okstra 0.76.0 → 0.78.0

package/runtime/prompts/profiles/implementation.md

@@ -32,14 +32,7 @@
 - Approval gate (phase-specific addendum to shared authority rule):
   - the pre-implementation gate's recorded user approval marker is the only authorised approval gate at this phase — proceed once it is satisfied without further external coordination.
 - Forbidden actions — universal (any occurrence → terminal status `contract-violated`):
-  - **`git push` of any kind**, including `--dry-run` against a real remote that produces side-effects
-  - publishing or release commands: `npm publish`, `cargo publish`, `pip publish`, `gh release`, `docker push`
-  - real database migrations or schema changes that touch shared environments
-  - production credentials, deploy commands, infra mutation against non-local clusters
-  - external API WRITE calls (POST/PUT/PATCH/DELETE) to third-party services other than localhost test fixtures
-  - dispatching parallel sub-agents beyond the required worker roster
-  - any Edit/Write before the pre-implementation gate has passed
-  - source edits or Bash mutations performed by any verifier role (verifier-specific deny-list lives in the verifier sidecar)
+{{PHASE_FORBIDDEN_ACTIONS}}
 - In-phase debugging:
   - isolate root cause before changing the fix direction, but the executor MUST NOT route to a separate `error-analysis` phase mid-run; if a defect blocks plan progress, the executor records findings and routes to a new run after this one ends.
 

package/runtime/prompts/profiles/improvement-discovery.md

@@ -20,6 +20,11 @@
   - per-candidate evidence (path:line) and scope mapping
   - per-candidate severity / effort / recommended-next-phase
   - convergence classification (full / partial / contested / worker-unique) across workers
+- Worker diversity rule:
+  - every analyser inspects every priority lens, but each starts with a different primary pass so the run does not rely on model randomness for diversity. Order lenses exactly as they appear in the brief; `claude` starts at lens 1, `codex` at lens 2, and `gemini` at lens 3, wrapping around when fewer lenses are present.
+  - before broadening to the remaining lenses, each worker must either produce at least one candidate from its primary pass or record a no-candidate rationale with the highest-signal path:line evidence it inspected.
+  - two workers' candidates are the same candidate only when they cite the same underlying design/code problem and the same remediation direction. Shared evidence paths alone are not enough to merge; keep distinct failure modes distinct.
+  - when a candidate from one worker overlaps another worker's evidence, convergence must verify whether it is duplicate, broader/narrower, or conflicting. Do not collapse contested candidates just to meet the candidate cap.
 - Phase 1.5 — Lead reflect-back grilling (runs after Phase 1 context loading and before Phase 4 worker dispatch):
   - Lead inspects scan-scope paths via `ls` / `Grep` / `Read` to map modules, entry points, dependencies, approximate LOC, and recent commit patterns.
   - Lead emits a single reflect-back message covering: (a) understood scope per path (one-line summary), (b) understood meaning of each priority lens in this scope, (c) understood out-of-scope rationale, (d) ordered list of N open questions.

