:
+        return "not checked: the carry has no stageCommitRange.base"
+    try:
+        violations = [
+            v for v in file_size_violations(project_root, str(base), head) if v.blocking
+        ]
+    except subprocess.CalledProcessError as exc:
+        return f"not checked: git: {exc.stderr.decode(errors='replace').strip()}"
+    if violations:
+        raise StateError(
+            "the stage diff breaks the 400-line file-size limit:\n"
+            + "\n".join(v.line() for v in violations)
+            + f"\nRun a correction round (`okstra correction prompt ... --base {head} "
+            f"--stage-base {base}`) so the executor splits these files, or end the run FAIL "
+            "with `okstra stage-fail` when no round is left.", stage="file-size")
+    return f"pass: {base}..{head}"
+
+
 def _supersede(target: Path, rows: list[dict], stage: int) -> Path:
     """Move the sidecar of the run that first settled a reopened stage aside, unchanged."""
     settled = [r for r in rows if r.get("stage") == stage and r.get("status") == "done"]
@@ -76,6 +106,7 @@ def done_stage(
     identity, plan_run_root = resolve_planned_stage(project_root, task_key, stage)
     carry = _read_carry(carry_file, stage)
     head = carry_head_commit(carry)
+    file_size_cap = _check_file_size(project_root, carry, head)
     report = report if report.is_absolute() else project_root / report
     try:
         report_rel = report.relative_to(RunRef.from_report_path(report).run_dir).as_posix()
@@ -118,6 +149,7 @@ def done_stage(
         "supersededCarryPath": str(superseded) if superseded else "",
         "reportPath": report_rel,
         "consumersPath": str(plan_run_root / "consumers.jsonl"),
+        "fileSizeCap": file_size_cap,
     }
 
 
@@ -131,11 +163,13 @@ canonical sidecar `runs/implementation/carry/stage-<N>.json`, then appends the
 `done` row with that carry path, the report path relative to its run directory,
 the carry's head and the completion time. A reopened stage's previous sidecar
 is moved to `carry/superseded/stage-<N>-from-<task-type>-<seq>.json` first.
-Refuses a carry for another stage, a failed carry, and a stage already done at
-another head. Re-running with the same carry writes nothing new.
+Refuses a carry for another stage, a failed carry, a stage already done at
+another head, and a carry whose stageCommitRange diff leaves a source or test
+file over the 400-line limit (`okstra correction file-size`). Re-running with the
+same carry writes nothing new.
 
 Output: JSON { ok, taskKey, stage, headCommit, carryPath, supersededCarryPath,
-reportPath, consumersPath }. Exit 1 on a refusal, 2 when
+reportPath, consumersPath, fileSizeCap }. Exit 1 on a refusal, 2 when
 PROJECT_ROOT cannot be resolved.
 """
 

package/runtime/python/okstra_ctl/stage_reconcile.py

@@ -1,4 +1,4 @@
-"""Best-effort git reconciliation shared by stage prepare flows."""
+"""Git reconciliation shared by stage prepare flows."""
 from __future__ import annotations
 
 import sys
@@ -31,3 +31,51 @@ def auto_reconcile_best_effort(inp: Any, plan_run_root: Path) -> None:
             )
     except Exception as exc:
         print(f"git-reconcile skipped: {exc}", file=sys.stderr)
+
+
+class StaleStageRecordsError(RuntimeError):
+    """A recorded stage SHA no longer matches git and only the user can say which commit counts."""
+
+
+def require_reconciled_stages(
+    inp: Any, plan_run_root: Path, *, stage: int | None = None,
+) -> None:
+    """Apply auto items, then refuse while a confirm item remains.
+
+    A prepare that restores, rebases or merges stage branches calls this first:
+    building on a recorded commit the branch no longer carries integrates work
+    nobody verified. ``stage`` narrows the check to that stage's done row.
+    """
+    from .git_reconcile import _git, classify_task, guidance
+
+    auto_reconcile_best_effort(inp, plan_run_root)
+    # A project prepared without git (worktree status skipped-not-git) has no
+    # history the recorded SHAs could disagree with.
+    if _git(Path(inp.project_root), "rev-parse", "--git-dir").returncode != 0:
+        return
+    coordinates = dict(
+        project_id=inp.project_id,
+        task_group=inp.task_group,
+        task_id=inp.task_id,
+        work_category=inp.work_category,
+    )
+    pending = [
+        item
+        for item in classify_task(
+            project_root=Path(inp.project_root),
+            plan_run_root=plan_run_root,
+            **coordinates,
+        )
+        if item.classification == "confirm"
+        and (stage is None or item.stage == stage)
+    ]
+    if not pending:
+        return
+    lines = "\n".join(
+        f"  {f'stage {item.stage}' if item.kind == 'done' else 'anchor'}: "
+        f"{item.reason} (recorded {item.recorded})"
+        for item in pending
+    )
+    raise StaleStageRecordsError(
+        f"{lines}\n{guidance(plan_run_root=plan_run_root, **coordinates)}"
+    )

