elanous 0.2.0 → 0.2.5

package/scripts/eval-bot-vs-grok.ts

@@ -0,0 +1,79 @@
+// 봇 UX «그록봇 수준» 판별 — 같은 질문 묶음을 elanous chat(글자) · elanous agent(도구) · xAI Grok 에 던지고 원문·시간을 남긴다.
+// 사용: bun scripts/eval-bot-vs-grok.ts <outDir> <repoCwd> · Grok 모델 = 사다리 `budget` 칸(tierModel)   (키 값은 출력하지 않는다)
+import { spawnSync } from 'node:child_process';
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { tierModel } from '../src/llm/model-defaults.js';
+
+const [,, outDir, repoCwd] = process.argv;
+mkdirSync(outDir, { recursive: true });
+
+type Q = { id: string; axis: string; text: string; session?: string; needsTools?: boolean };
+const QUESTIONS: Q[] = [
+  { id: 'q01', axis: 'smalltalk', text: '안녕, 오늘 뭐 도와줄 수 있어? 세 줄 안으로.' },
+  { id: 'q02', axis: 'smalltalk', text: '요즘 좀 지쳤어. 짧게 한마디 해줘.' },
+  { id: 'q03', axis: 'fact', text: '서울에서 부산까지 KTX 로 대략 몇 시간 걸려? 한 줄로.' },
+  { id: 'q04', axis: 'fact', text: 'HWPX 파일 형식이 뭐야? 두 줄로.' },
+  { id: 'q05', axis: 'context', session: 'ctx', text: '내 프로젝트 이름은 elanous 야. 기억해 둬. «알겠다» 한 마디만.' },
+  { id: 'q06', axis: 'context', session: 'ctx', text: '우리 팀은 네 세션으로 나뉘어 있어: OP, MK, TC, UX. 이것도 기억해. 한 마디만.' },
+  { id: 'q07', axis: 'context', session: 'ctx', text: '내 프로젝트 이름이랑 팀 세션 약자 넷을 한 줄로 말해 봐.' },
+  { id: 'q08', axis: 'tools', needsTools: true, text: '지금 작업 폴더(git 저장소)에서 가장 최근 커밋 제목 세 개를 알려줘.' },
+  { id: 'q09', axis: 'tools', needsTools: true, text: 'apps/pwa 폴더에 파일이 대략 몇 개야? 숫자 하나로.' },
+  { id: 'q10', axis: 'tools', needsTools: true, text: '오늘 날짜를 한국 시간으로 알려줘.' },
+  { id: 'q11', axis: 'recovery', needsTools: true, text: 'docs/NOPE-does-not-exist-xyz.md 파일을 요약해줘.' },
+  { id: 'q12', axis: 'recovery', text: '내가 어제 너한테 부탁한 일 결과 알려줘.' },
+];
+
+type Row = { id: string; axis: string; target: string; ms: number; ok: boolean; reply: string; meta?: Record<string, unknown> };
+const rows: Row[] = [];
+
+function runElanous(mode: 'chat' | 'agent', q: Q, session?: string): Row {
+  const args = [mode, '--json', ...(session ? ['--session', session] : ['--new']), q.text];
+  const t0 = Date.now();
+  const r = spawnSync('elanous', args, { cwd: repoCwd, encoding: 'utf8', timeout: 240_000, maxBuffer: 64 << 20 });
+  const ms = Date.now() - t0;
+  const line = (r.stdout ?? '').trim().split('\n').reverse().find((l) => l.startsWith('{')) ?? '';
+  let parsed: Record<string, unknown> = {};
+  try { parsed = JSON.parse(line); } catch { /* keep empty */ }
+  const reply = typeof parsed.reply === 'string' ? parsed.reply : ((r.stderr ?? '').slice(-400) || '(no reply)');
+  return { id: q.id, axis: q.axis, target: `elanous-${mode}`, ms, ok: r.status === 0 && typeof parsed.reply === 'string', reply, meta: { sessionId: parsed.sessionId, provider: parsed.provider, model: parsed.model, status: r.status } };
+}
+
+function xaiKey(): string {
+  const env = readFileSync(join(process.env.HOME!, '.claude/skills/omni-crawl/.env'), 'utf8');
+  return /^XAI_API_KEY=(.*)$/m.exec(env)?.[1]?.trim().replace(/^['"]|['"]$/g, '') ?? '';
+}
+const grokHistory = new Map<string, Array<{ role: string; content: string }>>();
+async function runGrok(q: Q): Promise<Row> {
+  if (q.needsTools) return { id: q.id, axis: q.axis, target: 'grok', ms: 0, ok: false, reply: 'n/a — 작업 폴더·도구 없음(대조 제외)' };
+  const history = q.session ? (grokHistory.get(q.session) ?? []) : [];
+  const messages = [...history, { role: 'user', content: q.text }];
+  const t0 = Date.now();
+  const res = await fetch('https://api.x.ai/v1/chat/completions', {
+    method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${xaiKey()}` },
+    body: JSON.stringify({ model: tierModel('budget', 'grok'), messages }),
+  });
+  const ms = Date.now() - t0;
+  const body = await res.json().catch(() => ({})) as { choices?: Array<{ message?: { content?: string } }> };
+  const reply = body.choices?.[0]?.message?.content ?? `(http ${res.status})`;
+  if (q.session) grokHistory.set(q.session, [...messages, { role: 'assistant', content: reply }]);
+  return { id: q.id, axis: q.axis, target: 'grok', ms, ok: res.ok, reply };
+}
+
+for (const mode of ['chat', 'agent'] as const) {
+  const sessions = new Map<string, string>();
+  for (const q of QUESTIONS) {
+    const row = runElanous(mode, q, q.session ? sessions.get(q.session) : undefined);
+    if (q.session && !sessions.has(q.session) && typeof row.meta?.sessionId === 'string') sessions.set(q.session, row.meta.sessionId as string);
+    rows.push(row);
+    console.log(`${mode} ${q.id} ${row.ok ? 'ok' : 'FAIL'} ${(row.ms / 1000).toFixed(1)}s`);
+    writeFileSync(join(outDir, 'rows.json'), JSON.stringify(rows, null, 2));
+  }
+}
+for (const q of QUESTIONS) {
+  const row = await runGrok(q);
+  rows.push(row);
+  console.log(`grok ${q.id} ${row.ok ? 'ok' : 'skip/FAIL'} ${(row.ms / 1000).toFixed(1)}s`);
+}
+writeFileSync(join(outDir, 'rows.json'), JSON.stringify(rows, null, 2));
+console.log('done', rows.length);

package/scripts/eval-grok-live-baseline.ts

@@ -0,0 +1,36 @@
+// 대조군 v2 — xAI Responses API · 추론 모델(저장소 GROK_SEARCH_MODEL) · web_search ⊕ x_search 켬. 그록봇 «제품» 은 아니다.
