okstra 0.86.0 → 0.87.0

package/runtime/prompts/profiles/_implementation-executor.md

@@ -11,19 +11,19 @@ until Phase 5 ends, then drop from active context for Phase 6/7.
 
 ## Executor role binding (carried over from the thin core)
 
-- **Executor dispatch labelling.** When Lead dispatches the Executor it MUST set the Agent `name` to `<provider>-executor` (e.g. `codex-executor`, `claude-executor`) — NOT the generic `<provider>-worker` — so the FleetView teammate pill names the job; see `prompts/lead/okstra-lead-contract.md` Phase 4 "Agent `name` on dispatch". For a `codex` / `gemini` Executor, Lead MUST additionally inject a `**Pane role:** executor` line into the dispatched prompt body so the CLI wrapper titles its tmux trace pane `<cli>-executor-<pid>` (the wrapper reads that line per `agents/workers/_cli-wrapper-template.md`). Token attribution is unaffected — the collector matches any `agentName` beginning `<provider>-`.
-- The `Executor` (bound in `implementation.md` thin core) is the **only worker permitted to use Edit / Write / state-mutating Bash commands** on project files. All other workers run read-only. When the executor provider is `codex` or `gemini`, the actual file mutation happens inside the executor CLI's own auto-edit mode (e.g. `codex exec --sandbox workspace-write`, gemini's equivalent) — not through Claude-side Edit/Write tools — but the safety rules in this sidecar still apply identically.
+- **Executor dispatch labelling.** When Lead dispatches the Executor it MUST set the Agent `name` to `<provider>-executor` (e.g. `codex-executor`, `claude-executor`) — NOT the generic `<provider>-worker` — so the FleetView teammate pill names the job; see `prompts/lead/okstra-lead-contract.md` Phase 4 "Agent `name` on dispatch". For a `codex` / `antigravity` Executor, Lead MUST additionally inject a `**Pane role:** executor` line into the dispatched prompt body so the CLI wrapper titles its tmux trace pane `<cli>-executor-<pid>` (the wrapper reads that line per `agents/workers/_cli-wrapper-template.md`). Token attribution is unaffected — the collector matches any `agentName` beginning `<provider>-`.
+- The `Executor` (bound in `implementation.md` thin core) is the **only worker permitted to use Edit / Write / state-mutating Bash commands** on project files. All other workers run read-only. When the executor provider is `codex` or `antigravity`, the actual file mutation happens inside the executor CLI's own auto-edit mode (e.g. `codex exec --sandbox workspace-write`, antigravity's equivalent) — not through Claude-side Edit/Write tools — but the safety rules in this sidecar still apply identically.
 - Worktree cwd handling — when the thin core's Task worktree block resolves status to `created` or `reused`, the Executor MUST run every Edit / Write / build / test / commit command with the worktree path as cwd. Treat it as `project_root` for the duration of this run. Do NOT mutate the caller's original checkout. Do NOT `cd` out of the worktree to reach files; if a file outside the worktree is needed, the dependency is a planning gap — record it in `Out-of-plan edits` and continue.
-  - **How to set cwd per Bash call**: the Claude Bash tool inherits its cwd from the lead session, which is NOT the worktree. To put cwd-sensitive toolchains (`cargo`, `npm`, `pnpm`, `bun`, `pytest`, `make`, `go`) into the worktree, prefix the command with `cd {{EXECUTOR_WORKTREE_PATH}} && ` inside the same Bash invocation — e.g. `cd {{EXECUTOR_WORKTREE_PATH}} && cargo test -p foo`. **Never wrap in `bash -lc "..."` or `bash -c "..."`** — the wrapper hides the leading `cd` token from Claude Code's permission auto-allow layer (causing prompts on every call) without any safety benefit. For tools that accept an explicit working-directory flag (`git -C <path>`, `cargo --manifest-path`, `pytest --rootdir`), prefer that form over the `cd && ` chain. Edit / Write / Read tool calls already use absolute paths and need no cwd handling. The codex / gemini executor CLI wrappers (`okstra-codex-exec.sh -C`, `okstra-gemini-exec.sh --include-directories`) already inject worktree cwd at the CLI layer, so this rule applies primarily to the Claude executor.
+  - **How to set cwd per Bash call**: the Claude Bash tool inherits its cwd from the lead session, which is NOT the worktree. To put cwd-sensitive toolchains (`cargo`, `npm`, `pnpm`, `bun`, `pytest`, `make`, `go`) into the worktree, prefix the command with `cd {{EXECUTOR_WORKTREE_PATH}} && ` inside the same Bash invocation — e.g. `cd {{EXECUTOR_WORKTREE_PATH}} && cargo test -p foo`. **Never wrap in `bash -lc "..."` or `bash -c "..."`** — the wrapper hides the leading `cd` token from Claude Code's permission auto-allow layer (causing prompts on every call) without any safety benefit. For tools that accept an explicit working-directory flag (`git -C <path>`, `cargo --manifest-path`, `pytest --rootdir`), prefer that form over the `cd && ` chain. Edit / Write / Read tool calls already use absolute paths and need no cwd handling. The codex / antigravity executor CLI wrappers (`okstra-codex-exec.sh -C`, `okstra-antigravity-exec.sh --include-directories`) already inject worktree cwd at the CLI layer, so this rule applies primarily to the Claude executor.
 - **Synced okstra state directory.** At provision time `okstra-ctl` may symlink `.project-docs/` from the repo's **main worktree** into the task worktree. This is NOT an independent copy — writes through it land in the main worktree. Inside this run the executor MUST confine okstra artifact writes to its own task scope (i.e. `.okstra/tasks/<this-task-id>/...`). Other synced directories, if present due to local configuration, are not implicit okstra context; read them only when the brief explicitly cites them as source material.
 