package/runtime/python/okstra_ctl/wizard/steps_plan.py

@@ -215,14 +215,14 @@ def _stage_plan_for_confirmation(
 
 
 def _fix_cycle_confirm_required(state: WizardState) -> bool:
-    """완료(release-handoff) task 에 entry phase 로 재진입하고, 아직 열린 fix
-    cycle 이 없을 때만 묻는다."""
+    """전달까지 끝난(release-handoff) task 에 entry phase 로 재진입하고, 아직
+    열린 fix cycle 이 없을 때만 묻는다."""
     if state.task_type not in fix_cycles.FIX_CYCLE_ENTRY_PHASES:
         return False
     task_root = task_dir(Path(state.project_root),
                          state.task_group, state.task_id)
     workflow = (read_task_manifest(task_root) or {}).get("workflow") or {}
-    if workflow.get("lastCompletedPhase") != "release-handoff":
+    if not fix_cycles.delivery_completed(workflow):
         return False
     return fix_cycles.open_cycle(fix_cycles.read_rows(task_root)) is None
 

package/runtime/schemas/final-report-v3.0.schema.json

@@ -480,6 +480,42 @@
             }
           ]
         },
+        "correctionRounds": {
+          "type": "array",
+          "maxItems": 2,
+          "description": "Each implementation correction round's re-convergence of the verifiers' re-verification, projected from `convergence-correction-r<N>-<task-type>-<seq>.json`. Row ids continue the initial round's numbering so every row keeps its own anchor.",
+          "items": {
+            "type": "object",
+            "required": [
+              "round",
+              "consensus",
+              "differences"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "round": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 2
+              },
+              "roundHistory": {
+                "$ref": "#/properties/crossVerification/properties/roundHistory"
+              },
+              "consensus": {
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/ConsensusRow"
+                }
+              },
+              "differences": {
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/DifferenceRow"
+                }
+              }
+            }
+          }
+        },
         "criticGaps": {
           "type": "object",
           "description": "Coverage-critic gap accounting. `proposed - merged - unverified` is the count the voters judged and rejected, so a gap that vanished shows up as a mismatch instead of as nothing. Every `unverified` gap needs a matching `missingInformation` row with source `critic-unverified` (prompts/lead/convergence.md \"Gap verification\").",

package/runtime/skills/_fragments/wizard-lead-takeover.md

@@ -1,6 +1,6 @@
 ## Step 6: Take over as Okstra lead
 
-Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it.
+Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it. The run manifest's `reportLanguage` sets the language of okstra report artifacts; a host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not override it, and the lead never tells the report writer to use another language.
 
 Then proceed through the phases exactly as the lead prompt directs (Phase 1 context → Phase 2+ worker dispatch → final synthesis → final report).
 

package/runtime/skills/_fragments/wizard-relay-protocol.md

@@ -20,8 +20,8 @@ On `ok: false`, re-prompt with the same `current.step` using the error message.
 The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object, including the runtime-generated navigation and completion options. If the entry is absent, stop instead of inventing a host function or falling back silently. Use the explicit `Legacy text relay compatibility` mapping only when the preflight response has no `relayContract`.
 
 - `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
-- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
-- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the host's selected-labels string unchanged (labels may contain `, `; the wizard decodes it against the option list); submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; a single-select step value is the selected option value, and a multi-select step value is the host's selected-labels string unchanged, not a JSON array.
 - `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
 - `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
 - `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.

package/runtime/skills/okstra-discussion/SKILL.md

@@ -47,8 +47,8 @@ On `ok: false`, re-prompt with the same `current.step` using the error message.
 The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object, including the runtime-generated navigation and completion options. If the entry is absent, stop instead of inventing a host function or falling back silently. Use the explicit `Legacy text relay compatibility` mapping only when the preflight response has no `relayContract`.
 
