okstra 0.223.2 → 0.225.0

package/runtime/python/okstra_ctl/phases/implementation_planning/authoring.py

@@ -11,8 +11,10 @@ from . import plan_body
 
 import argparse
 import copy
+from dataclasses import dataclass
 import json
 import re
+import subprocess
 from collections.abc import Mapping, Sequence
 from datetime import datetime, timezone
 from pathlib import Path
@@ -25,6 +27,7 @@ from okstra_ctl.convergence import (
     validated_run_authority,
 )
 from okstra_ctl.convergence_store import write_json_atomic
+from okstra_ctl.paths import RUN_VALIDATOR_RELATIVE, find_asset_root
 from okstra_ctl.incremental_carry import sync_prepared_dispatch_queue
 from okstra_ctl.json_boundary import JsonBoundaryError, load_owned_object
 from okstra_ctl.report_finalize import task_manifest_path
@@ -54,6 +57,14 @@ from okstra_ctl.plan_items import (
     with_response_format,
 )
 from okstra_ctl.paths import RunRef
+from okstra_ctl.plan_item_evidence import (
+    capture_review_inputs,
+    dependency_scopes,
+    reusable_item_ids,
+    review_fingerprint,
+    review_files_unchanged,
+)
+from okstra_ctl.plan_review_context import render_review_context
 from okstra_ctl.stage_ledger import build_stage_ledger
 from okstra_ctl.claim_reproduction import NOT_RUNNABLE, reproduce
 from okstra_ctl.final_report_schema import load_schema_version
@@ -118,13 +129,39 @@ def _queue_for(
     run_manifest: Path | None,
     previous_hashes: Mapping[str, str] | None = None,
     tied_ids: Sequence[str] | None = None,
+    previous_rows: Sequence[Mapping[str, Any]] = (),
+    review_inputs: Mapping[str, Any] | None = None,
 ) -> list[str]:
     ledger = _merged_ledger(planning, run_manifest)
     if tied_ids is not None:
         return tie_vote_item_ids(items, ledger, tied_ids)
+    inputs = review_inputs or _review_inputs(items, planning, run_manifest, previous_rows)
+    reusable = reusable_item_ids(previous_rows, inputs)
+    candidates = set(dispatch_item_ids(items, ledger))
     if previous_hashes:
-        return reverify_item_ids(items, previous_hashes, ledger)
-    return dispatch_item_ids(items, ledger)
+        candidates.update(reverify_item_ids(items, previous_hashes, ledger))
+    return [item["id"] for item in items if item["id"] in candidates - reusable]
+
+
+def _review_inputs(
+    items: list[dict[str, Any]], planning: Mapping[str, Any],
+    run_manifest: Path | None, rows: Sequence[Mapping[str, Any]],
+) -> dict[str, Any]:
+    if run_manifest is None:
+        return {}
+    authority = validated_run_authority(run_manifest)
+    return capture_review_inputs(items, planning, authority.payload, authority.project_root, rows)
+
+
+def _checked_review_inputs(run_manifest: Path | None) -> dict[str, Any]:
+    root = _probe_project_root(run_manifest)
+    if root is None:
+        return {}
+    path = _prepared_items_path(run_manifest)
+    inputs = _load_json_object(path).get("reviewInputs", {}) if path.is_file() else {}
+    if not review_files_unchanged(inputs, root):
+        raise PlanItemContractError("review evidence changed during dispatch; prepare and verify again")
+    return inputs
 
 
 def _queue_kwargs(args: argparse.Namespace) -> dict[str, Any]:
@@ -133,7 +170,9 @@ def _queue_kwargs(args: argparse.Namespace) -> dict[str, Any]:
         if state is None:
             raise PlanItemContractError("--tie-vote requires --state")
         return {"tied_ids": _tied_ids(state)}
-    return {"previous_hashes": _previous_hashes(getattr(args, "state", None))}
+    state = getattr(args, "state", None)
+    rows = _state_plan_body_items(_load_json_object(state), state) if state and state.is_file() else []
+    return {"previous_hashes": _previous_hashes(state), "previous_rows": rows}
 