 ## Pre-implementation context exploration (executor before first edit)
 
 - **Coding-conventions preflight (BLOCKING — runs before the first `Edit` / `Write`, and binds the TDD loop below).** The gate body is a single source at `prompts/profiles/_coding-conventions-preflight.md` (sibling of this sidecar): resolved `Coding preflight pack:` runtime-resource path usage, project review rule packs, the always-binding language-agnostic principles, and graceful degradation. Do NOT re-type that content from memory — deliver it by file so it cannot drift or be dropped:
   - **Claude executor:** Read `_coding-conventions-preflight.md` end-to-end before the first `Edit` / `Write`, then state in ONE line which conventions apply (e.g. `Applying TS + hexagonal overlay; domain at src/domains/*/domain/`).
-  - **CLI executor (BLOCKING when the executor provider is `codex` or `gemini`):** the executor CLI process does NOT share the lead's context, and it cannot Read this sidecar's directory — that path sits outside the CLI sandbox and the CLI only sees its stdin prompt, so a file reference never reaches it. The lead MUST physically append the **body** of `_coding-conventions-preflight.md` into the persisted executor prompt at dispatch time: Read the file from the same absolute directory you read this sidecar from, then `Write`/`cat` its body into the persisted prompt. Never hand-retype it. Enforcement: the CLI wrapper agents refuse an implementation-Executor dispatch whose persisted prompt lacks the literal heading `Coding-conventions preflight`, returning `<SENTINEL_PREFIX>_PREFLIGHT_MISSING` (see `agents/workers/_cli-wrapper-template.md` → Prompt Composition).
-- **Stage discipline transcription (when a preceding stage is `done`):** the lead MUST transcribe the `Stage discipline` rule (from this run's rendered profile — the INCLUDEd `_stage-discipline.md` body) verbatim into the dispatched CLI executor prompt, so a codex/gemini executor honors the prior-stage behavior-freeze. Declaration-level — no wrapper sentinel.
-- **Non-interactive auto-execution (BLOCKING when the executor provider is `codex` or `gemini`).** A CLI executor runs head-less (`codex exec` / gemini equivalent) — there is no human at the keyboard. Skills loaded during the run (tdd, coding-preflight, and others) contain "get user approval", "state your plan to the user and wait", or "ask before proceeding" gates written for interactive sessions; in this run those gates are **already satisfied** by the upstream `implementation-planning` approval (the plan this stage executes was human-approved). The executor MUST NOT stop to request approval, MUST NOT end its turn after only producing a plan, and MUST carry the stage through end-to-end — RED → GREEN → refactor → per-step commits → `### Stage Carry Evidence`. The ONLY skill step to skip is the interactive user-approval prompt itself; every other skill rule (TDD discipline, conventions, real-IO isolation) still binds. The lead MUST transcribe this bullet verbatim into the dispatched CLI executor prompt (same reason as the preflight transcription rule above — the CLI process does not share lead context). Stopping early for approval in a head-less run is the observed empty-exit failure (exit 0, no diff): treat it as `contract-violated`.
+  - **CLI executor (BLOCKING when the executor provider is `codex` or `antigravity`):** the executor CLI process does NOT share the lead's context, and it cannot Read this sidecar's directory — that path sits outside the CLI sandbox and the CLI only sees its stdin prompt, so a file reference never reaches it. The lead MUST physically append the **body** of `_coding-conventions-preflight.md` into the persisted executor prompt at dispatch time: Read the file from the same absolute directory you read this sidecar from, then `Write`/`cat` its body into the persisted prompt. Never hand-retype it. Enforcement: the CLI wrapper agents refuse an implementation-Executor dispatch whose persisted prompt lacks the literal heading `Coding-conventions preflight`, returning `<SENTINEL_PREFIX>_PREFLIGHT_MISSING` (see `agents/workers/_cli-wrapper-template.md` → Prompt Composition).
+- **Stage discipline transcription (when a preceding stage is `done`):** the lead MUST transcribe the `Stage discipline` rule (from this run's rendered profile — the INCLUDEd `_stage-discipline.md` body) verbatim into the dispatched CLI executor prompt, so a codex/antigravity executor honors the prior-stage behavior-freeze. Declaration-level — no wrapper sentinel.
+- **Non-interactive auto-execution (BLOCKING when the executor provider is `codex` or `antigravity`).** A CLI executor runs head-less (`codex exec` / antigravity equivalent) — there is no human at the keyboard. Skills loaded during the run (tdd, coding-preflight, and others) contain "get user approval", "state your plan to the user and wait", or "ask before proceeding" gates written for interactive sessions; in this run those gates are **already satisfied** by the upstream `implementation-planning` approval (the plan this stage executes was human-approved). The executor MUST NOT stop to request approval, MUST NOT end its turn after only producing a plan, and MUST carry the stage through end-to-end — RED → GREEN → refactor → per-step commits → `### Stage Carry Evidence`. The ONLY skill step to skip is the interactive user-approval prompt itself; every other skill rule (TDD discipline, conventions, real-IO isolation) still binds. The lead MUST transcribe this bullet verbatim into the dispatched CLI executor prompt (same reason as the preflight transcription rule above — the CLI process does not share lead context). Stopping early for approval in a head-less run is the observed empty-exit failure (exit 0, no diff): treat it as `contract-violated`.
 - **Mandatory TDD loop**: BEFORE the first `Edit` or `Write` call, the executor MUST apply a red-green-refactor loop for every code change in this run. This is required; skipping it is a `contract-violated` outcome. This governs HOW each step is executed (failing test first → minimal implementation → refactor); it does not override the approved plan's WHAT/file scope.
   - Order of operations per plan step: (1) write/extend the test that captures the step's acceptance criterion and confirm it fails for the right reason, (2) commit the failing test (`test(<scope>): ...`), (3) implement the minimum change to make it pass, (4) commit the implementation (`feat|fix(<scope>): ...`), (5) refactor without changing behaviour and commit separately if any cleanup is made (`refactor(<scope>): ...`). The failing-then-passing transition between steps (2) and (4) is the `TDD evidence` required by the final report.
   - Doc-only / config-only / pure-rename steps that have no observable runtime behaviour are exempt from the failing-test requirement, but the executor MUST cite the exemption per step in the final report (`TDD exemption: <reason>`).