 - `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
-- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
-- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the host's selected-labels string unchanged (labels may contain `, `; the wizard decodes it against the option list); submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; a single-select step value is the selected option value, and a multi-select step value is the host's selected-labels string unchanged, not a JSON array.
 - `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
 - `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
 - `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.
@@ -290,7 +290,7 @@ You can delete the literal state-file path after this point — its job is done.
 <!-- BEGIN FRAGMENT: wizard-lead-takeover -->
 ## Step 6: Take over as Okstra lead
 
-Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it.
+Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it. The run manifest's `reportLanguage` sets the language of okstra report artifacts; a host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not override it, and the lead never tells the report writer to use another language.
 
 Then proceed through the phases exactly as the lead prompt directs (Phase 1 context → Phase 2+ worker dispatch → final synthesis → final report).
 

package/runtime/skills/okstra-manager/SKILL.md

@@ -52,6 +52,7 @@ okstra manager view --manager-id <manager-id>
 
 `remove project`, `remove task`, `remove task-group` and `task remove-child` change nothing without `--confirm`; they print what would be removed (`Removed: no — dry run`). Run the command without `--confirm` first, show the user the listed project, path, tasks or kept children, and rerun with `--confirm` only after the user approves that exact target. These commands touch manager files only; project `.okstra/` state and briefs written by `task split` stay.
 
+- `task status` shows the snapshot as of `Synced at` with its `Sync age`; a child marked `changed since sync: yes` has a project task manifest written after that sync, so run `task sync` before reporting its state.
 - `remove project` unregisters the project and keeps its child tasks. `task status` shows them with `project linked: no`, the view marks them `unlinked`, and `task run` refuses them until the project is registered again with `new project`.
 - `task update` changes only the fields given and needs no confirmation. `new task` still refuses to change an existing task's objective, common brief or progress mode.
 

package/runtime/skills/okstra-run/SKILL.md

@@ -47,8 +47,8 @@ On `ok: false`, re-prompt with the same `current.step` using the error message.
 The wizard tells you which relay operation to use via `next.interaction.kind`. Step 1 loads the current registered host's relay contract. Use the matching entry under its `interactions` object, including the runtime-generated navigation and completion options. If the entry is absent, stop instead of inventing a host function or falling back silently. Use the explicit `Legacy text relay compatibility` mapping only when the preflight response has no `relayContract`.
 
 - `native-single` → use the current registered host's relay contract for its native single-select function. Pass every option in its original order and submit the selected `options[].value`.
-- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the selected values as one CSV answer; submit an empty selection as `--answer ""`.
-- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; when a grouped question is multi-select, its step value is the selected option values joined as one CSV string, not a JSON array.
+- `native-multi` → use the relay contract's native multi-select function. Pass every option in its original order and submit the host's selected-labels string unchanged (labels may contain `, `; the wizard decodes it against the option list); submit an empty selection as `--answer ""`.
+- `native-group` → use the relay contract's native grouped-question function once. Preserve every question and option, then submit one JSON object keyed by `questions[].step`; a single-select step value is the selected option value, and a multi-select step value is the host's selected-labels string unchanged, not a JSON array.
 - `numbered-single` → render every option as a 1-based numbered Markdown list and submit the user's next message unchanged.
 - `numbered-multi` → render every option as a 1-based numbered Markdown list and submit the user's comma-separated reply unchanged.
 - `sequential-group` → render every question in order, preserve each complete option list, collect every answer, and submit one JSON object keyed by `questions[].step`.
@@ -439,6 +439,7 @@ If `render-bundle` fails with a `PrepareError` containing `Recorded stage SHAs n
    - **Enter a different ref directly** — the user names a commit/branch/tag.
    - **Abort** — stop the run without recovering.
 3. Run `okstra git-reconcile … --apply --stage <N> --use-ref <ref>` with the chosen ref, then retry the failed `render-bundle` with the same arguments.
+   If that output carries a `Warning` naming the implementation anchor, the chosen head no longer contains the anchor: show the warning to the user and run its printed `--reset-anchor` command only after they confirm the new base, before the retry.
 
 If the anchor (`implementation_base_commit`) is reported unresolvable, run the same command's `--reset-anchor <ref>` after user confirmation. Correcting a confirm item without the picker is forbidden — the runtime also rejects a confirm correction without `--use-ref`.
 