+// 사용: bun eval-grok-live.ts <repo-checkout> <outDir>   (키 값은 출력하지 않는다)
+import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const [,, repo, outDir] = process.argv;
+mkdirSync(outDir, { recursive: true });
+const { grokAgentSearch, GROK_SEARCH_MODEL } = await import(join(repo, 'src/grok/agent-search.js'));
+const env = readFileSync(join(process.env.HOME!, '.claude/skills/omni-crawl/.env'), 'utf8');
+const apiKey = /^XAI_API_KEY=(.*)$/m.exec(env)?.[1]?.trim().replace(/^['"]|['"]$/g, '') ?? '';
+
+type Q = { id: string; text: string; session?: string };
+const QS: Q[] = [
+  { id: 'q01', text: '안녕, 오늘 뭐 도와줄 수 있어? 세 줄 안으로.' },
+  { id: 'q02', text: '요즘 좀 지쳤어. 짧게 한마디 해줘.' },
+  { id: 'q03', text: '서울에서 부산까지 KTX 로 대략 몇 시간 걸려? 한 줄로.' },
+  { id: 'q04', text: 'HWPX 파일 형식이 뭐야? 두 줄로.' },
+  { id: 'q05', session: 'ctx', text: '내 프로젝트 이름은 elanous 야. 기억해 둬. «알겠다» 한 마디만.' },
+  { id: 'q06', session: 'ctx', text: '우리 팀은 네 세션으로 나뉘어 있어: OP, MK, TC, UX. 이것도 기억해. 한 마디만.' },
+  { id: 'q07', session: 'ctx', text: '내 프로젝트 이름이랑 팀 세션 약자 넷을 한 줄로 말해 봐.' },
+  { id: 'q10', text: '오늘 날짜를 한국 시간으로 알려줘.' },
+  { id: 'q12', text: '내가 어제 너한테 부탁한 일 결과 알려줘.' },
+];
+const history: string[] = [];
+const rows: unknown[] = [];
+for (const q of QS) {
+  const systemPrompt = q.session && history.length ? `이전 대화:\n${history.join('\n')}` : undefined;
+  const t0 = Date.now();
+  const r = await grokAgentSearch(q.text, { apiKey, tools: ['web_search', 'x_search'], ...(systemPrompt ? { systemPrompt } : {}), timeoutMs: 90_000 });
+  const ms = Date.now() - t0;
+  if (q.session) history.push(`사용자: ${q.text}`, `어시스턴트: ${r.text}`);
+  rows.push({ id: q.id, target: 'grok-live', model: GROK_SEARCH_MODEL, ms, ok: r.ok, reply: r.text, citations: (r.citations ?? []).length, error: r.error });
+  console.log(`grok-live ${q.id} ${r.ok ? 'ok' : 'FAIL'} ${(ms / 1000).toFixed(1)}s cites=${(r.citations ?? []).length}`);
+}
+writeFileSync(join(outDir, 'grok-live.rows.json'), JSON.stringify(rows, null, 2));
+console.log('done', rows.length);

package/scripts/fixtures/front-route-corpus.sample.json

@@ -0,0 +1,17 @@
+{
+  "description": "손으로 쓴 개인정보 없는 앞 분류기 예시 — 규칙 미판정 문장",
+  "items": [
+    { "id": "absorb-1", "text": "이 기술 발표에서 핵심 논점이 뭔지 알고 싶어.", "expected": "absorb" },
+    { "id": "absorb-2", "text": "긴 글의 주요 주장만 파악하고 싶어.", "expected": "absorb" },
+    { "id": "absorb-3", "text": "이 자료는 어떤 배경에서 나왔는지 살펴봐.", "expected": "absorb" },
+    { "id": "tasks-1", "text": "문서 제목 확인하고 표 오타 검토한 다음 회의실 예약도 챙겨야 해.", "expected": "tasks" },
+    { "id": "tasks-2", "text": "청구서 확인, 일정 변경, 메일 답장 각각 챙기자.", "expected": "tasks" },
+    { "id": "tasks-3", "text": "오늘은 재고 파악하고 전등 교체 일정도 따로 잡아야겠어.", "expected": "tasks" },
+    { "id": "graph-1", "text": "이 입력부터 결과까지 이어지는 처리 과정을 자동화하고 싶어.", "expected": "graph" },