package/runtime/prompts/profiles/_implementation-verifier.md

@@ -9,10 +9,10 @@ at Phase 5, BEFORE constructing the verifier worker dispatch prompts.
 
 ## Verifier roles (resolved at run-prep time)
 
-- **Verifier dispatch labelling.** When Lead dispatches a verifier (here, and identically in `final-verification`) it MUST set the Agent `name` to `<provider>-verifier` (e.g. `claude-verifier`, `codex-verifier`) — NOT the generic `<provider>-worker` — so the FleetView teammate pill names the job; see `prompts/lead/okstra-lead-contract.md` Phase 4 "Agent `name` on dispatch". For a `codex` / `gemini` verifier, Lead MUST additionally inject a `**Pane role:** verifier` line into the dispatched prompt body so the CLI wrapper titles its tmux trace pane `<cli>-verifier-<pid>` (the wrapper reads that line per `agents/workers/_cli-wrapper-template.md`). Token attribution is unaffected — the collector matches any `agentName` beginning `<provider>-`.
-- The verifier slots are `Claude verifier` and `Codex verifier`, plus `Gemini verifier` **only when `gemini` is in the resolved `--workers` roster**. Every verifier in the resolved roster is dispatched regardless of which provider holds the executor role; the executor's own provider is run *separately* as a verifier (a fresh CLI session with no shared context) so that no verdict is produced from the same session that wrote the diff. Verifiers MUST NOT call Edit, Write, or any Bash command that mutates files outside the run's artifact directories. If a verifier wants a fix, it records the recommendation in its worker result; it does not apply the fix itself.
+- **Verifier dispatch labelling.** When Lead dispatches a verifier (here, and identically in `final-verification`) it MUST set the Agent `name` to `<provider>-verifier` (e.g. `claude-verifier`, `codex-verifier`) — NOT the generic `<provider>-worker` — so the FleetView teammate pill names the job; see `prompts/lead/okstra-lead-contract.md` Phase 4 "Agent `name` on dispatch". For a `codex` / `antigravity` verifier, Lead MUST additionally inject a `**Pane role:** verifier` line into the dispatched prompt body so the CLI wrapper titles its tmux trace pane `<cli>-verifier-<pid>` (the wrapper reads that line per `agents/workers/_cli-wrapper-template.md`). Token attribution is unaffected — the collector matches any `agentName` beginning `<provider>-`.
+- The verifier slots are `Claude verifier` and `Codex verifier`, plus `Antigravity verifier` **only when `antigravity` is in the resolved `--workers` roster**. Every verifier in the resolved roster is dispatched regardless of which provider holds the executor role; the executor's own provider is run *separately* as a verifier (a fresh CLI session with no shared context) so that no verdict is produced from the same session that wrote the diff. Verifiers MUST NOT call Edit, Write, or any Bash command that mutates files outside the run's artifact directories. If a verifier wants a fix, it records the recommendation in its worker result; it does not apply the fix itself.
 - Session isolation — not model-variant divergence — is the primary self-review safeguard: each verifier is a separate CLI invocation with its own context window, so reusing the same model variant for executor and same-provider verifier is acceptable. Different model variants (e.g. executor=opus / Claude verifier=sonnet) remain recommended when available.
-- Phase-specific model defaults override the shared defaults: `Claude verifier`=`opus`, `Codex verifier`=`gpt-5.5`, `Gemini verifier`=`auto` (only when present in the roster). The `Executor`'s model is taken from the provider-specific worker model corresponding to `--executor`: claude→`--claude-model` (default `opus`), codex→`--codex-model` (default `gpt-5.5`), gemini→`--gemini-model` (default `auto`).
+- Phase-specific model defaults override the shared defaults: `Claude verifier`=`opus`, `Codex verifier`=`gpt-5.5`, `Antigravity verifier`=`auto` (only when present in the roster). The `Executor`'s model is taken from the provider-specific worker model corresponding to `--executor`: claude→`--claude-model` (default `opus`), codex→`--codex-model` (default `gpt-5.5`), antigravity→`--antigravity-model` (default `auto`).
 - Verifiers read from the SAME working tree path the Executor used so they observe the exact diff the Executor produced. Verifiers remain strictly read-only there.
 