@@ -455,7 +456,7 @@ If `render-bundle` raises Step 5's concurrent-run conflict detection (concurrent
 <!-- BEGIN FRAGMENT: wizard-lead-takeover -->
 ## Step 6: Take over as Okstra lead
 
-Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it.
+Read `resources.leadExecutionPromptPath` from the run manifest at `<RUN_MANIFEST_PATH>` — the same manifest Step 5 already opened for `resources.leadPromptMetadataPath` — then read that file verbatim and take over as `Okstra lead` in the current host-native session. Do not construct the path yourself: the prompt is written per run under `runs/<task-type>/prompts/lead-execution-prompt-<task-type>-<seq>.md`, not in the instruction set, and the `<seq>` is assigned at prepare time. The prompt selects exactly one runtime adapter and points to compact intake artifacts first (`active-run-context`, `analysis-profile.md`, and `analysis-packet.md`); full source files such as `analysis-material.md`, `reference-expectations.md`, and `final-report-template.md` are lazy/fallback inputs. Follow the rendered prompt order, do not preempt it. The run manifest's `reportLanguage` sets the language of okstra report artifacts; a host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not override it, and the lead never tells the report writer to use another language.
 
 Then proceed through the phases exactly as the lead prompt directs (Phase 1 context → Phase 2+ worker dispatch → final synthesis → final report).
 

package/runtime/skills/okstra-setup/SKILL.md

@@ -174,6 +174,8 @@ matching section:
 - **F. declared architecture style** (`architecture.style`) — `hexagonal` /
   `layered` / `none`; hand-added, default `none`. Declaring one makes that
   architecture's placement rules binding in planning + verification.
+- **H. MCP servers** (`mcpServers`) — `okstra mcp add` declares a server,
+  `okstra mcp check` shows which provider CLIs reach it.
 
 ## Step 4: Verify
 

package/runtime/skills/okstra-setup/references/project-config.md

@@ -301,3 +301,37 @@ preserves it:
   records that it read no rules and the run still passes. Whether a pack that
   does resolve was actually read and applied stays the phase's own
   `project-review-rules:` record — no machine check reads a worker's reasoning.
+
+## H. MCP servers (`mcpServers`)
+
+`mcpServers` declares the MCP servers a run may use — a Figma file server for a
+visual check, for example. Without a declaration the launch prompt and the
+analysis packet tell every worker that MCP is unavailable, even when a provider
+CLI has the server configured.
+
+Register each server with `okstra mcp add`. `--tool` repeats per tool;
+`--alias` repeats per name a provider CLI lists the server under (one provider
+may list Figma as `claude.ai Figma`, another as `figma-desktop`):
+
+```bash
+okstra mcp add --name figma --description "Figma design files" --tool get_screenshot --tool get_metadata --alias "claude.ai Figma" --alias figma-desktop
+```
+
+Then check which providers can reach it:
+
+```bash
+okstra mcp check
+```
+
+Each provider adapter lists its own CLI's MCP servers without an inference
+call. `reachable` means the provider listed the server enabled; `disabled`
+means listed but disabled or awaiting authentication; `missing` means not
+listed; `unknown` means the adapter cannot list. Show the result to the user.
+For a provider that is not `reachable`, tell the user to add the server to that
+provider CLI's own MCP configuration — okstra never edits a provider's
+configuration. `okstra mcp list` and `okstra mcp remove --name <name>` manage
+existing entries.
+
+prepare repeats the check for the providers a run selects and prints a warning
+for each gap; it never refuses the run. It also warns when the task brief cites
+a Figma URL and no declared server name or alias contains `figma`.

package/runtime/templates/report-writer-prompt-preamble.md

@@ -30,7 +30,7 @@ The narrative is not free-form Markdown. A narrative file is the line `# OKSTRA
 
 Blank lines are ignored. **Every other line is rejected**, including Markdown headings (`#`, `##`, `###`), a pipe table written at column 0, code fences, bare paragraphs, JSON, YAML, and JSON Pointer. A heading or table that belongs in the reader's report is written as the text of a `> ` value, never as a narrative line of its own.
 
-Follow the task-specific schema order. Write every `> ` prose value directly in the language named by `**Report Language:**`; do not draft in English first, because no translation step follows. Field names, `Verdict Token` and other enum or status values, finding and requirement ids, paths, symbols, commands, and model names stay exactly as the schema and sources spell them.
+Follow the task-specific schema order. Write every `> ` prose value directly in the language named by `**Report Language:**`; do not draft in English first, because no translation step follows. A host, project or global instruction file (`CLAUDE.md`, `AGENTS.md`) does not change that language for report artifacts. Field names, `Verdict Token` and other enum or status values, finding and requirement ids, paths, symbols, commands, and model names stay exactly as the schema and sources spell them.
 