+    { "id": "graph-2", "text": "데이터가 들어오면 검사 후 분류해서 다음 단계로 넘기는 흐름이 필요해.", "expected": "graph" },
+    { "id": "graph-3", "text": "요청 접수부터 승인과 배포까지 한 흐름으로 묶자.", "expected": "graph" },
+    { "id": "ask-human-1", "text": "이거 어떻게 할까?", "expected": "ask-human" },
+    { "id": "ask-human-2", "text": "지금은 어느 방향이 좋을지 모르겠어.", "expected": "ask-human" },
+    { "id": "ask-human-3", "text": "그건 상황을 보고 결정하자.", "expected": "ask-human" }
+  ]
+}

package/scripts/fleet/node-setup.sh

@@ -56,16 +56,60 @@ elif [ $CHECK = 1 ]; then todo "k3d 설치"
 else R 'brew install k3d >/tmp/fleet-k3d.log 2>&1' && ok "k3d (설치)" || bad "k3d 설치 실패"; fi
 # 6. 클러스터 elanous-pool — API 를 0.0.0.0:<포트> 로 · 인증서 SAN = 호스트 이름 ⊕ tailnet 이름
 TSNAME="$(R '(tailscale status --self --json 2>/dev/null || /Applications/Tailscale.app/Contents/MacOS/Tailscale status --self --json 2>/dev/null) | python3 -c "import json,sys;print(json.load(sys.stdin)[\"Self\"][\"DNSName\"].rstrip(\".\"))"' 2>/dev/null)"
+# 5b. 노드 로컬 레지스트리 — 델타 판올림(대표 2026-09-26): 원격 빌드가 여기로 push 하면 «없는 층만» 올라가고
+#     Pod 는 커밋 태그로 pull 한다(종전 `k3d image import` 는 4GB 전체를 클러스터 저장소로 매번 복사했다).
+REGISTRY="${ELANOUS_FLEET_REGISTRY:-elanous-registry}"; REG_PORT="${ELANOUS_FLEET_REGISTRY_PORT:-5050}"
+# ⛔ 레지스트리는 노드의 «루프백»에만 연다 — 🩸 2026-09-26: `0.0.0.0:5050` 이라 tailnet 의 누구든 인증 없이 목록·푸시가 됐다
+#   (Pod 는 커밋 태그로 pull 하므로 그 태그를 덮으면 곧 공급망 위험). 노드 안 빌드는 localhost 로 푸시하고, 클러스터는 docker 내부 이름으로 받는다.
+REG_BIND="$(R "docker port k3d-$REGISTRY 5000/tcp" 2>/dev/null | head -1)"
+if [ -n "$REG_BIND" ] && [ "${REG_BIND#127.0.0.1:}" != "$REG_BIND" ]; then ok "레지스트리 k3d-$REGISTRY :$REG_PORT (루프백)"
+elif [ -n "$REG_BIND" ] && [ $CHECK = 1 ]; then bad "레지스트리 k3d-$REGISTRY 가 $REG_BIND 에 열려 있다 — 루프백으로 다시 만들어야 한다"
+elif [ -n "$REG_BIND" ]; then R "k3d registry delete $REGISTRY >/dev/null 2>&1; k3d registry create $REGISTRY --port 127.0.0.1:$REG_PORT >/tmp/fleet-registry.log 2>&1 && (docker network connect k3d-$CLUSTER k3d-$REGISTRY 2>/dev/null || true)" && ok "레지스트리 k3d-$REGISTRY 를 루프백으로 다시 만들었다(이미지는 다음 동기화에서 다시 푸시)" || { bad "레지스트리 재생성 실패 — 원격 /tmp/fleet-registry.log"; exit 1; }
+elif [ $CHECK = 1 ]; then todo "레지스트리 k3d-$REGISTRY :$REG_PORT 생성(루프백)"
+else R "k3d registry create $REGISTRY --port 127.0.0.1:$REG_PORT >/tmp/fleet-registry.log 2>&1" && ok "레지스트리 k3d-$REGISTRY :$REG_PORT (생성 · 루프백)" || { bad "레지스트리 생성 실패 — 원격 /tmp/fleet-registry.log"; exit 1; }
+# ⛔ 레지스트리는 클러스터 네트워크에도 붙어 있어야 Pod 가 `k3d-<레지스트리>` 이름을 푼다 — 🩸 2026-09-26: 루프백으로 다시 만든 레지스트리가
+#   `bridge` 에만 붙어 kubelet 이 `lookup k3d-elanous-registry: no such host` → Pod `ImagePullBackOff`(🅕 첫 Pod 사용에서 발견). 멱등.
+[ $CHECK = 1 ] || R "docker network inspect k3d-$CLUSTER >/dev/null 2>&1 && (docker network connect k3d-$CLUSTER k3d-$REGISTRY 2>/dev/null || true)" >/dev/null 2>&1
+fi
+# 🪞 호스트 git 미러(대표 09-29) — Pod 는 GitHub 대신 이 미러에서 clone 한다(`ELANOUS_POD_HOST_MIRROR` · #21929).