 
 def _tied_ids(state_path: Path) -> list[str]:
@@ -170,8 +209,8 @@ def _parser() -> argparse.ArgumentParser:
     prepare.add_argument(
         "--state",
         type=Path,
-        help="previous plan-body state; when it carries verifiedContentHash "
-        "rows the dispatch queue shrinks to the self-fix reverify set, and "
+        help="previous plan-body state; only matching body and complete "
+        "evidence fingerprints shrink the self-fix reverify queue, and "
         "each queued item's recorded votes and selfFixNote are carried "
         "into the prompt as its `**Prior round dissent**` block",
     )
@@ -251,8 +290,8 @@ def _parser() -> argparse.ArgumentParser:
         "--prior-state",
         type=Path,
         help="the previous run's plan-body-verification-<task-type>-<seq>.json. "
-        "A newly seeded item whose contentHash still equals that run's "
-        "verifiedContentHash inherits its verdicts and is tagged "
+        "A newly seeded item with matching body and complete evidence "
+        "fingerprints inherits its verdicts and is tagged "
         "carriedForwardFromSeq, so round 1 does not re-judge text nobody "
         "changed. Requires --state, refuses a state file belonging to "
         "another task, and never carries on a matching id alone",
@@ -474,12 +513,21 @@ def _prepare(args: argparse.Namespace) -> dict[str, Any]:
                 + "; correct the narrative in this run, then retry plan-items prepare"
             )
     envelope = _envelope(source)
+    kwargs = _queue_kwargs(args)
+    envelope["reviewInputs"] = _review_inputs(
+        envelope["items"], _planning(source), args.run_manifest,
+        kwargs.get("previous_rows", []),
+    )
     envelope["dispatchQueue"] = _queue_for(
         envelope["items"],
         _planning(source),
         args.run_manifest,
-        **_queue_kwargs(args),
+        **kwargs,
+        review_inputs=envelope["reviewInputs"],
     )
+    envelope["reusedItems"] = sorted(reusable_item_ids(
+        kwargs.get("previous_rows", []), envelope["reviewInputs"],
+    ))
     if getattr(args, "tie_vote", False):
         envelope["dispatchKind"] = "critic-tie"
         envelope["tieSplits"] = _tie_splits_from_state(
@@ -998,6 +1046,7 @@ def _render_inputs(run_manifest: Path) -> str:
 
 
 def _prompt(args: argparse.Namespace) -> str:
+    inputs = _checked_review_inputs(args.run_manifest)
     envelope = _load_json_object(
         _prepared_items_path(args.run_manifest, require_regular=True)
     )
@@ -1021,6 +1070,11 @@ def _prompt(args: argparse.Namespace) -> str:
         line("Item count", len(items)),
         _render_inputs(args.run_manifest),
     ]
+    authority = validated_run_authority(args.run_manifest)
+    rows.append(render_review_context(
+        [item["id"] for item in items], inputs, authority.payload, authority.project_root,
+    ))
+    _checked_review_inputs(args.run_manifest)
     for index, item in enumerate(items, 1):
         if not isinstance(item, Mapping):
             continue
@@ -1075,6 +1129,12 @@ def _validate_prepared(args: argparse.Namespace) -> dict[str, Any]:
     )
     if actual.get("dispatchQueue") != expected_queue:
         raise PlanItemContractError("prepared dispatch queue does not match")
+    current_inputs = _review_inputs(
+        expected["items"], _planning(source), args.run_manifest,
+        _queue_kwargs(args).get("previous_rows", []),
+    )
+    if actual.get("reviewInputs") != current_inputs:
+        raise PlanItemContractError("prepared review evidence changed; prepare again")
     if not getattr(args, "tie_vote", False):
         # 라운드 2+ 의 반대 의견 반입은 여기서만 검사된다. 봉투에서 빠지면
         # 프롬프트에도 빠지고, 반대한 워커는 자기 판정을 그대로 다시 적는다.
@@ -1089,6 +1149,69 @@ def _validate_prepared(args: argparse.Namespace) -> dict[str, Any]:
     return {"ok": True, "operation": "validate-prepared", "path": str(path)}
 
