elanous 0.2.0 → 0.2.5

package/scripts/lib/pwa-scenarios/scenarios.ts

@@ -0,0 +1,202 @@
+import { randomBytes } from 'node:crypto';
+import { readTerminalReplay } from './acp-replay.js';
+
+export type Surface = 'terminal' | 'chat' | 'intake';
+export type Step =
+  | { kind: 'goto' }
+  | { kind: 'waitFor'; selector?: string; jsPredicate?: string; timeoutMs: number; intervalMs?: number; measureChip?: true; withinChipMs?: true }
+  | { kind: 'capture'; key: string; js: string; timeoutMs: number }
+  | { kind: 'type'; text: string }
+  | { kind: 'press'; key: string }
+  | { kind: 'click'; selector?: string };
+
+export interface Check {
+  /** Expression evaluated in the page; any truthy value passes. */
+  js: string;
+  expected: string;
+  timeoutMs?: number;
+  intervalMs?: number;
+}
+
+export interface HostCheck {
+  js: string;
+  expected: string;
+  timeoutMs: number;
+  intervalMs?: number;
+  predicate: (value: unknown, baseUrl: string, captured: Readonly<Record<string, unknown>>) => Promise<boolean>;
+}
+
+export interface Scenario {
+  id: string;
+  surface: Surface;
+  path: string;
+  title: string;
+  steps: Step[];
+  expect: Check[];
+  hostCheck?: HostCheck[];
+  /** Calls a real model (costs a turn). Runs only when named in `--only`. */
+  costly?: true;
+}
+
+const selector = (css: string): string => `Boolean(document.querySelector(${JSON.stringify(css)}))`;
+const tab = 'button[aria-label^="switch to "]';
+const terminal = '.xterm';
+const connected = '[aria-live="polite"]';
+// ChatInput 의 입력창(`apps/pwa/src/components/chat/ChatInput.tsx` placeholder) — testid 가 없어 placeholder 로 고른다.
+const chatInput = 'textarea[placeholder^="message"]';
+const intakeField = '[data-testid="intake-front-door-field"]';
+const terminalIdentity = `(() => { const sessionId = localStorage.getItem('elanous.daemon.sessionId'); const terminalId = Array.from(document.querySelectorAll('button[aria-label^="switch to "]')).find(node => node.title?.includes('지금 보는 터미널'))?.getAttribute('aria-label')?.slice('switch to '.length); return sessionId && terminalId ? { sessionId, terminalId } : null; })()`;
+const identity = (value: unknown): { sessionId: string; terminalId: string } | null => {
+  if (!value || typeof value !== 'object') return null;
+  const { sessionId, terminalId } = value as Record<string, unknown>;
+  return typeof sessionId === 'string' && sessionId.length > 0 && typeof terminalId === 'string' && terminalId.length > 0
+    ? { sessionId, terminalId } : null;
+};
+
+async function replayContains(value: unknown, baseUrl: string, text: string, count: number, readReplay: typeof readTerminalReplay): Promise<boolean> {
+  const ids = identity(value);
+  if (!ids) return false;
+  const snapshot = await readReplay({ baseUrl, ...ids, timeoutMs: 2_000 });
+  return snapshot.split(text).length - 1 >= count;
+}
+
+/** `--only` picks exactly those IDs; without it, every scenario except the costly ones (they call a real model). */
+export function selectScenarios(all: readonly Scenario[], only?: readonly string[]): { selected: Scenario[]; unknown: string[] } {
+  const requested = new Set(only ?? all.filter((s) => !s.costly).map((s) => s.id));
+  return {
+    selected: all.filter((s) => requested.has(s.id)),
+    unknown: [...requested].filter((id) => !all.some((s) => s.id === id)),
+  };
+}
+
+/** Fresh data per invocation: the terminal marker must not match earlier scrollback. */
+export function createScenarios(): Scenario[] {
+  return createScenariosWithReplay(readTerminalReplay);
+}
+
+/** Testable replay seam; production always uses the daemon-backed reader. */
+export function createScenariosWithReplay(readReplay: typeof readTerminalReplay): Scenario[] {
+  const marker = `pwa-scn-${randomBytes(8).toString('hex')}`;
+  const t1bMarker = `pwa-scn-${randomBytes(8).toString('hex')}`;
+  // C1 — the answer (n+1) never appears in the question, so finding it on the page means a model replied.
