okstra 0.30.0 → 0.30.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okstra",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "Multi-agent cross-verification orchestrator runtime + Claude Code skills.",
   "license": "MIT",
   "author": "devonshin",

package/runtime/BUILD.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.30.0",
-  "builtAt": "2026-05-17T08:21:41.472Z",
+  "package": "0.30.1",
+  "builtAt": "2026-05-17T11:12:55.482Z",
   "repoRoot": "/home/runner/work/okstra/okstra"
 }

package/runtime/prompts/profiles/_common-contract.md

@@ -77,3 +77,12 @@ profile document.
 - Audit sidecar (shared — applies to every analysis-worker output and every final-report):
   - Reading Confirmation lines (one short line per input file confirming end-to-end reading) live in the **worker audit sidecar** at `runs/<task-type>/worker-results/<worker>-audit-<task-type>-<seq>.md`, NOT in the worker's main worker-results file. The worker-results body starts at section 1 (Findings). The validator fails worker-results files that contain a `## 0. Reading Confirmation` heading.
   - The audit sidecar carries any other meta the worker wants to log (tool-call counts, MCP query summaries, timing notes). The lead's final-report does NOT duplicate this content — it is consumed by the validator and by post-run audit tooling, not by end-user readers.
+
+- Markdown authoring (shared — applies to every markdown document produced by the lead or any worker, including final-reports, worker-results, briefs, and ad-hoc notes):
+  - every document must begin with an `Index` section.
+  - include only information necessary to fulfill the user's stated purpose and directly related requirements.
+  - follow only the sections, format, tone, and scope specified by the user, plus the required `Index` section.
+  - when writing task instructions or work orders, define the scope of work clearly and specifically, including deliverables, acceptance criteria, and verification steps when relevant.
+  - define scope positively by stating what work is included. Work outside the defined scope must not be performed.
+  - before adding any structure or content not explicitly specified, ask the user for confirmation, except for the required `Index` section.
+  - before completion, verify that the document exactly matches the requested scope and contains no unrelated material.

package/runtime/python/okstra_ctl/worktree.py

@@ -43,6 +43,7 @@ from typing import Optional
 
 from .ids import _safe_fs_segment
 from . import worktree_registry
+from .seeding import SettingsLinkError, ensure_project_settings_symlink
 
 
 # Project-root directories that hold okstra task state, ignored by git, or
@@ -361,6 +362,34 @@ def _link_sync_files(source_root: Path, worktree_path: Path) -> list[str]:
     return notes
 
 
+def _seed_worktree_settings_symlink(worktree_path: Path) -> None:
+    """Seed `.claude/settings.local.json` in the worker worktree so dispatched
+    Claude / codex / gemini sessions inherit the okstra read-only / write
+    allowlist. Mirrors the main-project seeding done in `run.py` — needed
+    because `_link_sync_dirs` skips `.claude/` whenever `git worktree add`
+    already materialised the directory (e.g. tracked `.claude/handoff-*.md`).
+    Failures degrade to stderr warning so worktree provisioning still
+    succeeds.
+    """
+    try:
+        link = ensure_project_settings_symlink(project_root=worktree_path)
+    except SettingsLinkError as exc:
+        print(
+            f"okstra-settings: failed to seed worker worktree symlink at "
+            f"{worktree_path / '.claude/settings.local.json'} — worker dispatch "
+            f"may be blocked by Claude Code permissions. ({exc})",
+            file=__import__("sys").stderr,
+        )
+        return
+    if link is None:
+        print(
+            "okstra-settings: ~/.okstra/templates/settings.local.json missing — "
+            "re-run 'npx okstra@latest install' (0.14.0+) to provision the "
+            "symlink target.",
+            file=__import__("sys").stderr,
+        )
+
+
 def _copy_snapshot_files(source_root: Path, worktree_path: Path) -> list[str]:
     """Copy fixture files from MAIN → task worktree as read-only snapshots
     (FU-V3).
@@ -485,6 +514,7 @@ def provision_task_worktree(
     existing = worktree_registry.lookup(safe_project, safe_group, safe_task)
     if existing is not None and existing.status == "active":
         worktree_registry.touch_phase(safe_project, safe_group, safe_task, task_type)
+        _seed_worktree_settings_symlink(Path(existing.worktree_path))
         return WorktreeProvision(
             status="reused",
             path=existing.worktree_path,
@@ -586,6 +616,8 @@ def provision_task_worktree(
         _git(main_root, "branch", "-D", branch)
         raise
 
+    _seed_worktree_settings_symlink(worktree_path)
+
     base_label = (
         f"{base_origin} @ {resolved_base_ref[:12]}"
         if base_origin != "HEAD"