 
+@dataclass(frozen=True)
+class PreparedPlanReview:
+    manifest: Path
+    state: Path
+    items: Path
+    narrative: Path
+
+
+def validate_current_review(run_manifest: Path) -> PreparedPlanReview:
+    authority = validated_run_authority(run_manifest)
+    state = canonical_run_state_artifact(
+        authority, manifest_field="planBodyVerificationPath",
+        prefix="plan-body-verification", label="plan body verification path",
+    )
+    name = authority.payload.get("reportNarrativePath")
+    if not isinstance(name, str) or not name:
+        raise PlanItemContractError("reportNarrativePath is missing")
+    narrative = (authority.project_root / name).resolve(strict=True)
+    if not narrative.is_relative_to(authority.run_dir):
+        raise PlanItemContractError("plan narrative must stay inside the current run")
+    items_path = _prepared_items_path(run_manifest, require_regular=True)
+    prepared = _load_json_object(items_path)
+    source = _plan_source(argparse.Namespace(data=None, narrative=narrative))
+    items = _envelope(source)["items"]
+    if prepared.get("items") != items:
+        raise PlanItemContractError("prepared plan items do not match the current narrative")
+    inputs = _checked_review_inputs(run_manifest)
+    current = _review_inputs(items, _planning(source), run_manifest, [])
+    if inputs.get("context") != current.get("context"):
+        raise PlanItemContractError("prepared review context changed; prepare and verify again")
+    return PreparedPlanReview(run_manifest, state, items_path, narrative)
+
+
+def finish_verification_round(
+    review: PreparedPlanReview, results: Sequence[str], round_number: int,
+) -> dict[str, Any]:
+    common = ["--state", str(review.state), "--run-manifest", str(review.manifest),
+              "--items", str(review.items), "--round", str(round_number)]
+    apply_args = ["apply-verdicts", *common]
+    for result in results:
+        apply_args.extend(["--result", result])
+    if results and all(is_critic_worker(value.split("=", 1)[0]) for value in results):
+        apply_args.append("--append")
+    _apply_verdicts(_parser().parse_args(apply_args))
+    assets = find_asset_root(RUN_VALIDATOR_RELATIVE)
+    if assets is None:
+        raise PlanItemContractError("plan-body validator is unavailable")
+    verified = subprocess.run(
+        [sys.executable, str(assets.joinpath(*RUN_VALIDATOR_RELATIVE)),
+         "--section", "plan-body", "--narrative", str(review.narrative),
+         "--state", str(review.state)],
+        capture_output=True, text=True, check=False, timeout=60,
+    )
+    if verified.returncode:
+        raise PlanItemContractError(
+            f"plan-verify failed: {verified.stdout.strip()} {verified.stderr.strip()}"
+        )
+    validation = json.loads(verified.stdout)
+    validate_current_review(review.manifest)
+    completed = _complete_round(_parser().parse_args(["complete-round", *common]))
+    return {**completed, "verification": validation}
+
+
 def _split_result_arg(raw: str) -> tuple[str, Path]:
     worker, separator, path = raw.partition("=")
     if not separator or not worker.strip() or not path.strip():
@@ -1134,6 +1257,7 @@ def _verdict_row(worker: str, block: VerdictBlock) -> dict[str, Any]:
         ("fixability", block.fixability),
         ("note", block.note),
         ("explanation", block.explanation),
+        ("dependencies", block.dependencies),
     ):
         if value:
             row[key] = value
@@ -1367,24 +1491,6 @@ def _carry_prior_run_verdicts(
     added: list[dict[str, Any]],
     hashes: Mapping[str, str],
 ) -> _PriorRunCarry | None:
-    """직전 run 이 같은 본문에 내린 판정을 새로 시드된 행에 옮긴다.
-
-    실패한 계획 run 을 다시 돌면 판정이 하나도 넘어오지 않았다. 이월은 답변된
-    clarification 이 있는 경로에만 있고(`incremental_scope.decide_scope` 는
-    답변된 `C-NNN` 이 없으면 `full` 을 되돌려 `incremental_carry` 를 도달 불가로
-    만든다), 그래서 아무도 고치지 않은 문장이 매 재실행마다 다시 채점됐다.
-
-    행 모양은 `incremental_carry._stamp_carried` 와 같다 — `verdicts` 를 그대로
-    옮기고, `carriedForwardFromSeq` 에 직전 seq 를 찍고, `verifiedContentHash` 를
-    이번 추출 해시로 맞춘다. 그 해시가 시드의 `dispatchQueue` 계산에 그대로
-    들어가므로(`_queue_for` → `reverify_item_ids`), 이월된 행은 라운드 1 큐에서
-    빠진다. 큐를 따로 줄이지 않는 이유가 이것이다: incremental 경로가
-    `incremental_carry._recompute_dispatch_queue` 에서 쓰는 것과 같은 장치다.
-
-    id 만 같은 행은 절대 이월하지 않는다. `P-*` id 는 위치에서 나오므로 계획이
-    한 줄만 밀려도 같은 번호가 다른 문장을 가리킨다. 해시가 같아야 그 문장이
-    같은 문장이다.
-    """
     prior = getattr(args, "prior_state", None)
     if prior is None:
         return None
@@ -1420,9 +1526,17 @@ def _carry_prior_run_verdicts(
         current_hash = hashes.get(item_id)
         if not current_hash or previous.get("verifiedContentHash") != current_hash:
             continue
+        manifest = getattr(args, "run_manifest", None)
+        inputs = (
+            _load_json_object(_prepared_items_path(manifest)).get("reviewInputs", {})
+            if manifest is not None else {}
+        )
+        if item_id not in reusable_item_ids([previous], inputs):
+            continue
         row["verdicts"] = copy.deepcopy(verdicts)
         row["carriedForwardFromSeq"] = prev_seq
         row["verifiedContentHash"] = current_hash
+        row["verifiedReviewHash"] = previous["verifiedReviewHash"]
         count += 1
     return _PriorRunCarry(prev_seq, count)
 