+  const c1Base = 1000 + (randomBytes(2).readUInt16BE(0) % 8000);
+  return [
+    {
+      id: 'T1', surface: 'terminal', path: '/app/term/', title: 'xterm and a tab',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: terminal, timeoutMs: 20_000 }, { kind: 'waitFor', selector: tab, timeoutMs: 20_000 }],
+      expect: [
+        { js: selector(terminal), expected: 'xterm screen is mounted' },
+        { js: `document.querySelectorAll(${JSON.stringify(tab)}).length >= 1`, expected: 'at least one terminal tab' },
+      ],
+    },
+    {
+      id: 'T1b', surface: 'terminal', path: '/app/term/', title: 'no unknown terminal relationship',
+      steps: [
+        { kind: 'goto' }, { kind: 'waitFor', selector: terminal, timeoutMs: 20_000 },
+        { kind: 'waitFor', selector: tab, timeoutMs: 20_000 },
+        { kind: 'waitFor', jsPredicate: `Array.from(document.querySelectorAll(${JSON.stringify(connected)})).some(node => node.textContent?.includes('ACP: 연결됨'))`, timeoutMs: 20_000 },
+        { kind: 'click', selector: terminal }, { kind: 'type', text: `echo ${t1bMarker}` }, { kind: 'press', key: 'Enter' },
+      ],
+      expect: [],
+      hostCheck: [{
+        js: `(() => { const ids = ${terminalIdentity}; if (!ids) return null; return { ...ids, tabsClean: Array.from(document.querySelectorAll(${JSON.stringify(tab)})).every(node => !node.textContent?.includes('이 행에서는 알 수 없음')), paneClean: Array.from(document.querySelectorAll('[data-pane-relationship]')).every(node => !node.textContent?.includes('관계를 알 수 없어 배치하지 않았습니다')) }; })()`,
+        expected: 'two echo markers in replay, no unknown relationship message in terminal replay, pane or tab', timeoutMs: 20_000,
+        predicate: async (value, baseUrl) => {
+          const ids = identity(value);
+          if (!ids) return false;
+          const snapshot = await readReplay({ baseUrl, ...ids, timeoutMs: 2_000 });
+          return snapshot.split(t1bMarker).length - 1 >= 2
+            && !snapshot.includes('관계를 알 수 없어 배치하지 않았습니다')
+            && (value as { tabsClean?: unknown; paneClean?: unknown }).tabsClean === true
+            && (value as { paneClean?: unknown }).paneClean === true;
+        },
+      }],
+    },
+    {
+      id: 'T4a', surface: 'terminal', path: '/app/term/', title: 'terminal echo round-trip',
+      steps: [
+        { kind: 'goto' }, { kind: 'waitFor', selector: terminal, timeoutMs: 20_000 },
+        { kind: 'waitFor', selector: tab, timeoutMs: 20_000 },
+        { kind: 'waitFor', jsPredicate: `Array.from(document.querySelectorAll(${JSON.stringify(connected)})).some(node => node.textContent?.includes('ACP: 연결됨'))`, timeoutMs: 20_000 },
+        { kind: 'click', selector: terminal }, { kind: 'type', text: `echo ${marker}` }, { kind: 'press', key: 'Enter' },
+      ],
+      expect: [],
+      hostCheck: [{ js: terminalIdentity, expected: `replay contains ${marker} twice (input echo and output)`, timeoutMs: 20_000,
+        predicate: (value, baseUrl) => replayContains(value, baseUrl, marker, 2, readReplay) }],
+    },
+    {
+      id: 'T5', surface: 'terminal', path: '/app/term/', title: 'terminal reload keeps one shell',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: tab, timeoutMs: 20_000 },
+        { kind: 'capture', key: 'first', js: terminalIdentity, timeoutMs: 20_000 },
+        { kind: 'goto' }, { kind: 'waitFor', selector: tab, timeoutMs: 20_000 },
+        { kind: 'capture', key: 'second', js: terminalIdentity, timeoutMs: 20_000 },
+        { kind: 'goto' }, { kind: 'waitFor', selector: tab, timeoutMs: 20_000 },
+        { kind: 'capture', key: 'third', js: terminalIdentity, timeoutMs: 20_000 }],