+#   bare 미러 = 원격 ~/mirror/elanous-agent.git(없으면 만든다 · 갱신은 이 맥의 크론이 push). 클러스터 노드에 읽기 전용으로 붙인다.
+MIRROR_DIR='$HOME/mirror'; MIRROR_MOUNT=/mirror-host
+if R "test -d ~/mirror/elanous-agent.git"; then ok "호스트 git 미러 ~/mirror/elanous-agent.git"
+elif [ $CHECK = 1 ]; then todo "호스트 git 미러 ~/mirror/elanous-agent.git 생성(git init --bare) ⊕ 이 맥에서 첫 push"
+else R "mkdir -p ~/mirror && git init -q --bare ~/mirror/elanous-agent.git" && ok "호스트 git 미러 (생성 · 첫 push 는 이 맥 크론)" || { bad "미러 생성 실패"; exit 1; }; fi
+# 클러스터가 그 레지스트리를 쓰나 ⊕ 미러가 붙어 있나 — 둘 중 하나라도 아니면(옛 클러스터) 돌고 있는 Job 이 없을 때만 다시 만든다.
+#   ⛔ k3d 는 볼륨을 «클러스터 생성 때만» 붙인다 — 붙이려면 다시 만들 수밖에 없다.
+REG_WIRED=0; R "docker exec k3d-$CLUSTER-server-0 cat /etc/rancher/k3s/registries.yaml 2>/dev/null | grep -q k3d-$REGISTRY" && REG_WIRED=1
+MIRROR_WIRED=0; R "docker exec k3d-$CLUSTER-server-0 test -d $MIRROR_MOUNT/elanous-agent.git" && MIRROR_WIRED=1
+[ $MIRROR_WIRED = 1 ] || { [ $REG_WIRED = 1 ] && REG_WIRED=0 && MIRROR_ONLY=1; }
+if R "k3d cluster list $CLUSTER" >/dev/null 2>&1 && [ $REG_WIRED = 0 ]; then
+  # «실행 중»만 센다 — 실패로 끝난 Job 은 Complete 가 아니어도 도는 것이 아니다(09-29: `grep -vc Complete` 는 Failed 까지 세서 영원히 0 이 안 됐다).
+  RUNNING="$(R "KUBECONFIG=\$(k3d kubeconfig write $CLUSTER) kubectl get jobs -A -o jsonpath='{range .items[*]}{.status.active}{\"\\n\"}{end}' 2>/dev/null | awk '\$1>0' | wc -l | tr -d ' '" 2>/dev/null | tail -1)"; RUNNING="${RUNNING:-0}"
+  if [ $CHECK = 1 ]; then todo "클러스터 $CLUSTER 가 $([ "${MIRROR_ONLY:-0}" = 1 ] && echo "미러($MIRROR_MOUNT)를 안 붙였다" || echo "레지스트리를 안 쓴다") — 다시 만든다(도는 Job ${RUNNING:-?}개)"
+  elif [ "${RUNNING:-0}" != "0" ]; then bad "클러스터 $CLUSTER 를 다시 만들어야 하는데 도는 Job 이 ${RUNNING}개 — 끝난 뒤 다시"; exit 1
+  else R "k3d cluster delete $CLUSTER >/dev/null 2>&1" && ok "클러스터 $CLUSTER (레지스트리 연결 위해 지움)"; fi
+fi
 if R "k3d cluster list $CLUSTER" >/dev/null 2>&1; then ok "클러스터 $CLUSTER"
-elif [ $CHECK = 1 ]; then todo "클러스터 $CLUSTER 생성($K3S_IMAGE · API :$API_PORT · SAN $HOST ${TSNAME:-})"
+elif [ $CHECK = 1 ]; then todo "클러스터 $CLUSTER 생성($K3S_IMAGE · API :$API_PORT · SAN $HOST ${TSNAME:-} · 레지스트리 k3d-$REGISTRY:$REG_PORT)"
 else
   SAN="--k3s-arg --tls-san=$HOST@server:0"; [ -n "$TSNAME" ] && SAN="$SAN --k3s-arg --tls-san=$TSNAME@server:0"
-  R "k3d cluster create $CLUSTER --image $K3S_IMAGE --no-lb --api-port 0.0.0.0:$API_PORT $SAN --wait --timeout 300s >/tmp/fleet-k3d-create.log 2>&1" && ok "클러스터 $CLUSTER (생성)" || { bad "클러스터 생성 실패 — 원격 /tmp/fleet-k3d-create.log"; exit 1; }
+  R "k3d cluster create $CLUSTER --image $K3S_IMAGE --no-lb --api-port 0.0.0.0:$API_PORT $SAN --registry-use k3d-$REGISTRY:$REG_PORT --volume $MIRROR_DIR:$MIRROR_MOUNT:ro@server:0 --wait --timeout 300s >/tmp/fleet-k3d-create.log 2>&1" && ok "클러스터 $CLUSTER (생성 · 레지스트리 k3d-$REGISTRY)" || { bad "클러스터 생성 실패 — 원격 /tmp/fleet-k3d-create.log"; exit 1; }
 fi
 # 7. 이 맥 kubeconfig 에 컨텍스트 pool-<호스트>
-if kubectl config get-contexts -o name 2>/dev/null | grep -qx "$CTX"; then ok "kubeconfig 컨텍스트 $CTX"
-elif [ $CHECK = 1 ]; then todo "kubeconfig 에 $CTX 추가"
+# ⛔ «있다»로 끝내지 않는다 — 클러스터를 다시 만들면 인증서가 바뀌어 옛 컨텍스트가 x509 로 죽는다(2026-09-26 node-b:
+#   monad-pool → elanous-pool 재생성 뒤 «✓ 컨텍스트» 라 말하고 모든 kubectl 이 실패했다). 붙는지까지 잰다.