@@ -1526,6 +1640,7 @@ def _seed(args: argparse.Namespace) -> dict[str, Any]:
         _planning(source),
         getattr(args, "run_manifest", None),
         previous,
+        previous_rows=recorded,
     )
     verification["gating"] = (
         verification.get("gating") is True
@@ -1609,8 +1724,21 @@ def _apply_verdicts(args: argparse.Namespace) -> dict[str, Any]:
             f"gate is re-derived from that table, so a verdict with nowhere to "
             f"land would be scored as if it were never cast"
         )
+    review_inputs = _checked_review_inputs(getattr(args, "run_manifest", None))
     if args.round_number < 1:
         raise PlanItemContractError("--round must be 1 or greater")
+    _write_round_verdicts(args, data, recorded, rows, review_inputs)
+    if requires_plan_repair(verification):
+        verification["gating"] = True
+    _validate_advisory_round(verification, args.round_number)
+    write_json_atomic(target, data)
+    return {"ok": True, "operation": "apply-verdicts", "path": str(target)}
+
+
+def _write_round_verdicts(
+    args: argparse.Namespace, data: Mapping[str, Any], recorded: list[dict[str, Any]],
+    rows: Mapping[str, list[dict[str, Any]]], review_inputs: Mapping[str, Any],
+) -> None:
     project_root = _probe_project_root(getattr(args, "run_manifest", None))
     append = bool(getattr(args, "append", False))
     replaces_critic = append and any(
@@ -1627,18 +1755,20 @@ def _apply_verdicts(args: argparse.Namespace) -> dict[str, Any]:
             rows,
             data.get("roundHistory"),
             args.round_number,
-            target,
-            discard_open_rounds=discard_open_rounds,
+            args.state or args.data,
+            discard_open_rounds=bool(getattr(args, "discard_open_rounds", False)),
         )
     writer = _append_item_verdicts if append else _replace_item_verdicts
     for item in recorded:
         if isinstance(item, Mapping) and item.get("id") in rows:
             writer(item, rows[item["id"]], args.round_number, project_root)
-    if requires_plan_repair(verification):
-        verification["gating"] = True
-    _validate_advisory_round(verification, args.round_number)
-    write_json_atomic(target, data)
-    return {"ok": True, "operation": "apply-verdicts", "path": str(target)}
+    review_inputs = {**review_inputs, "dependencies": dependency_scopes(recorded)}
+    for item in recorded:
+        if isinstance(item, Mapping) and item.get("id") in rows:
+            item.pop("verifiedReviewHash", None)
+            fingerprint = review_fingerprint(item, review_inputs)
+            if fingerprint is not None:
+                item["verifiedReviewHash"] = fingerprint
 
 
 def _stamped_verdicts(
@@ -2110,6 +2240,7 @@ def _reject_unbacked_self_fix_stop(
 
 
 def _complete_round(args: argparse.Namespace) -> dict[str, Any]:
+    _checked_review_inputs(args.run_manifest)
     if args.round_number < 1:
         raise PlanItemContractError("--round must be 1 or greater")
     data, current, audit, history = _round_inputs(args)

package/runtime/python/okstra_ctl/phases/implementation_planning/instructions/plan-body-verification.md

@@ -413,18 +413,22 @@ round before any host or provider process starts.
 