package/runtime/prompts/profiles/release-handoff.md

@@ -20,9 +20,9 @@
   - the lead MUST confirm `git log --oneline <base>..HEAD` contains at least one implementation commit. If it is empty, the run MUST end with status `blocked` and route back to `implementation`.
 - User interaction protocol (Claude lead — performed in order, using `AskUserQuestion` or the equivalent interactive prompt):
   1. **Action selection** — present three choices and capture exactly one:
-     - `local only` — record the accepted, already-committed branch and end without push or PR.
+     - `local only` — complete the handoff as a local delivery record: record the accepted, already-committed branch and end without push or PR.
      - `push + PR` — push the feature branch, then open or reuse a pull request.
-     - `skip` — record the verified state and end the run without any git command.
+     - `skip` — cancel delivery actions for now: record that release-handoff was intentionally skipped and end the run without any git command.
      If the user picks `skip`, route directly to the final-report self-review pass.
   - **stage-group mode order**: G1 base branch first (same options as Q2 — the dependency-closure check needs `origin/<base>`), then G2 stage confirmation, then assemble, then Q2b/Q3 as usual with the collector branch as the PR head.
   1g. **G2 — stage confirmation**: the stage selection already happened before the run (wizard `handoff_stage_pick`, or the CLI `--stages` flag) and is fixed in `HANDOFF_STAGES`. Display it as a one-line confirmation (`PR 대상 stage: <csv> — 진행합니다`) and proceed; do NOT re-ask the multi-select. Only if `HANDOFF_MODE` is `stage-group` but `HANDOFF_STAGES` is empty (defensive, should not happen) run `okstra handoff eligible --plan-run-root <plan-run-root> --approved-plan <approved plan path>` and ask the user to pick from the eligible stages.
@@ -60,21 +60,7 @@
   - after `gh pr create` succeeds (or an existing PR is reused), the lead MUST run `okstra handoff record-pr --plan-run-root <...> --stages <csv> --branch <head branch> --url <pr url>` and quote the command + exit code in the final report. This applies to BOTH modes — whole-task runs record `--stages` as the full Stage Map list — so duplicate-PR prevention converges on one consumers record.
   - stage-group helpers: `okstra handoff eligible`, `okstra handoff assemble`, `okstra handoff record-pr`. The assemble step is the ONLY path that may create commits (merge commits on the collector branch) in this phase.
 - Forbidden actions (any occurrence → terminal status `contract-violated`):
-  - local commit commands of any kind (`git add`, `git commit`, `git restore --staged`, `git stash`), and any direct `git merge` / `git rebase` run by the lead. The single exception is the merge commits `okstra handoff assemble` itself creates on the collector branch — the lead never merges by hand.
-  - any of the following git push variants, regardless of intent or whether the user said "force it":
-    - `git push --force`
-    - `git push --force-with-lease`
-    - `git push -f`
-    - `git push +<refspec>`
-    - any other invocation that rewrites remote history
-  - pushing directly to a base branch — i.e. `git push origin <branch>` where `<branch>` is `main`, `master`, `prod`, `preprod`, `staging`, `dev`, or the branch the user chose as the PR base in this run. The only permitted push target is the current feature branch.
-  - bypassing repo safeguards: `--no-verify` / `-n` on `git push`, disabling safeguards via equivalent flags, or any hook bypass.
-  - release-publishing commands: `gh release create`, `gh release edit`, `npm publish`, `cargo publish`, `pip publish`, `twine upload`, `docker push`, `terraform apply`, `kubectl apply` against any non-local cluster.
-  - source-code edits, refactors, or any modification to files outside the run's own artifact directories (`reports/`, `prompts/`, `state/`, `manifests/`, `worker-results/`, `status/`, `sessions/`). The diff being shipped MUST be exactly what the prior `implementation` run produced; release-handoff packages it, it does not re-author it.
-  - executing any mutating command the user did NOT select. Examples: opening a PR when the user picked `local only`; pushing when the user picked `skip`; switching the PR base branch silently after the user already chose one.
-  - retrying a failed git / gh command with weaker safety flags. If `git push` fails with non-fast-forward, the lead MUST stop, explain the failure to the user, and ask for instructions — it MUST NOT add `--force`.
-  - `TeamCreate`, `Agent(...)` dispatch of any kind, or any other parallel sub-agent fan-out. This phase runs entirely under the Claude lead.
-  - silently treating an unrecognised user reply as one of the menu options. If the user's answer does not match a presented choice, re-ask the question verbatim.
+{{PHASE_FORBIDDEN_ACTIONS}}
 - Required deliverable shape (final report, in addition to the standard sections):
   - **Source Verification Report**: relative path of the originating `final-verification` final-report file plus the literal quoted `Verdict Token` row whose value is `accepted`.
   - **Feature Branch & Working-Tree State**: branch name from `git rev-parse --abbrev-ref HEAD`, output of `git status --short` at run start.

package/runtime/python/okstra_ctl/analysis_packet.py

@@ -27,12 +27,28 @@ PROFILE_SECTIONS = (
     "Clarification request policy",
 )
 PROFILE_SECTIONS_BY_TASK_TYPE = {
+    "requirements-discovery": (
+        "Fan-out",
+        "Decision-tree walk",
+    ),
+    "error-analysis": (
+        "Diagnosis loop",
+    ),
     "implementation-planning": (
         "Section heading contract",
         "Required deliverable shape",
         "No-placeholder rule",
         "Self-review pass before finalising the report",
     ),
+    "final-verification": (
+        "Required deliverable shape",
+        "Self-review pass before finalising the report",
+    ),
+    "improvement-discovery": (
+        "Phase 1.5 — Lead reflect-back grilling",
+        "Worker diversity rule",
+        "Decision-tree walk",
+    ),
 }
 CLARIFICATION_SECTIONS = (
     "Clarification Items",
@@ -261,6 +277,7 @@ def _top_level_bullet_heading(line: str) -> str:
     if not line.startswith("- ") or ":" not in line:
         return ""
     label = line[2:].split(":", 1)[0].strip().strip("*")
+    label = label.split(" (", 1)[0].strip()
     return label