 ## Verifier QA duties (independent re-run mandate)
@@ -114,7 +114,7 @@ A mocked unit test cannot observe the SQL a query builder actually emits — `co
 
 ## All-verifier-failure policy
 
-If every verifier present in the resolved roster (`Claude verifier`, `Codex verifier`, and `Gemini verifier` when opted in) ends with a non-result terminal status (`timeout`, `error`, `not-run`) — i.e. zero independent verdicts were produced — the run MUST end with status `blocked` and route to a follow-up `error-analysis` run. `Claude lead` MUST NOT substitute its own verdict in place of the missing verifier outputs; synthesis requires at least one independent verifier's verdict. If one or more verifiers fail but at least one returns a verdict, the run proceeds with the surviving verdict(s) and the final report MUST explicitly notate which verifiers were unavailable, with the captured error / timeout evidence per failed verifier.
+If every verifier present in the resolved roster (`Claude verifier`, `Codex verifier`, and `Antigravity verifier` when opted in) ends with a non-result terminal status (`timeout`, `error`, `not-run`) — i.e. zero independent verdicts were produced — the run MUST end with status `blocked` and route to a follow-up `error-analysis` run. `Claude lead` MUST NOT substitute its own verdict in place of the missing verifier outputs; synthesis requires at least one independent verifier's verdict. If one or more verifiers fail but at least one returns a verdict, the run proceeds with the surviving verdict(s) and the final report MUST explicitly notate which verifiers were unavailable, with the captured error / timeout evidence per failed verifier.
 
 ## Verifier-specific forbidden actions (any occurrence → terminal status `contract-violated`)
 

package/runtime/prompts/profiles/_stage-discipline.md

@@ -2,7 +2,7 @@
 Shared stage-discipline rule. INCLUDEd by implementation-planning.md (binds the
 planner) and implementation.md (binds the lead). The implementation executor
 sidecar instructs the lead to transcribe this rule into a CLI executor prompt,
-since codex/gemini executors do not share lead context.
+since codex/antigravity executors do not share lead context.
 
 Do NOT write the literal include directive token in this file's body — the
 resolver matches it anywhere and would recurse on this file itself.

package/runtime/prompts/profiles/error-analysis.md

@@ -6,7 +6,7 @@
   - codex
   - report-writer
 - Optional workers (opt-in via `--workers`):
-  - gemini — when added to the roster it joins the analyser set; omitted by default
+  - antigravity — when added to the roster it joins the analyser set; omitted by default
 {{INCLUDE:_common-contract.md}}
 - Brief consumption (phase-specific addendum — shared rules live in `_common-contract.md` under "Brief handoff contract"):
   - Apply the shared reporter-confirmation precondition exactly as written. In this phase, unresolved `intent-check:` / `conversion-block:` rows use `Blocks=next-phase`; any unconfirmed inference may be used as a labelled hypothesis only.

package/runtime/prompts/profiles/final-verification.md

@@ -6,7 +6,7 @@
   - codex
   - report-writer
 - Optional workers (opt-in via `--workers`):
-  - gemini — when added to the roster it joins the analyser set; omitted by default
+  - antigravity — when added to the roster it joins the analyser set; omitted by default
 {{INCLUDE:_common-contract.md}}
 - Primary focus areas (each maps to a deliverable section below):
   - Acceptance-gating — a failure here pushes the verdict toward `blocked` / `conditional-accept`:

package/runtime/prompts/profiles/forbidden-actions.json

@@ -35,11 +35,11 @@
     "real database migrations, schema changes against shared environments, or writes to non-local datastores",
     "production credentials, deploy commands, infra mutation (`terraform apply`, `kubectl apply` against non-local cluster, etc.)",
     "external API write calls (POST/PUT/PATCH/DELETE) to third-party services other than localhost test fixtures",
-    "source edits or Bash mutations performed by any verifier role (`Gemini verifier`, `Codex verifier`, `Claude verifier` are read-only — recommend, do not apply)",
+    "source edits or Bash mutations performed by any verifier role (`Antigravity verifier`, `Codex verifier`, `Claude verifier` are read-only — recommend, do not apply)",
     "dispatching parallel sub-agents beyond the required worker roster",
     "silent scope expansion: every file edited outside the approved plan list MUST appear in the `Out-of-plan edits` block with rationale",
     "leaving placeholders such as TBD / TODO / \"implement later\" / \"handle edge cases\" in newly-added lines of this run (check via `git diff <base>..HEAD | grep -E '^\\+[^+].*\\b(TBD|TODO|FIXME|XXX|implement later|handle edge cases|similar to|placeholder)\\b'`; pre-existing strings in untouched regions are out of scope)",
-    "lead substituting its own verdict when every required verifier (`Gemini verifier`, `Codex verifier`, `Claude verifier`) returned a non-result terminal status (`timeout`/`error`/`not-run`); in that case the run MUST end as `blocked` with routing recommendation back to `error-analysis`, never with a lead-only verdict",
+    "lead substituting its own verdict when every required verifier (`Antigravity verifier`, `Codex verifier`, `Claude verifier`) returned a non-result terminal status (`timeout`/`error`/`not-run`); in that case the run MUST end as `blocked` with routing recommendation back to `error-analysis`, never with a lead-only verdict",
     "claiming rollback verification on a schema migration, config-format change, or any persisted-state mutation without a recorded dry-run of the rollback step and its captured exit code",
     "declaring overall task acceptance — that is `final-verification` ownership; this phase reports only \"ready for final-verification\" or \"needs new planning loop\"",
     "delegating the self-review pass to a generic subagent — `Claude lead` must run it"

package/runtime/prompts/profiles/implementation-planning.md

@@ -6,7 +6,7 @@
   - codex
   - report-writer
 - Optional workers (opt-in via `--workers`):
-  - gemini — when added to the roster it joins the analyser set; omitted by default
+  - antigravity — when added to the roster it joins the analyser set; omitted by default
 {{INCLUDE:_common-contract.md}}
 {{INCLUDE:_stage-discipline.md}}
 - Brief consumption (phase-specific addendum — shared rules live in `_common-contract.md` under "Brief handoff contract"):

package/runtime/prompts/profiles/implementation.md

@@ -7,13 +7,13 @@
   - codex
   - report-writer
 - Optional workers (opt-in via `--workers`):
-  - gemini — when added to the roster it joins the verifier set; when omitted only the Claude+Codex verifiers participate (`--executor gemini` is therefore not selectable without explicitly listing `gemini` in `--workers`)
+  - antigravity — when added to the roster it joins the verifier set; when omitted only the Claude+Codex verifiers participate (`--executor antigravity` is therefore not selectable without explicitly listing `antigravity` in `--workers`)
 - **Executor binding (resolved at run-prep time, fixed for this run):**
   - Executor display name: `{{EXECUTOR_DISPLAY_NAME}}`
-  - Executor provider: `{{EXECUTOR_PROVIDER}}` (one of: `claude` | `codex` | `gemini`; chosen via `--executor` or `OKSTRA_DEFAULT_EXECUTOR`, default `claude`)
+  - Executor provider: `{{EXECUTOR_PROVIDER}}` (one of: `claude` | `codex` | `antigravity`; chosen via `--executor` or `OKSTRA_DEFAULT_EXECUTOR`, default `claude`)
   - Executor subagent for dispatch: `{{EXECUTOR_WORKER_AGENT}}`
   - Executor model: `{{EXECUTOR_MODEL_DISPLAY}}` (launch value: `{{EXECUTOR_MODEL_EXECUTION_VALUE}}`)
-  - Wherever this profile mentions the `Executor`, it refers to the role bound above. The other two providers in the roster (`claude` / `codex` / `gemini` minus the executor) are dispatched as **verifiers only** for this run and remain strictly read-only.
+  - Wherever this profile mentions the `Executor`, it refers to the role bound above. The other two providers in the roster (`claude` / `codex` / `antigravity` minus the executor) are dispatched as **verifiers only** for this run and remain strictly read-only.
 {{INCLUDE:_common-contract.md}}
 {{INCLUDE:_stage-discipline.md}}
 - Pre-implementation gate (mandatory — refuse to start if any item fails):