 For contract 3.0, `prepare` checks the selected-direction draft with the same semantic validator as publication before writing the queue. Correct all reported references, coverage rows and planned commands through the writer correction procedure, then retry in this run. **Enforced:** `report_assembly.validate_plan_draft` and `plan_items_cli._prepare`; `tests/report/test_report_assembly.py` checks that invalid coverage creates no prepared queue.
 
-1. Lead runs `okstra plan-items prepare --narrative <report-writer-narrative.md> --run-manifest <run-manifest>`, places the fixed output of `okstra plan-items prompt --run-manifest <run-manifest>` verbatim in every verifier prompt, then runs `okstra plan-items validate-prepared --narrative <report-writer-narrative.md> --run-manifest <run-manifest>`. After a self-fix rewrite, pass `--state <plan-body-verification.json>` on prepare and validate-prepared so the dispatch queue is the changed items plus their stage closure, not the full extract, and so each re-dispatched item carries the previous round's dissent (§"Re-verification rounds (round 2+)"). Python resolves the one convergence-owned state path from that run identity. Dispatch only after that exact-match validation succeeds. The prompt is the dispatch queue: `observed` / `deferred` stages are omitted; plan-wide items (`P-Dir-1`, `P-Var-*`, `P-Dep-*`, `P-Opt-*`) stay. Unscoped `P-Val-*` / `P-Req-*` / `P-Rb-*` stay on the first round, then only when their own `contentHash` changed — a neighbour rewrite must not resweep them. **Enforced:** `okstra_ctl.plan_items.dispatch_item_ids` / `reverify_item_ids`. After `okstra incremental-carry`, the carry copies unchanged checklist verdicts, rewrites `dispatchQueue`, and updates the sibling `plan-items-*.json` so the next `okstra plan-items prompt` does not re-score a carried row.
+1. Lead runs `okstra plan-items prepare --narrative <report-writer-narrative.md> --run-manifest <run-manifest>`, places the fixed output of `okstra plan-items prompt --run-manifest <run-manifest>` verbatim in every verifier prompt, then runs `okstra plan-items validate-prepared --narrative <report-writer-narrative.md> --run-manifest <run-manifest>`. After a self-fix rewrite, pass `--state <plan-body-verification.json>` on prepare and validate-prepared. The runtime reuses a verdict only when its body, complete declared evidence closure, shared analysis packet, plan metadata, reviewer assignments and review contract have the same fingerprint. A missing or uncertain dependency declaration, unresolved reference, non-result or executable fact probe stays in the re-verification queue. Detailed verdicts and their original rounds remain unchanged for reused items. File dependencies cover whole files; step items also include preceding steps; plan-wide and preparation items include all plan items. Python resolves the one convergence-owned state path from that run identity. Dispatch only after exact-match validation succeeds. `observed` / `deferred` stages remain omitted. An empty queue opens no worker dispatch and creates no verification round. **Enforced:** `implementation_planning.authoring._queue_for`, `plan_item_evidence.review_fingerprint`, `_validate_prepared` and `tests/run/test_plan_items.py`. An incremental carry without evidence snapshots keeps active items queued until prepare can validate their dependencies.
 
    **Then seed the landing table (BLOCKING):** `okstra plan-items seed --narrative <report-writer-narrative.md> --state <plan-body-verification.json> --run-manifest <run-manifest.json>`. `apply-verdicts` in step 8 refuses a verdict whose item has no `planBodyVerification.planItems[]` row. The report writer never owns that state, so the deterministic seed is the only creator of its rows. The seed is idempotent by id and never touches existing verdicts, so it is safe to re-run between rounds and after a self-fix re-extraction. It does refresh `contentHash` from the current extract. Skipping it makes step 8 fail with `plan-body state has no row for [...]`.
 