+CTX_STATE=absent
+if kubectl config get-contexts -o name 2>/dev/null | grep -qx "$CTX"; then
+  if kubectl --context "$CTX" version --request-timeout=8s >/dev/null 2>&1; then CTX_STATE=ok; else CTX_STATE=stale; fi
+fi
+if [ $CTX_STATE = ok ]; then ok "kubeconfig 컨텍스트 $CTX"
+elif [ $CHECK = 1 ]; then todo "kubeconfig 에 $CTX $([ $CTX_STATE = stale ] && echo '갱신(붙지 않는다 — 인증서가 바뀌었다)' || echo '추가')"
 else
+  if [ $CTX_STATE = stale ]; then
+    # 병합은 «앞 파일이 이긴다» — 옛 항목을 먼저 지워야 새 인증서가 들어간다.
+    cp ~/.kube/config ~/.kube/config.bak-fleet-"$HOST"-stale-"$(date +%Y%m%d%H%M%S)"
+    kubectl config delete-context "$CTX" >/dev/null 2>&1; kubectl config delete-cluster "$CTX" >/dev/null 2>&1; kubectl config delete-user "admin@$CTX" >/dev/null 2>&1
+  fi
   TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
   R "k3d kubeconfig get $CLUSTER" > "$TMP/kc.yaml" || { bad "kubeconfig 못 받음"; exit 1; }
   python3 - "$TMP/kc.yaml" "$HOST" "$API_PORT" <<'PY'
@@ -80,9 +124,38 @@ PY
   KUBECONFIG=~/.kube/config:"$TMP/kc.yaml" kubectl config view --flatten > "$TMP/merged.yaml" && chmod 600 "$TMP/merged.yaml" && mv "$TMP/merged.yaml" ~/.kube/config && ok "kubeconfig 컨텍스트 $CTX (추가 · 현재 컨텍스트는 그대로)" || bad "kubeconfig 병합 실패"
 fi
 # 8. 네임스페이스 ⊕ 격리 정책
-if kubectl --context "$CTX" --request-timeout=10s get ns elanous-test >/dev/null 2>&1; then ok "elanous-test 네임스페이스"
-elif [ $CHECK = 1 ]; then todo "base.yaml ⊕ policy-internet.yaml 적용"
-else kubectl --context "$CTX" apply -f "$ROOT/docker/h1/base.yaml" -f "$ROOT/docker/h1/policy-internet.yaml" >/dev/null && ok "elanous-test 네임스페이스 ⊕ 정책 (적용)" || bad "적용 실패"; fi
+apply_base() {
+  if [ "$CHECK" = 1 ]; then
+    if ! kubectl --context "$CTX" --request-timeout=10s get ns elanous-test >/dev/null 2>&1; then
+      todo "base.yaml ⊕ policy-internet.yaml 적용"
+    elif kubectl --context "$CTX" diff -f "$ROOT/docker/h1/base.yaml" -f "$ROOT/docker/h1/policy-internet.yaml" >/dev/null 2>&1; then
+      ok "elanous-test 네임스페이스 ⊕ 정책"
+    else
+      local diff_status=$?
+      if [ "$diff_status" = 1 ]; then todo "base.yaml ⊕ policy-internet.yaml 적용"
+      else todo "base.yaml ⊕ policy-internet.yaml 적용 (못 쟀다)"; fi
+    fi
+    return
+  fi
+
+  local attempts=0 output retries
+  while [ "$attempts" -lt 6 ]; do
+    attempts=$((attempts+1))
+    if output=$(kubectl --context "$CTX" apply -f "$ROOT/docker/h1/base.yaml" -f "$ROOT/docker/h1/policy-internet.yaml" 2>&1); then
+      retries=$((attempts-1))
+      if [ "$retries" -eq 0 ]; then ok "elanous-test 네임스페이스 ⊕ 정책 (적용)"
+      else ok "elanous-test 네임스페이스 ⊕ 정책 (적용 · 재시도 $retries)"; fi
+      return
+    fi
+    if [[ "$output" != *'serviceaccount "default" not found'* ]] || [ "$attempts" -eq 6 ]; then
+      [ -z "$output" ] || printf '%s\n' "$output" >&2
+      bad "적용 실패 (재시도 $((attempts-1)))"
+      return
+    fi
+    sleep "${FLEET_APPLY_RETRY_SLEEP:-5}"
+  done
+}
+apply_base
 # 9. 판 대조 — k3s · 노드 준비
 v="$(kubectl --context "$CTX" --request-timeout=10s get nodes -o jsonpath='{.items[0].status.nodeInfo.kubeletVersion}' 2>/dev/null)"
 want="${K3S_IMAGE##*:}"; want="${want/-k3s/+k3s}"

package/scripts/heal/run-role.ts

@@ -0,0 +1,328 @@
+#!/usr/bin/env bun
+/** 힐 판 역할 하나 — ELANOUS_GRAPH_CONTEXT 를 읽고 마지막 줄에 {outcome, …} JSON 을 낸다. */
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import {
+  fillMissingGateFacts,
+  markDeletedUnverified,
+  mergeHealSignatures,
+  triageFailure,
+  type HealCitation,
+  type HealFailureSignature,
+  type HealTriageHistory,
+  type PathExists,
+} from '../../src/self-implement/heal-triage.js';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../../src/self-implement/run-ledger.js';
+
+interface GraphContext {
+  graphId?: string;
+  runId?: string;
+  nodeId?: string;
+  input?: unknown;
+  outputs?: Record<string, unknown>;
+}
+
+function readContext(): GraphContext {
+  const path = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!path) return {};
+  try {
+    return JSON.parse(readFileSync(path, 'utf8')) as GraphContext;
+  } catch {
+    return {};
+  }
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+
+function citationsOf(value: unknown): HealCitation[] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((item) => {
+    const record = asRecord(item);
+    return typeof record?.title === 'string' && typeof record.url === 'string' && record.url.trim()
+      && typeof record.snippet === 'string'
+      ? [{ title: record.title, url: record.url, snippet: record.snippet }]
+      : [];
+  });
+}
+
+function failureOf(ctx: GraphContext): HealFailureSignature {
+  const input = asRecord(ctx.input);