package/runtime/prompts/profiles/improvement-discovery.md

@@ -4,7 +4,7 @@
 - Required workers:
   - claude
   - codex
-  - gemini
+  - antigravity
   - report-writer
 - Optional workers (opt-in via `--workers`):
   - none — every required worker stays required because lens diversity is the load-bearing value of this phase
@@ -21,7 +21,7 @@
   - per-candidate severity / effort / recommended-next-phase
   - convergence classification (full / partial / contested / worker-unique) across workers
 - Worker diversity rule:
-  - every analyser inspects every priority lens, but each starts with a different primary pass so the run does not rely on model randomness for diversity. Order lenses exactly as they appear in the brief; `claude` starts at lens 1, `codex` at lens 2, and `gemini` at lens 3, wrapping around when fewer lenses are present.
+  - every analyser inspects every priority lens, but each starts with a different primary pass so the run does not rely on model randomness for diversity. Order lenses exactly as they appear in the brief; `claude` starts at lens 1, `codex` at lens 2, and `antigravity` at lens 3, wrapping around when fewer lenses are present.
   - before broadening to the remaining lenses, each worker must either produce at least one candidate from its primary pass or record a no-candidate rationale with the highest-signal path:line evidence it inspected.
   - two workers' candidates are the same candidate only when they cite the same underlying design/code problem and the same remediation direction. Shared evidence paths alone are not enough to merge; keep distinct failure modes distinct.
   - when a candidate from one worker overlaps another worker's evidence, convergence must verify whether it is duplicate, broader/narrower, or conflicting. Do not collapse contested candidates just to meet the candidate cap.
@@ -34,7 +34,7 @@
 - Decision-tree walk (bounded):
   - When candidates branch on a structural question (e.g. "is module X meant to own this responsibility?"), resolve via `Read` / `Grep` first. Only escalate to the user inside the Phase 1.5 budget.
 - Expected output emphasis:
-  - the `## 5.9 Improvement Candidates` table populated with rows that obey the 10-column schema from `validators/validate-improvement-report.py` (Cand ID `I-NNN`, Lens from whitelist, Title, Scope ⊆ scan-scope, Severity, Effort, Consensus, Source workers `<worker>:<id>` from {claude, codex, gemini}, Recommended next-phase ∈ {requirements-discovery, implementation-planning, error-analysis}, Evidence as path:line list)
+  - the `## 5.9 Improvement Candidates` table populated with rows that obey the 10-column schema from `validators/validate-improvement-report.py` (Cand ID `I-NNN`, Lens from whitelist, Title, Scope ⊆ scan-scope, Severity, Effort, Consensus, Source workers `<worker>:<id>` from {claude, codex, antigravity}, Recommended next-phase ∈ {requirements-discovery, implementation-planning, error-analysis}, Evidence as path:line list)
   - `Consensus` cells in `## 5.9 Improvement Candidates` use the table enum exactly: `full`, `partial`, `contested`, `worker-unique`. Map convergence's `full-consensus` / `partial-consensus` labels to `full` / `partial` before writing the table.
   - `## 7. Final Verdict` Verdict Token ∈ {`candidates-ready`, `no-candidates`, `blocked`}; Direction `routing`; Next Step "사용자에게 후보 K개 선택 의뢰 (## 5.9 표 참조)"
   - `## 3. Recommended Next Steps` first entry summarises per-candidate routing and proposes new task-key names of the form `<task-group>/imp-<Cand-ID>`

package/runtime/prompts/profiles/requirements-discovery.md

@@ -6,7 +6,7 @@
   - codex
   - report-writer
 - Optional workers (opt-in via `--workers`):
-  - gemini — when added to the roster it joins the analyser set; omitted by default
+  - antigravity — when added to the roster it joins the analyser set; omitted by default
 {{INCLUDE:_common-contract.md}}
 - Brief consumption (phase-specific addendum — shared rules live in `_common-contract.md` under "Brief handoff contract"):
   - Apply the shared reporter-confirmation precondition exactly as written. In this phase, unresolved `intent-check:` / `conversion-block:` rows use `Blocks=next-phase`.

package/runtime/prompts/wizard/prompts.ko.json

@@ -290,7 +290,7 @@
       }
     },
     "clarification_pick": {
-      "label": "clarification-response 파일 경로가 있나요? (follow-up 시에만)",
+      "label": "clarification-response 를 넘길까요? (follow-up 시에만 — final-report 선택 시 user-responses/ 폴더의 답변도 함께 첨부됩니다)",
       "echo_template": "clarification(pick): {value}",
       "options": {
         "__skip__": "없음 (건너뛰기)",
@@ -299,6 +299,10 @@
       "labels": {
         "latest_report": "최근 final-report 사용: {snippet}"
       },
+      "sidecar_note": {
+        "attached": " + user-responses 답변 {count}개 함께 첨부",
+        "empty": " (user-responses 폴더 비어 있음 — final-report 만 첨부)"
+      },
       "echo_suffixes": {
         "skip": "clarification: (none)",
         "latest_report": "clarification: {value} (재사용)"
@@ -354,7 +358,7 @@
       }
     },
     "defaults_or_custom": {
-      "label": "역할별 모델·실행 옵션 단계입니다 (참여 워커 구성을 바꾸는 게 아닙니다).\n이번 run 의 워커: {workers}\n· 기본값으로 진행 — 모든 역할을 추천 모델로 둡니다. 추천 기본값: lead·report-writer=opus, claude=opus, codex=gpt-5.5, gemini=auto (실제 값은 runtime 기본값으로 해소). directive·관련 task 없이 바로 진행.\n· 커스터마이즈 — 역할별 모델을 직접 고르고, 추가 directive·관련 task 도 지정합니다.",
+      "label": "역할별 모델·실행 옵션 단계입니다 (참여 워커 구성을 바꾸는 게 아닙니다).\n이번 run 의 워커: {workers}\n· 기본값으로 진행 — 모든 역할을 추천 모델로 둡니다. 추천 기본값: lead·report-writer=opus, claude=opus, codex=gpt-5.5, antigravity=auto (실제 값은 runtime 기본값으로 해소). directive·관련 task 없이 바로 진행.\n· 커스터마이즈 — 역할별 모델을 직접 고르고, 추가 directive·관련 task 도 지정합니다.",
       "echo_template": "customize: {value}",
       "options": {
         "defaults": "기본값으로 진행 (역할별 추천 모델 그대로)",
@@ -387,9 +391,9 @@
       "label": "codex 워커 모델?",
       "echo_template": "codex-model: {value}"
     },
-    "gemini_model": {
-      "label": "gemini 워커 모델?",
-      "echo_template": "gemini-model: {value}"
+    "antigravity_model": {
+      "label": "antigravity 워커 모델?",
+      "echo_template": "antigravity-model: {value}"
     },
     "report_writer_model": {
       "label": "리포트 작성자(report-writer) 모델?",