-   **On a re-run, add `--prior-state <the previous run's plan-body-verification-<task-type>-<seq>.json>`.** A newly seeded item whose `contentHash` equals that run's `verifiedContentHash` for the same id inherits its verdicts, is tagged `carriedForwardFromSeq`, and drops out of round 1's `dispatchQueue` — in the state and in the sibling `plan-items-*.json` the next `okstra plan-items prompt` reads. Without it a re-run re-judges every line the previous run already settled, and the same dissent re-opens under a new `P-*` number. A matching id alone never carries: `P-*` ids are positional, so a plan that gained one line hands the old id to a different sentence. The flag requires `--state` and refuses a prior state file that sits under another task's root — a plan-body state carries no task identity of its own, so its path is the only identity there is. **Enforced:** `okstra_ctl.plan_items_cli._carry_prior_run_verdicts`.
+   **On a re-run, add `--prior-state <the previous run's plan-body-verification-<task-type>-<seq>.json>`.** A newly seeded item inherits verdicts only when its body and verified evidence fingerprint match the prepared snapshot for the same task. Reused rows carry `carriedForwardFromSeq`; their full verdicts are preserved. Legacy body-only records re-enter verification. A matching id alone never carries: `P-*` ids are positional. The flag requires `--state` and refuses another task's state. **Enforced:** `implementation_planning.authoring._carry_prior_run_verdicts` and `plan_item_evidence.reusable_item_ids`.
 
    **`--run-manifest` is what scopes the gate to the stage you are starting.** Seed uses it to overlay disk `done` / `active` onto `planBodyVerification.stageLedger`. The current plan's depends-on fills `ready` / `blocked` when no prior plan exists, so a first run does not treat every stage as in-scope. **Enforced:** `okstra_ctl.plan_items.planning_stage_ledger`.
 2. For each analyser worker in the roster, use `okstra plan-items prompt` output verbatim as the instruction body in the materialization sequence above. Read §"Re-verification rounds (round 2+)" before preparing a later round; read §"Plan-body reverify prompt" only when diagnosing a prompt-contract failure.
 3. Dispatch uses the same wrapper infrastructure as finding convergence, so the `--role-slug` is the same canonical `<role>-worker` that convergence uses — not a round-specific slug. Result file path: `runs/<task-type>/worker-results/<role>-worker-plan-verify-r<N>-implementation-planning-<seq>.md` (e.g. `codex-worker-plan-verify-r1-implementation-planning-003.md`). **`<seq>` is the report's sequence** — the one in this run's `final-report-<task-type>-<seq>` filename, NOT the `workerResults` sequence the initial analysis results carry. The two are equal in most runs and diverge in some (`reports: 004` alongside `workerResults: 005` is a real case). Provenance no longer globs by either seq: it resolves the expected filenames from this run's team-state `workerDispatches[]` rows — the paths the dispatches actually recorded — and falls back to the seq glob only when no team-state is readable, saying so in its finding. The `-worker-` token is load-bearing twice over: §"Plan-body reverify prompt" requires the same anchor headers as convergence, whose `**Audit sidecar path:**` is derived by `okstra_ctl.worker_artifact_paths.audit_sidecar_rel()` inserting `-audit-` after that token — a slug without it makes the header underivable and the helper raises. Record each `planItems[].verdicts[].worker` as the same `<role>-worker` string, because provenance compares it to this filename's prefix. **Enforced:** `tests/contract/test_reverify_dispatch_anchors.py` derives the sidecar from the documented name and re-extracts the prefix the provenance resolver uses.
    **Verdict provenance.** Every verdict recorded in `planItems[].verdicts[]` MUST trace back to a dispatch that actually returned a result file. The whole gate — classification, self-fix eligibility, promotion, `gateBlockedBy` — is computed from these votes, so an unbacked vote lets the round be skipped while the gate still reads `passed`. **Enforced (advisory):** `scripts/okstra_ctl/phases/implementation_planning/plan_body.py` `_validate_plan_body_verdict_provenance` reports any `verdicts[].worker` with no recorded reverify dispatch whose result file exists; the finding is not in the blocking allowlist, so it surfaces as an advisory rather than failing the run — record it, never dismiss it. Recording a `verification-error` for a dispatch that produced no result is the correct way to represent a failed worker — inventing an `AGREE` is a contract violation, and renaming a result file to make provenance match destroys the link the check reads.
 