+      expect: [],
+      hostCheck: [{ js: terminalIdentity, expected: 'same tab ID on three opens and one web-registration row', timeoutMs: 10_000,
+        predicate: async (value, baseUrl, captured) => {
+          const ids = identity(value);
+          const first = identity(captured.first);
+          const second = identity(captured.second);
+          const third = identity(captured.third);
+          if (!ids || !first || !second || !third) return false;
+          if (first.terminalId !== second.terminalId || second.terminalId !== third.terminalId || third.terminalId !== ids.terminalId) return false;
+          const response = await fetch(`${baseUrl}/v1/terminals`, { headers: { Origin: baseUrl }, signal: AbortSignal.timeout(5_000) });
+          if (!response.ok) throw new Error(`terminal list HTTP ${response.status}`);
+          const body = await response.json() as { terminals?: Array<{ id?: string; producer?: string }> };
+          if (!Array.isArray(body.terminals)) throw new Error('invalid terminal list response');
+          return body.terminals.filter((row) => row.producer === 'web-registration' && row.id === ids.terminalId).length === 1;
+        } }],
+    },
+    {
+      id: 'C1', surface: 'chat', path: '/app/chat/', title: 'first message streams a model reply', costly: true,
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: chatInput, timeoutMs: 20_000 }, { kind: 'click', selector: chatInput }, { kind: 'type', text: `Reply with only the number that is one more than ${c1Base}.` }, { kind: 'press', key: 'Enter' }],
+      expect: [{ js: `document.body.innerText.includes(${JSON.stringify(String(c1Base + 1))})`, expected: `a model reply containing ${c1Base + 1} appears`, timeoutMs: 120_000, intervalMs: 1_000 }],
+    },
+    {
+      id: 'C2a', surface: 'chat', path: '/app/chat/', title: 'local meta command help',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: chatInput, timeoutMs: 20_000 }, { kind: 'click', selector: chatInput }, { kind: 'type', text: ':help' }, { kind: 'press', key: 'Enter' }],
+      expect: [{ js: `Array.from(document.querySelectorAll('pre')).some(node => node.textContent?.includes('Meta commands'))`, expected: 'message list shows Meta commands', timeoutMs: 10_000 }],
+    },
+    {
+      id: 'C2b', surface: 'chat', path: '/app/chat/', title: 'slash help aliases local meta command',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: chatInput, timeoutMs: 20_000 }, { kind: 'click', selector: chatInput }, { kind: 'type', text: '/help' }, { kind: 'press', key: 'Enter' }],
+      expect: [{ js: `Array.from(document.querySelectorAll('pre')).some(node => node.textContent?.includes('Meta commands'))`, expected: 'message list shows Meta commands for /help', timeoutMs: 10_000 }],
+    },
+    {
+      id: 'N1', surface: 'intake', path: '/app/intake/', title: 'empty field disables actions',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: intakeField, timeoutMs: 20_000 },
+        ...['intake-absorb', 'intake-split', 'intake-graph'].map((id): Step => ({ kind: 'waitFor', selector: `[data-testid="${id}"]`, timeoutMs: 5_000 }))],
+      expect: [{ js: `['intake-absorb','intake-split','intake-graph'].every(id => document.querySelector('[data-testid="' + id + '"]')?.hasAttribute('disabled'))`, expected: 'all three action buttons disabled for empty input' }],
+    },
+    {
+      id: 'N5a', surface: 'intake', path: '/app/intake/', title: 'URL previews absorb without submitting',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: intakeField, timeoutMs: 20_000 }, { kind: 'click', selector: intakeField }, { kind: 'type', text: 'https://example.com' },