+  const raw = asRecord(input?.failure) ?? input ?? {};
+  const unverified = Array.isArray(raw.unverified) ? raw.unverified.filter((item): item is string => typeof item === 'string') : [];
+  const citations = citationsOf(raw.citations);
+  return {
+    ...(typeof raw.failedTests === 'number' ? { failedTests: raw.failedTests } : {}),
+    ...(typeof raw.introduced === 'number' ? { introduced: raw.introduced } : {}),
+    ...(typeof raw.unknown === 'number' ? { unknown: raw.unknown } : {}),
+    ...(typeof raw.timedOut === 'number' ? { timedOut: raw.timedOut } : {}),
+    ...(unverified.length ? { unverified } : {}),
+    ...(typeof raw.importerUnrunTests === 'number' ? { importerUnrunTests: raw.importerUnrunTests } : {}),
+    ...(typeof raw.environmentClaim === 'string' ? { environmentClaim: raw.environmentClaim } : {}),
+    ...(typeof raw.namedSource === 'string' ? { namedSource: raw.namedSource } : {}),
+    ...(typeof raw.errorText === 'string' ? { errorText: raw.errorText } : {}),
+    ...(citations.length ? { citations } : {}),
+  };
+}
+
+function historyOf(ctx: GraphContext): HealTriageHistory {
+  return { visited: Object.keys(ctx.outputs ?? {}) };
+}
+
+function accountCount(failure: Record<string, unknown>): number | undefined {
+  const evidence = asRecord(failure.environmentEvidence);
+  const count = evidence?.accountCount ?? failure.accountCount;
+  return typeof count === 'number' ? count : undefined;
+}
+
+function exitCode(failure: Record<string, unknown>): number | undefined {
+  const evidence = asRecord(failure.environmentEvidence);
+  const code = evidence?.exitCode ?? failure.exitCode;
+  return typeof code === 'number' ? code : undefined;
+}
+
+function credentialMissing(failure: Record<string, unknown>): boolean {
+  const evidence = asRecord(failure.environmentEvidence);
+  return evidence?.credentialFile === 'missing' || failure.credentialFile === 'missing';
+}
+
+function accountsFullOrExpired(failure: Record<string, unknown>): boolean {
+  const evidence = asRecord(failure.environmentEvidence);
+  return evidence?.accounts === 'full' || evidence?.accounts === 'expired'
+    || failure.accounts === 'full' || failure.accounts === 'expired';
+}
+
+export interface HealRoleDeps {
+  exists?: (path: string) => PathExists;
+  loadLedger?: (runId: string) => RunLedgerEntry[] | null;
+  ledgerDir?: string;
+  search?: (query: string) => unknown;
+}
+
+function gitHeadExists(worktree: string, path: string): PathExists {
+  const repo = spawnSync('git', ['-C', worktree, 'rev-parse', '--is-inside-work-tree'], { encoding: 'utf8' });
+  if (repo.error || repo.status !== 0) return 'unknown';
+  const child = spawnSync('git', ['-C', worktree, 'cat-file', '-e', `HEAD:${path}`], { encoding: 'utf8' });
+  if (child.error || child.status === null) return 'unknown';
+  return child.status === 0;
+}
+
+function defaultExists(worktree: string): (path: string) => PathExists {
+  return (path) => gitHeadExists(worktree, path);
+}
+
+function signatureFromUnknown(value: unknown): HealFailureSignature | undefined {
+  const raw = asRecord(value);
+  if (!raw) return undefined;
+  const unverified = Array.isArray(raw.unverified) ? raw.unverified.filter((item): item is string => typeof item === 'string') : undefined;
+  const citations = citationsOf(raw.citations);
+  const signature: HealFailureSignature = {
+    ...(typeof raw.failedTests === 'number' ? { failedTests: raw.failedTests } : {}),
+    ...(typeof raw.introduced === 'number' ? { introduced: raw.introduced } : {}),
+    ...(typeof raw.unknown === 'number' ? { unknown: raw.unknown } : {}),
+    ...(typeof raw.timedOut === 'number' ? { timedOut: raw.timedOut } : {}),
+    ...(unverified ? { unverified } : {}),
+    ...(typeof raw.importerUnrunTests === 'number' ? { importerUnrunTests: raw.importerUnrunTests } : {}),
+    ...(typeof raw.environmentClaim === 'string' ? { environmentClaim: raw.environmentClaim } : {}),
+    ...(typeof raw.namedSource === 'string' ? { namedSource: raw.namedSource } : {}),
+    ...(typeof raw.errorText === 'string' ? { errorText: raw.errorText } : {}),
+    ...(citations.length ? { citations } : {}),
+  };
+  return Object.keys(signature).length ? signature : undefined;
+}
+
+function outputRecord(outputs: Record<string, unknown> | undefined, nodeId: string): Record<string, unknown> | undefined {
+  const raw = outputs?.[nodeId];
+  if (typeof raw === 'string') {
+    const line = raw.split('\n').map((row) => row.trim()).filter(Boolean).at(-1);
+    return line?.startsWith('{') ? asRecord(JSON.parse(line) as unknown) : undefined;