-4. After all dispatches return, lead aggregates verdicts per `P-*` item across workers and classifies each:
+4. After all dispatches return, first read `planVerification` in the `worker-dispatch`, `team await --json`, or `agent-prompt link-result --json` response. When its `status` is `completed`, the runtime has already parsed all accepted verifier results, run the plan-body contract validator, and recorded the round. Use its `gateResult`, `verification` (including advisories), and `nextDispatch`; skip the separate collect/apply/plan-verify/complete/next-dispatch calls and continue with the decisions and self-fix procedure below. `pending` means the complete prepared verifier roster has not returned. `failed` stops automatic completion and returns the error; preserve the result files and repair the named defect. `needs-lead`, or a response without this field, uses the manual procedure below. In particular, self-fix re-verification retains the lead-owned cause groups and completion metadata. **Enforced:** `phases/implementation_planning/round_completion.py` and the automatic-round and execution-boundary tests in `tests/run/test_plan_items.py`.
+
+   A critic correction sharing the analysers' round also returns `needs-lead`; retain the original round queue and use the manual `--append` procedure. The automatic-round tests in `tests/run/test_plan_items.py` enforce this boundary.
+
+   In the manual procedure, lead aggregates verdicts per `P-*` item across workers and classifies each:
 
    **Every in-scope item carries at least one verdict row (BLOCKING).** Aggregation covers the dispatch queue, not deferred or observed stages. An in-scope item left with an empty `verdicts[]` is not a weak signal the gate can discount — it classifies `all-non-result`, states as `needs-reverify`, and folds into `passed-with-dissent` next to items two verifiers actually agreed on, so a plan item nobody judged reads as a passing one. This is the shape a self-fix round produces when the planner adds an in-scope item and the targeted round-N queue never picks it up. A worker that returned nothing is a `verification-error` row (step 3), not a missing row; if an in-scope item was never dispatched, dispatch it before scoring the round. **Enforced:** `scripts/okstra_ctl/phases/implementation_planning/plan_body.py` `_validate_round_recorded_verdicts` fails any run whose `roundCount` ≥ 1 leaves an in-scope item with no verdict row.
 
@@ -693,6 +697,23 @@ and a `- Plan narrative:` line from its `reportNarrativePath`. The worker's
 are what let a verifier read the requirement a selected-direction `P-Req-*` row
 names by `originalRequirementId`. The lead does not add them by hand.
 
+When a complete input snapshot is available, the renderer also provides inline
+review context. Read that context and the assigned payloads first. It preserves
+the packet except its navigation index and generated analysis Coverage Census,
+and carries plan metadata plus supporting items as lossless JSON. Supporting
+items are narrowed only when the previous dependency closure is complete and
+every body in that closure is unchanged; otherwise all other plan items are
+included. A changed body, missing declaration, unresolved reference or uncertain
+cross-item claim requires the full context or the original Inputs paths.
+Read those paths when the supplied context does not resolve a question, and
+record the additional dependencies. Omission never proves absence.
+Packets containing finding-like headings are quoted as source data, preserving
+their text without adding foreign items to the plan-verification queue.
+
+Enforcement: `render_review_context` in `okstra_ctl.plan_review_context` selects
+the context; `test_plan_review_context_preserves_facts_and_falls_back_for_unknown_dependencies`
+in `tests/run/test_plan_items.py` checks retained facts and conservative fallback.
+
 Carrying the packet does not license re-analysis. It is there so the verifier
 can resolve a plan item back to the requirement it claims to satisfy; the
 posture in §"Adversarial plan-body posture" still applies, and this round does
@@ -847,6 +868,9 @@ never recorded, and the round is scored on the items that remain.
 **Probe** (only when Claim is fact): <one line of JSON, e.g. {"kind": "path-absent", "path": "src/missing.ts"}>
 **Note**: <the falsification candidate considered and why it is excluded; required even for AGREE>
 **Explanation**: <2-3 sentences>
+**Dependencies**: {"complete": false, "itemIds": [], "paths": []}
+
+Keep the detailed Note and Explanation. Declare all direct and transitive plan-item and whole-file evidence dependencies. Set `complete` to true only when that boundary is known. Include source files behind references. External or dynamic evidence, unlisted narrative dependencies and unresolved references keep `complete` false. This declaration controls reuse eligibility, not the verdict itself. Missing and malformed declarations are treated as unknown by `verdict_blocks._block` and `plan_item_evidence.review_fingerprint`.
 