package/runtime/python/okstra_ctl/__init__.py

@@ -52,6 +52,7 @@ from .reconcile import (
     normalize_central_status,
     normalize_reconciled_report_status,
     reconcile_active,
+    reconcile_recent,
 )
 from .listing import (
     _parse_since,
@@ -115,6 +116,7 @@ __all__ = [
     "read_run_context",
     "read_run_inputs",
     "reconcile_active",
+    "reconcile_recent",
     "record_start",
     "remove_jsonl_row",
     "remove_reservation",

package/runtime/python/okstra_ctl/analysis_packet.py

@@ -69,7 +69,7 @@ def build_analysis_packet(
     instruction_set_relative_path: str,
     fix_history_text: str = "",
 ) -> str:
-    """Return the primary compact input for Claude/Codex/Gemini analysers."""
+    """Return the primary compact input for Claude/Codex/Antigravity analysers."""
     brief_text = task_brief_path.read_text(encoding="utf-8")
     profile_text = analysis_profile_path.read_text(encoding="utf-8")
     reference_text = _read_optional(reference_expectations_path)

package/runtime/python/okstra_ctl/clarification_items.py

@@ -285,21 +285,31 @@ def section_1_present_but_unparsed(report_text: str) -> bool:
     return bool(_LOOSE_SECTION_1_RE.search(report_text))
 
 
-def clarification_response_with_sidecars(source: Path) -> str:
-    """clarification-response 원문 뒤에 `user-responses/` 사이드카를 덧붙인 본문.
+def user_response_sidecars(source: Path) -> list[Path]:
+    """``source`` 형제 ``user-responses/`` 의 ``user-response-*.md`` 목록(이름 순).
 
     ``source`` 가 ``runs/<task-type>/reports/final-report-*.md`` 레이아웃일 때만
     형제 ``user-responses/`` 디렉토리를 찾는다(HTML 뷰의 `Export user response`
-    가 내려준 파일을 사용자가 거기 저장). 그 외 경로·사이드카 부재 시 원문 그대로 —
-    호출자는 항상 이 함수를 거쳐 instruction-set 사본을 쓰면 된다.
+    가 내려준 파일을 사용자가 거기 저장). 그 외 경로·디렉토리 부재 시 빈 목록.
+    carry-in 첨부 본문(``clarification_response_with_sidecars``)과 위저드 안내
+    문구의 사이드카 카운트가 같은 한 곳을 보도록 하는 단일 참조점이다.
     """
-    text = source.read_text(encoding="utf-8")
     responses_dir = source.parent.parent / "user-responses"
     if source.parent.name != "reports" or not responses_dir.is_dir():
-        return text
-    sidecars = sorted(
+        return []
+    return sorted(
         p for p in responses_dir.glob("user-response-*.md") if p.is_file()
     )
+
+
+def clarification_response_with_sidecars(source: Path) -> str:
+    """clarification-response 원문 뒤에 `user-responses/` 사이드카를 덧붙인 본문.
+
+    사이드카 부재 시 원문 그대로 — 호출자는 항상 이 함수를 거쳐 instruction-set
+    사본을 쓰면 된다.
+    """
+    text = source.read_text(encoding="utf-8")
+    sidecars = user_response_sidecars(source)
     if not sidecars:
         return text
     parts = [text.rstrip("\n"), "\n\n---\n\n# Attached User Responses\n"]

package/runtime/python/okstra_ctl/codex_dispatch.py

@@ -26,7 +26,7 @@ from .worker_prompt_headers import WorkerPromptHeaderError, worker_prompt_header
 
 SUPPORTED_CLI_WORKERS = {
     "codex": "okstra-codex-exec.sh",
-    "gemini": "okstra-gemini-exec.sh",
+    "antigravity": "okstra-antigravity-exec.sh",
 }
 BACKEND_CLI_WRAPPER = "cli-wrapper"
 BACKEND_MIXED = "mixed"
@@ -35,7 +35,7 @@ REPORT_WRITER_WORKER_ID = "report-writer"
 REPORT_LANGUAGE_VALUES = {"en", "ko", "auto"}
 ANALYSIS_WORKER_LABELS = {
     "codex": "Codex worker",
-    "gemini": "Gemini worker",
+    "antigravity": "Antigravity worker",
 }
 
 

package/runtime/python/okstra_ctl/context_cost.py

@@ -13,7 +13,7 @@ import sys
 from pathlib import Path
 from typing import Iterable
 
-from okstra_project import ResolverError, find_task_root, resolve_project_root
+from okstra_ctl.task_target import resolve_task_root, project_rel
 