 ### Top-level fields you may author
 

package/runtime/templates/reports/html/base.template.html

@@ -70,7 +70,7 @@
     </section>
     {% endif %}
     {% set no_cross_model_check = taskType != "release-handoff" and (crossVerification.get("roundHistory") or {}).get("round2SkippedReason") == "single-analyser-only" %}
-    {% if crossVerification.get("consensus") or crossVerification.get("differences") or no_cross_model_check %}
+    {% if crossVerification.get("consensus") or crossVerification.get("differences") or crossVerification.get("correctionRounds") or no_cross_model_check %}
     <section data-report-section="cross-check">
       <h2>{{ t('base.cross-check') }}</h2>
       {% if no_cross_model_check %}<p class="section-lede">{{ t('base.no-cross-model-check') }}</p>{% endif %}
@@ -82,6 +82,11 @@
       <h3>{{ t('base.workers-disagreed') }}</h3>
       <div class="summary-grid">{% for row in crossVerification.differences %}<article class="summary-card tone-important" id="id-xv-{{ row.id }}"><p class="eyebrow">{{ row.id | inline_code }}</p><h3>{{ row.disagreement | inline_code }}</h3><p>{% for pos in row.get("workersPosition", []) %}{{ pos.worker | inline_code }} · {{ pos.position | inline_code }}{% if not loop.last %} · {% endif %}{% endfor %}</p><p class="evidence-refs">{{ t('macros.layout.evidence') }} {{ row.evidence | inline_code }}</p></article>{% endfor %}</div>
       {% endif %}
+      {% for correction in crossVerification.get("correctionRounds", []) %}
+      <h3>{{ t('base.cross-check-correction-round') | replace('{round}', correction.round | string) }}</h3>
+      {% if correction.consensus %}<div class="summary-grid">{% for row in correction.consensus %}<article class="summary-card" id="id-xv-{{ row.id }}"><p class="eyebrow">{{ row.id | inline_code }} · {{ t('base.agreed-across-workers') }}</p><h3>{{ row.statement | inline_code }}</h3><p class="evidence-refs">{{ t('macros.layout.evidence') }} {{ row.evidence | inline_code }}</p></article>{% endfor %}</div>{% endif %}
+      {% if correction.differences %}<div class="summary-grid">{% for row in correction.differences %}<article class="summary-card tone-important" id="id-xv-{{ row.id }}"><p class="eyebrow">{{ row.id | inline_code }} · {{ t('base.workers-disagreed') }}</p><h3>{{ row.disagreement | inline_code }}</h3><p>{% for pos in row.get("workersPosition", []) %}{{ pos.worker | inline_code }} · {{ pos.position | inline_code }}{% if not loop.last %} · {% endif %}{% endfor %}</p><p class="evidence-refs">{{ t('macros.layout.evidence') }} {{ row.evidence | inline_code }}</p></article>{% endfor %}</div>{% endif %}
+      {% endfor %}
     </section>
     {% endif %}
     {% if agentActivity %}

package/runtime/templates/reports/html/i18n/en.json

@@ -242,6 +242,7 @@
     "no-cross-model-check": "No cross-model check ran: fewer than two analysis workers were selected, so no other model verified these findings.",
     "agreed-across-workers": "Agreed across workers",
     "workers-disagreed": "Workers disagreed",
+    "cross-check-correction-round": "Re-converged after correction round {round}",
     "source": "Source",
     "confidence": "Confidence",
     "export-my-answers": "Export my answers",

package/runtime/templates/reports/html/i18n/ko.json

@@ -242,6 +242,7 @@
     "no-cross-model-check": "교차 모델 검증을 하지 않았습니다. 분석 작업자를 두 명 미만으로 골라 다른 모델이 이 결과를 검증하지 않았습니다.",
     "agreed-across-workers": "작업자 간 합의",
     "workers-disagreed": "작업자 간 이견",
+    "cross-check-correction-round": "수정 라운드 {round} 뒤 재수렴",
     "source": "출처",
     "confidence": "확신도",
     "export-my-answers": "내 답변 내보내기",

package/runtime/templates/reports/task-brief.template.md

@@ -154,13 +154,13 @@ taskType: "{{FM_TASK_TYPE}}"
 
 ## Available MCP Servers
 
-The MCP servers available to this run are declared in `.okstra/project.json`'s `mcpServers` array and rendered into the Okstra lead's launch prompt under `## Available MCP Servers`. The lead is responsible for forwarding the rendered list verbatim into worker prompts (Phase 2) so each assignment can determine whether its selected runner exposes the named tools.
+The MCP servers available to this run are declared in `.okstra/project.json`'s `mcpServers` array. Prepare renders them, with the providers that list each server, into the lead's launch prompt and the analysis packet under `## Available MCP Servers`.
 