 ### P-Opt-2
 ...

package/runtime/python/okstra_ctl/phases/implementation_planning/plan_body.py

@@ -68,6 +68,7 @@ from okstra_ctl.design_surfaces import DesignSurfaceError  # noqa: E402
 
 from okstra_ctl.plan_items import (  # noqa: E402
     content_hash,
+    PlanItemContractError,
     expected_plan_item_ids,
     extract_plan_items,
 )
@@ -2543,6 +2544,7 @@ def validate_plan_body_section(
     _validate_round_recorded_verdicts(data, failures)
     _validate_verdicts_match_current_subjects(data, failures)
     _validate_verdict_rounds_outlive_self_fix(data, failures)
+    _validate_review_evidence(data, report_path, failures)
     _validate_unresolved_tie_was_reverified(data, failures)
     _validate_advisory_plan_body_gating(data, failures)
     _validate_plan_item_extraction_completeness(data, failures)
@@ -2553,6 +2555,37 @@ def validate_plan_body_section(
     return [*_detect_self_fix_recurrence(pbv), *_detect_uniform_verifier(pbv)]
 
 
+def _validate_review_evidence(data: dict, report_path: Path, failures: list[str]) -> None:
+    from okstra_ctl.convergence import validated_run_authority, ConvergenceContractError
+    from okstra_ctl.plan_item_evidence import capture_review_inputs, review_fingerprint
+
+    planning = data.get("implementationPlanning") or {}
+    pbv = planning.get("planBodyVerification") or {}
+    rows = pbv.get("planItems") or []
+    if not any(row.get("verifiedReviewHash") for row in rows):
+        return
+    sequences = _manifest_seq_for_report(report_path, "manifests")
+    if len(sequences) != 1:
+        failures.append("plan review evidence has no unambiguous run manifest")
+        return
+    path = report_path.parent.parent / "manifests" / (
+        f"run-manifest-implementation-planning-{next(iter(sequences))}.json"
+    )
+    try:
+        authority = validated_run_authority(path)
+        inputs = capture_review_inputs(
+            extract_plan_items(planning), planning, authority.payload, authority.project_root, rows,
+        )
+    except (ConvergenceContractError, PlanItemContractError) as exc:
+        failures.append(f"cannot validate plan review evidence: {exc}")
+        return
+    stale = [row["id"] for row in rows if _item_stage_scope_bucket(row, pbv) == "in-scope"
+             and row.get("verifiedReviewHash")
+             and row["verifiedReviewHash"] != review_fingerprint(row, inputs)]
+    if stale:
+        failures.append(f"plan review evidence changed for {stale}; prepare and re-verify those items")
+
+
 def _gate_summary_item(
     item: dict,
     pbv: dict,

package/runtime/python/okstra_ctl/phases/implementation_planning/profile.md

@@ -292,6 +292,7 @@ For a new `implementation-planning` run, the fixed order is initial verification
 
    An `AGREE` response records the considered counterexample and exclusion reason in its note; unverified external material is `verification-error`, not `DISAGREE`.
 2. Dispatch a single plan-body reverify round to every analyser worker in the run's roster. `Report writer worker` is NOT a participant in this round.
+   Read `planVerification` in the dispatch, await, or native result-link response. `status=completed` means the runtime has already applied the accepted results, checked the plan-body contract, and completed the round. Use its gate, advisories, and next dispatch and skip steps 3–4. `pending` waits for the remaining verifiers; `failed` stops for the returned defect; `needs-lead` retains the manual path, including self-fix cause-group recording. Enforcement: `phases/implementation_planning/round_completion.py` and automatic-round integration tests in `tests/run/test_plan_items.py`.
 3. Record each verifier Markdown result through `okstra plan-items apply-verdicts --state <plan-body-verification.json> --result <worker-id>=<result.md> --round <N>`. Python validates every submitted `P-*` identifier against the current convergence state and overwrites only that round's verdicts. Then resolve the gate result to one of `passed` / `passed-with-dissent` / `blocked-by-disagreement` / `aborted-non-result`.
 4. After `okstra plan-verify` succeeds, run `okstra plan-items complete-round --state <plan-body-verification.json> --run-manifest <current-run-manifest.json> --round <N>`. Python reads the current worker assignments, atomically appends the convergence-owned history, and updates its nested final projection. This state is the only plan-verification input report assembly reads.
 5. Record every *in-scope execution* `majority-disagree` decision through `okstra approval-decision`; record its plan and clarification links only on activities. Do not promote `observed` / `deferred` / `record` items, and do not append `clarificationItems[]` directly.