+        { kind: 'waitFor', jsPredicate: `(() => { const chip = document.querySelector('[data-testid="intake-route-chip"]'); return Boolean(chip && chip.getClientRects().length); })()`, timeoutMs: 5_000, measureChip: true },
+        { kind: 'waitFor', jsPredicate: `(() => { const chip = document.querySelector('[data-testid="intake-route-chip"]'); return chip?.getAttribute('data-auto-submit') === '0' && chip.querySelector('[data-testid="intake-route-chip-label"]')?.textContent?.includes('흡수'); })()`, timeoutMs: 5_000, withinChipMs: true }],
+      expect: [{ js: `(() => { const chip = document.querySelector('[data-testid="intake-route-chip"]'); return chip?.getAttribute('data-auto-submit') === '0' && chip.querySelector('[data-testid="intake-route-chip-label"]')?.textContent?.includes('흡수'); })()`, expected: 'absorb chip within 5s and data-auto-submit=0', timeoutMs: 0 }],
+    },
+    {
+      id: 'N6a', surface: 'intake', path: '/app/intake/', title: 'unknown rule offers classification without invoking LLM',
+      steps: [{ kind: 'goto' }, { kind: 'waitFor', selector: intakeField, timeoutMs: 20_000 }, { kind: 'click', selector: intakeField }, { kind: 'type', text: '안녕' },
+        { kind: 'waitFor', selector: '[data-testid="intake-route-chip"]', timeoutMs: 5_000 }],
+      expect: [{ js: `(() => { const button = document.querySelector('[data-testid="intake-route-chip"] [data-testid="intake-route-classify"]'); return Boolean(button && button.getClientRects().length); })()`, expected: 'classification button visible; never clicked (no LLM call)', timeoutMs: 5_000 }],
+    },
+  ];
+}
+
+/** Return a canonical loopback origin; disallow credentials, paths and non-local hosts. */
+export function validateBaseUrl(input: string, allowPort = false): string {
+  const explicit = /^http:\/\/127\.0\.0\.1:(\d+)\/?$/.exec(input);
+  let url: URL;
+  try { url = new URL(input); } catch { throw new Error('base URL must be http://127.0.0.1:PORT'); }
+  const port = Number(explicit?.[1]);
+  if (!explicit || url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || !Number.isInteger(port)
+      || port < 1 || port > 65535 || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+    throw new Error('base URL must be http://127.0.0.1:PORT');
+  }
+  if (!allowPort && (port < 31450 || port > 31499 || [31415, 31420, 31421].includes(port))) {
+    throw new Error(`port ${port} refused: use isolated daemon port 31450–31499 (or --allow-port)`);
+  }
+  return `http://127.0.0.1:${port}`;
+}

package/scripts/lib/tui-sim-keys.ts

@@ -0,0 +1,42 @@
+// Named tui-sim keys and raw PTY input bytes.
+const KEYS: Record<string, string> = {
+  enter: '\r', return: '\r', tab: '\t', 'shift-tab': '\x1b[Z', esc: '\x1b', escape: '\x1b',
+  space: ' ', backspace: '\x7f', delete: '\x1b[3~',
+  up: '\x1b[A', down: '\x1b[B', right: '\x1b[C', left: '\x1b[D',
+  pageup: '\x1b[5~', pagedown: '\x1b[6~', home: '\x1b[H', end: '\x1b[F',
+  'shift-enter': '\x1b[13;2u',
+};
+
+export function resolveKeyBytes(name: string): string | null {
+  const key = name.toLowerCase();
+  if (Object.hasOwn(KEYS, key)) return KEYS[key]!;
+  if (/^ctrl-[a-z]$/.test(key)) return String.fromCharCode(key.charCodeAt(5) - 96);
+  if (key === 'ctrl-\\') return '\x1c';
+  if (key === 'ctrl-]') return '\x1d';
+  if (key.startsWith('hex:')) {
+    const hex = key.slice(4);
+    return hex.length > 0 && hex.length % 2 === 0 && /^[0-9a-f]+$/.test(hex)
+      ? Buffer.from(hex, 'hex').toString('latin1')
+      : null;
+  }
+  if (key.startsWith('alt-')) {
+    const suffix = name.slice(4);
+    const bytes = Object.hasOwn(KEYS, suffix.toLowerCase()) ? KEYS[suffix.toLowerCase()]!