+  }
+  return asRecord(raw);
+}
+
+function collectSignature(outputs: Record<string, unknown> | undefined): HealFailureSignature | undefined {
+  const record = outputRecord(outputs, 'collect');
+  const entries = Array.isArray(record?.entries) ? record.entries : [];
+  return signatureFromUnknown(entries[0]);
+}
+
+function deeperSignature(outputs: Record<string, unknown> | undefined): HealFailureSignature | undefined {
+  const record = outputRecord(outputs, 'observe-deeper');
+  return signatureFromUnknown(record?.signature);
+}
+
+function externalSignature(outputs: Record<string, unknown> | undefined): HealFailureSignature | undefined {
+  const record = outputRecord(outputs, 'ground-external');
+  return record?.outcome === 'ok' ? signatureFromUnknown(record) : undefined;
+}
+
+function withAddedFacts(result: Record<string, unknown>, addedFacts: readonly string[]): Record<string, unknown> {
+  return { ...result, addedFacts: [...addedFacts] };
+}
+
+function mergedContextSignature(signature: HealFailureSignature, outputs: GraphContext['outputs']) {
+  const collect = collectSignature(outputs);
+  const deeper = deeperSignature(outputs);
+  const external = externalSignature(outputs);
+  return mergeHealSignatures(signature, [
+    ...(collect ? [{ source: 'collect', signature: collect }] : []),
+    ...(deeper ? [{ source: 'observe-deeper', signature: deeper }] : []),
+    ...(external ? [{ source: 'ground-external', signature: external }] : []),
+  ]);
+}
+
+function firstJsonObject(text: string): string | undefined {
+  const start = text.search(/\S/);
+  if (start < 0 || text[start] !== '{') return undefined;
+  let depth = 0;
+  let quoted = false;
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const char = text[i];
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{') depth++;
+    else if (char === '}' && --depth === 0) return text.slice(start, i + 1);
+  }
+  return undefined;
+}
+
+function defaultSearch(query: string): unknown {
+  const script = join(homedir(), '.claude/skills/omni-crawl/scripts/main.ts');
+  const child = spawnSync('npx', ['tsx', script, query, '--engine', 'fc-dev', '--json'], {
+    encoding: 'utf8', timeout: 60_000, maxBuffer: 8 * 1024 * 1024,
+  });
+  if (child.error || child.status !== 0) return [];
+  const begin = '---BEGIN_OMNI_CRAWL_JSON---';
+  const end = '---END_OMNI_CRAWL_JSON---';
+  const start = child.stdout.indexOf(begin);
+  if (start < 0) return [];
+  const finish = child.stdout.indexOf(end, start + begin.length);
+  try {
+    const payload = child.stdout.slice(start + begin.length, finish < 0 ? undefined : finish);
+    return JSON.parse(finish < 0 ? firstJsonObject(payload) ?? '' : payload.trim()) as unknown;
+  } catch {
+    return [];
+  }
+}
+
+function searchCitations(value: unknown): HealCitation[] {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => {
+      const raw = asRecord(item);
+      const snippet = raw?.snippet ?? raw?.text;
+      return typeof raw?.url === 'string' && raw.url.trim() && typeof raw.title === 'string' && typeof snippet === 'string'
+        ? [{ title: raw.title, url: raw.url, snippet: snippet.slice(0, 200) }]
+        : [];
+    }).slice(0, 5);
+  }
+  const payload = asRecord(value);
+  if (!Array.isArray(payload?.results)) return [];
+  return searchCitations(payload.results.flatMap((result) => {
+    const record = asRecord(result);
+    return Array.isArray(record?.items) ? record.items : [result];
+  }));
+}
+
+function groundQuery(signature: HealFailureSignature, failure: Record<string, unknown>): string {
+  if (signature.errorText?.trim()) return signature.errorText;
+  const names = failure.failedTestNames ?? failure.failingTests ?? failure.testNames;
+  return Array.isArray(names) ? names.filter((name): name is string => typeof name === 'string').slice(0, 3).join(' ') : '';
+}
+
+export function roleResult(role: string, ctx: GraphContext, deps: HealRoleDeps = {}): Record<string, unknown> {
+  const input = asRecord(ctx.input) ?? {};
+  const failure = asRecord(input.failure) ?? input;
+  const signature = failureOf(ctx);
+  switch (role) {
+    case 'observe-ledger': {
+      if (!asRecord(input.failure) && Object.keys(failure).length === 0) return withAddedFacts({ outcome: 'empty' }, []);
+      const worktree = typeof input.worktree === 'string' ? input.worktree : '';
+      const paths = signature.unverified ?? [];
+      if (!worktree || paths.length === 0) return withAddedFacts({ outcome: 'ok', entries: [signature] }, []);
+      const exists = deps.exists ?? defaultExists(worktree);