 
 INPUT_FILES = (
@@ -38,7 +38,7 @@ HOT_PATH_LEAD_RESOURCES = (
 WORKER_AGENT_FILES = (
     "claude-worker.md",
     "codex-worker.md",
-    "gemini-worker.md",
+    "antigravity-worker.md",
     "report-writer-worker.md",
 )
 TIMESTAMPED_ARTIFACT_RE = re.compile(r"\d{4}-\d{2}-\d{2}[_T]\d{2}-\d{2}-\d{2}")
@@ -89,40 +89,6 @@ def _load_json(path: Path) -> dict:
     return data if isinstance(data, dict) else {}
 
 
-def _resolve_task_root(target: str, project_root: str, cwd: str) -> tuple[Path, Path]:
-    target_path = Path(target).expanduser()
-    if target_path.exists():
-        task_root = target_path.resolve()
-        return task_root, _infer_project_root(task_root)
-
-    try:
-        resolved_project = Path(
-            resolve_project_root(explicit_root=project_root, cwd=cwd)
-        ).resolve()
-    except ResolverError as exc:
-        raise SystemExit(f"project root resolution failed: {exc}") from exc
-
-    task_root = find_task_root(resolved_project, target)
-    if task_root is None:
-        raise SystemExit(f"no task root for task key: {target}")
-    return task_root.resolve(), resolved_project
-
-
-def _infer_project_root(task_root: Path) -> Path:
-    parts = task_root.parts
-    if ".okstra" not in parts:
-        return task_root
-    idx = parts.index(".okstra")
-    return Path(*parts[:idx]).resolve()
-
-
-def _project_rel(path: Path, project_root: Path) -> str:
-    try:
-        return str(path.resolve().relative_to(project_root.resolve()))
-    except ValueError:
-        return str(path)
-
-
 def _find_current_run_dir(
     task_root: Path, manifest: dict, project_root: Path
 ) -> Path | None:
@@ -166,7 +132,7 @@ def _instruction_set_metric(task_root: Path, project_root: Path) -> dict:
     packet = instruction_set / "analysis-packet.md"
     legacy_packet = instruction_set / "task-packet.md"
     return {
-        "path": _project_rel(instruction_set, project_root),
+        "path": project_rel(instruction_set, project_root),
         "fileCount": file_count,
         "bytes": byte_count,
         "estimatedTokens": _estimate_tokens(files),
@@ -263,7 +229,7 @@ def _lead_phase1_metric(
         "fileCount": file_count,
         "bytes": byte_count,
         "estimatedTokens": _estimate_tokens(files),
-        "files": [_project_rel(path, project_root) for path in files if path.is_file()],
+        "files": [project_rel(path, project_root) for path in files if path.is_file()],
     }
 
 
@@ -300,9 +266,9 @@ def _analysis_worker_metric(task_root: Path, project_root: Path) -> dict:
         "legacyFullContractFileCount": full_file_count,
         "estimatedPacketModeBytesPerWorker": packet_byte_count,
         "estimatedReductionPercent": reduction_percent,
-        "files": [_project_rel(path, project_root) for path in current_files if path.is_file()],
+        "files": [project_rel(path, project_root) for path in current_files if path.is_file()],
         "legacyFullContractFiles": [
-            _project_rel(path, project_root)
+            project_rel(path, project_root)
             for path in full_contract_files
             if path.is_file()
         ],
@@ -360,7 +326,7 @@ def _report_writer_metric(run_dir: Path | None, task_root: Path, project_root: P
         "fileCount": file_count,
         "bytes": byte_count,
         "estimatedTokens": _estimate_tokens(files),
-        "files": [_project_rel(path, project_root) for path in files if path.is_file()],
+        "files": [project_rel(path, project_root) for path in files if path.is_file()],
     }
 
 
@@ -377,11 +343,11 @@ def analyze_task_bundle(task_root: Path, project_root: Path) -> dict:
 
     return {
         "ok": True,
-        "taskRoot": _project_rel(task_root, project_root),
+        "taskRoot": project_rel(task_root, project_root),
         "projectRoot": str(project_root),
         "taskKey": manifest.get("taskKey", ""),
         "taskType": manifest.get("taskType", ""),
-        "currentRunPath": _project_rel(run_dir, project_root) if run_dir else "",
+        "currentRunPath": project_rel(run_dir, project_root) if run_dir else "",
         "totals": {
             "taskFileCount": task_file_count,
             "taskBytes": task_bytes,
@@ -406,7 +372,7 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--cwd", default=".", help="cwd for project root resolution")
     args = parser.parse_args(argv)
 
-    task_root, project_root = _resolve_task_root(args.target, args.project_root, args.cwd)
+    task_root, project_root = resolve_task_root(args.target, args.project_root, args.cwd)
     result = analyze_task_bundle(task_root, project_root)
     print(json.dumps(result, ensure_ascii=False, indent=2))
     return 0

package/runtime/python/okstra_ctl/doctor.py

@@ -155,7 +155,7 @@ def _release_handoff_checks(project_root: Path) -> list[DoctorCheck]:
 def _improvement_discovery_checks(workspace: Path, home: Path) -> list[DoctorCheck]:
     return [
         _worker_agents_check(home, workspace, "improvement-discovery"),
-        _file_check("gemini worker agent", _agent_path(home, "gemini")),
+        _file_check("antigravity worker agent", _agent_path(home, "antigravity")),
         _lens_whitelist_check(),
     ]