+      : suffix.toLowerCase().startsWith('ctrl-') ? resolveKeyBytes(suffix)
+      : [...suffix].length === 1 ? suffix : null;
+    return bytes === null ? null : `\x1b${bytes}`;
+  }
+  return null;
+}
+
+/** Keep raw hex as a Buffer: passing a latin1 string to the PTY would UTF-8 encode bytes >= 0x80. */
+export function resolveKeyInput(name: string): string | Buffer | null {
+  const bytes = resolveKeyBytes(name);
+  if (bytes === null) return null;
+  return name.toLowerCase().startsWith('hex:') ? Buffer.from(name.slice(4), 'hex') : bytes;
+}
+
+/** Bun's native PTY passes Buffer bytes through unchanged; its typed registry API only declares strings. */
+export function writeKeyInput(handle: { write(chars: string): void }, input: string | Buffer): void {
+  handle.write(input as string);
+}

package/scripts/market/db-check.ts

@@ -0,0 +1,212 @@
+import { SQL } from 'bun';
+import { readFileSync } from 'node:fs';
+import { generateIndexKeyPair, signIndex, verifyIndex } from '../../src/market/signed-index';
+
+type Rows = Record<string, unknown>[];
+export interface DbQueries {
+  unsafe(query: string, values?: unknown[], options?: { simple: boolean }): Promise<Rows>;
+}
+export interface DbClient extends DbQueries {
+  begin<T>(callback: (tx: DbQueries) => Promise<T>): Promise<T>;
+  close(): Promise<void>;
+}
+
+export interface CheckResult {
+  name: string;
+  ok: boolean;
+  detail: string;
+}
+export interface DbCheckResult {
+  ok: boolean;
+  applied: boolean;
+  checks: CheckResult[];
+}
+
+const migration = readFileSync(new URL('../../services/market/migrations/0001_init.sql', import.meta.url), 'utf8');
+const tables = ['publishers', 'plugins', 'versions', 'scan_results', 'entitlements', 'audit_log'];
+const rollback = Symbol('rollback probe');
+
+function queryAdapter(queries: Pick<SQL, 'unsafe'>): DbQueries {
+  return {
+    unsafe: async (query, values, options) => {
+      const statement = queries.unsafe(query, values);
+      return await (options?.simple ? statement.simple() : statement) as Rows;
+    },
+  };
+}
+
+export function connect(url: string): DbClient {
+  const sql = new SQL(url);
+  return {
+    ...queryAdapter(sql),
+    begin: callback => sql.begin(async tx => callback(queryAdapter(tx))),
+    close: async () => { await sql.close(); },
+  };
+}
+
+async function preparePlugin(tx: DbQueries): Promise<string> {
+  const [publisher] = await tx.unsafe("insert into publishers (handle, display_name) values ($1, 'DB check') returning id", [`check-${crypto.randomUUID().replaceAll('-', '').slice(0, 32)}`]);
+  const [plugin] = await tx.unsafe('insert into plugins (publisher_id, name) values ($1, $2) returning id', [publisher.id, `check-${crypto.randomUUID().replaceAll('-', '').slice(0, 32)}`]);
+  return plugin.id as string;
+}
+
+async function insertVersion(tx: DbQueries, pluginId: string, version: string, sha256: string, pricingModel = 'free'): Promise<string> {
+  const keys = generateIndexKeyPair();
+  const indexBytes = Buffer.from(JSON.stringify({
+    name: 'check', interface: { displayName: 'Check' }, sequence: 1,
+    plugins: [{ name: 'check-plugin', version, source: { source: 'check' },
+      artifact: { sha256, bytes: 1, key: 'check-artifact' },
+      'ai.elanous': { capabilities: [], connectors: [], pricing: { model: pricingModel } } }],
+  }));
+  const [row] = await tx.unsafe(`insert into versions
+    (plugin_id, version, sha256, bytes, artifact_key, pricing_model, signed_sequence, signed_index_bytes, signed_index_signature)
+    values ($1, $2, $3, 1, 'check-artifact', $4, 1, $5, $6::jsonb) returning id`,
+    // Bun JSON-encodes a string parameter, so pass the parsed object or jsonb stores a string.
+    [pluginId, version, sha256, pricingModel, indexBytes, JSON.parse(signIndex(indexBytes, keys.privateKeyPem, keys.keyId))]);
+  return row.id as string;
+}
+
+async function rejectionCheck(db: DbClient, name: string, code: string, probe: (tx: DbQueries) => Promise<void>): Promise<CheckResult> {
+  try {
+    await db.begin(async tx => {
+      await probe(tx);
+      throw rollback;
+    });
+    return { name, ok: false, detail: 'probe unexpectedly committed' };
+  } catch (error) {
+    if (error === rollback) return { name, ok: false, detail: 'invalid statement was accepted' };
+    // Bun's Postgres client puts the SQLSTATE in `errno`; `code` is the generic ERR_POSTGRES_SERVER_ERROR.