+      const marked = markDeletedUnverified(paths, exists);
+      const changed = marked.some((path, index) => path !== paths[index]);
+      const entry: HealFailureSignature = { ...signature, unverified: marked };
+      return withAddedFacts({ outcome: 'ok', entries: [entry] }, changed ? ['unverified'] : []);
+    }
+    case 'triage': {
+      const merged = mergedContextSignature(signature, ctx.outputs);
+      const judged = triageFailure(merged.signature, historyOf(ctx));
+      return withAddedFacts(
+        { outcome: judged.outcome === 'rework-with-citations' ? 'child-fixable' : judged.outcome, evidence: [...merged.evidence, ...judged.evidence] },
+        merged.evidence.map((line) => line.split(' ← ')[0]!).filter((field, index, all) => all.indexOf(field) === index),
+      );
+    }
+    case 'verify-classification-evidence': {
+      const count = accountCount(failure);
+      const code = exitCode(failure);
+      if (count === 0) return { outcome: 'corrected', 'corrected-kind': 'no-account' };
+      if (code === 127) return { outcome: 'corrected', 'corrected-kind': 'binary-missing' };
+      if (credentialMissing(failure)) return { outcome: 'corrected', 'corrected-kind': 'credential-file-missing' };
+      if ((count ?? 0) > 0 && accountsFullOrExpired(failure)) return { outcome: 'confirmed', next: 'defer' };
+      return { outcome: 'corrected', 'corrected-kind': 'unexplained' };
+    }
+    case 'acknowledge-untestable':
+      return withAddedFacts({ outcome: 'ok', next: 'review', acknowledged: [...(signature.unverified ?? [])] }, []);
+    case 'rework-note': {
+      const grounded = mergedContextSignature(signature, ctx.outputs).signature;
+      const file = grounded.namedSource?.trim() || (grounded.unverified ?? []).find((path) => !path.endsWith('.md')) || 'unknown';
+      const symbol = typeof failure.symbol === 'string' ? failure.symbol : file.split('/').pop();
+      const citations = grounded.citations ?? [];
+      const urls = citations.length ? `\n근거: ${citations.map((citation) => citation.url).join(' · ')}` : '';
+      return withAddedFacts({ outcome: 'ok', next: 'implement', 'rework-note': `${file} 의 ${symbol} 을 고친다${urls}` }, []);
+    }
+    case 'verify':
+    case 'revise-goal':
+      return withAddedFacts({ outcome: 'fail', reason: 'not-wired' }, []);
+    case 'observe-deeper': {
+      const runId = typeof input.runId === 'string' ? input.runId : '';
+      if (!runId) return withAddedFacts({ outcome: 'empty', reason: 'not-wired' }, []);
+      const entries = deps.loadLedger
+        ? deps.loadLedger(runId)
+        : loadRunLedger(runId, deps.ledgerDir ?? (process.env.ELANOUS_STATE_DIR ? runLedgerDir(process.env.ELANOUS_STATE_DIR) : undefined));
+      const filled = fillMissingGateFacts(signature, entries ?? []);
+      if (filled.added.length === 0) return withAddedFacts({ outcome: 'empty', reason: 'no-new-facts' }, []);
+      return withAddedFacts({ outcome: 'ok', signature: filled.signature }, filled.added);
+    }
+    case 'ground-external': {
+      const collect = collectSignature(ctx.outputs);
+      const deeper = deeperSignature(ctx.outputs);
+      const grounded = mergeHealSignatures(signature, [
+        ...(collect ? [{ source: 'collect', signature: collect }] : []),
+        ...(deeper ? [{ source: 'observe-deeper', signature: deeper }] : []),
+      ]).signature;
+      const query = groundQuery(grounded, failure);
+      const started = Date.now();
+      let citations: HealCitation[] = [];
+      if (query) {
+        try { citations = searchCitations((deps.search ?? defaultSearch)(query)); }
+        catch { /* A failed external search is an empty observation, not a failed heal role. */ }
+      }
+      const search = { query, count: citations.length, ms: Date.now() - started };
+      debug.log('graph.heal', 'ground-external-search', search);
+      return citations.length
+        ? withAddedFacts({ outcome: 'ok', citations, ...search }, ['citations'])
+        : withAddedFacts({ outcome: 'empty', reason: 'no-results', ...search }, []);
+    }
+    default:
+      return withAddedFacts({ outcome: 'fail', reason: `unknown-role:${role}` }, []);
+  }
+}
+
+if (import.meta.main) {
+  const role = process.argv[2] ?? '';
+  const ctx = readContext();
+  const result = roleResult(role, ctx);
+  debug.log('graph.heal', role || 'missing-role', { outcome: result.outcome, nodeId: ctx.nodeId, runId: ctx.runId });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (result.outcome === 'fail' && result.reason !== 'not-wired') process.exitCode = 1;
+}