-To declare servers, add entries shaped `{ "name": "<server>", "description": "...", "tools": ["..."], "notes": "..." }` to that array. If the array is empty or absent, treat MCP as unavailable for this run.
+To declare a server, run `okstra mcp add --name <server> --description <text> --tool <tool>... [--alias <name-as-a-provider-lists-it>...]`, then `okstra mcp check` to see which providers reach it. If nothing is declared, treat MCP as unavailable for this run.
 
 How to invoke (worker-by-worker):
 
-- **Native-session assignments**: invoke an MCP tool directly by its tool name (e.g. `mcp__<server>__<tool>`) only when the selected host adapter exposes it. Do not call an MCP tool name through a shell.
+- **Native-session assignments**: invoke an MCP tool directly through the host's tool interface, under the name the host adapter exposes, only when it exposes the server. Do not call an MCP tool name through a shell.
 - **CLI-wrapper assignments**: use only the MCP or tool configuration explicitly supported and forwarded by that provider wrapper. If the wrapper has no matching MCP configuration, record `MCP not available in this CLI` in `Missing Information or Assumptions`; do not attempt a shell fallback.
 - All workers: cite the exact server, tool, and SELECT (or `WHERE` filters) used in the result file. Tool-call failures must be logged in the worker's `*-errors.json` (commandKind `mcp_call`) so the lead can decide whether to retry under a different worker.
 

package/runtime/validators/validate-run.py

@@ -2342,6 +2342,15 @@ def _validate_conformance_surfaces(
         )
 
 
+def _stage_ended_without_a_commit(report_data: dict) -> bool:
+    implementation = report_data.get("implementation")
+    if not isinstance(implementation, dict):
+        return False
+    evidence = implementation.get("stageSidecarEvidence")
+    withheld = isinstance(evidence, dict) and str(evidence.get("withheld") or "").strip()
+    return bool(withheld) and not implementation.get("commitList")
+
+
 def _validate_conformance(
     report_path: Path,
     failures: list[str],
@@ -2389,6 +2398,10 @@ def _validate_conformance(
         )
         if declared_manifest is None:
             return warnings
+        # 스크립트와 manifest 항목은 stage 를 실행한 run 이 쓴다. 커밋 없이 carry 를
+        # 보류한 run(첫 편집 전 정지 후 재계획)은 그것을 쓸 기회가 없었다.
+        if _stage_ended_without_a_commit(report_data):
+            declared_manifest = None
     if declared_manifest is not None:
         scoped_declared = _scope_manifest_entries(declared_manifest, stage_name)
         for error in missing_declared_scripts(
@@ -4841,8 +4854,10 @@ def _validate_convergence_group_provenance(run_dir, failures, suffix=None) -> No
 # provider token (`claude` vs `claude-worker`), depending on how the roster was
 # seeded — worker resolution below accepts both. `-reverify-r` never occurs
 # inside a slug, so the non-greedy slug capture stops at that literal anchor.
+# A correction round's re-convergence puts `correction-r<N>-` before
+# `reverify-r`, and its plans carry the same token before `<task-type>`.
 _REVERIFY_PROMPT_BASENAME_RE = re.compile(
-    r"^(?P<slug>[a-z][a-z0-9-]*?)-reverify-r(?P<round>\d+)"
+    r"^(?P<slug>[a-z][a-z0-9-]*?)(?:-(?P<scope>correction-r\d+))?-reverify-r(?P<round>\d+)"
     r"-(?P<task_type>[a-z][a-z-]*?)-(?P<seq>\d{3})\.md$"
 )
 
@@ -5305,8 +5320,9 @@ def _validate_reverify_prompt_matches_plan(run_dir, failures, suffix=None) -> No
         if match is None:
             continue
         round_n = match.group("round")
+        scope = f"{match.group('scope')}-" if match.group("scope") else ""
         plan_path = state_dir / (
-            f"convergence-round-{round_n}-plan-"
+            f"convergence-round-{round_n}-plan-{scope}"
             f"{match.group('task_type')}-{match.group('seq')}.json"
         )
         if not plan_path.is_file():