+    const failure = error as { errno?: unknown; code?: unknown };
+    const actual = typeof failure?.errno === 'string' && /^[0-9A-Z]{5}$/.test(failure.errno) ? failure.errno : failure?.code;
+    return { name, ok: actual === code, detail: actual === code ? `rejected (${code})` : `wrong rejection (${String(actual)}: ${String((error as { message?: unknown })?.message ?? '').slice(0, 120)})` };
+  }
+}
+
+async function signedIndexCheck(db: DbClient): Promise<CheckResult> {
+  const keys = generateIndexKeyPair();
+  let verified = false;
+  try {
+    await db.begin(async tx => {
+      const pluginId = await preparePlugin(tx);
+      const [plugin] = await tx.unsafe('select name from plugins where id = $1', [pluginId]);
+      const marketplaceBytes = Buffer.from(JSON.stringify({
+        name: 'check', interface: { displayName: 'Check' }, sequence: 1,
+        plugins: [{
+          name: plugin.name, version: '1.0.0', source: { source: 'check' },
+          artifact: { sha256: 'a'.repeat(64), bytes: 1, key: 'check-artifact' },
+          'ai.elanous': { capabilities: [], connectors: [], pricing: { model: 'free' } },
+        }],
+      }));
+      const signature = signIndex(marketplaceBytes, keys.privateKeyPem, keys.keyId);
+      const [stored] = await tx.unsafe(`insert into versions
+        (plugin_id, version, sha256, bytes, artifact_key, signed_sequence, signed_index_bytes, signed_index_signature)
+        values ($1, '1.0.0', $2, 1, 'check-artifact', 1, $3, $4::jsonb)
+        returning id`, [pluginId, 'a'.repeat(64), marketplaceBytes, JSON.parse(signature)]);
+      const [row] = await tx.unsafe('select version, sha256, bytes, artifact_key, signed_sequence, signed_index_bytes, signed_index_signature from versions where id = $1', [stored.id]);
+      const result = verifyIndex({
+        marketplaceBytes: row.signed_index_bytes as Uint8Array,
+        signatureText: JSON.stringify(row.signed_index_signature),
+        trustedKeys: [{ keyId: keys.keyId, publicKey: keys.publicKey }],
+      });
+      const indexed = result.ok ? result.index.plugins[0] : undefined;
+      verified = result.ok && indexed !== undefined && result.sequence === Number(row.signed_sequence)
+        && indexed.name === plugin.name && indexed.version === row.version
+        && indexed.artifact.sha256 === (row.sha256 as string).trim()
+        && indexed.artifact.bytes === Number(row.bytes) && indexed.artifact.key === row.artifact_key;
+      throw rollback;
+    });
+  } catch (error) {
+    if (error !== rollback) return { name: 'versions:signed_index', ok: false, detail: 'signed index storage or verification failed' };
+  }
+  return { name: 'versions:signed_index', ok: verified, detail: verified ? 'signature verified' : 'signature not verified' };
+}
+
+export async function runDbCheck(db: DbClient): Promise<DbCheckResult> {
+  const checks: CheckResult[] = [];
+  let applied = false;
+  try {
+    const [state] = await db.unsafe("select to_regclass('public.schema_migrations') is not null as exists");
+    const alreadyApplied = state.exists === true && (await db.unsafe("select version from schema_migrations where version = '0001_init'")).length > 0;
+    if (!alreadyApplied) await db.unsafe(migration, [], { simple: true });
+    applied = !alreadyApplied;
+    const recorded = await db.unsafe("select version from schema_migrations where version = '0001_init'");
+    checks.push({ name: 'migration:recorded', ok: recorded.length === 1, detail: recorded.length === 1 ? 'recorded' : 'missing' });
+
+    const found = await db.unsafe("select table_name from information_schema.tables where table_schema = 'public' and table_name in ('publishers', 'plugins', 'versions', 'scan_results', 'entitlements', 'audit_log')");
+    const names = new Set(found.map(row => row.table_name));
+    for (const table of tables) checks.push({ name: `table:${table}`, ok: names.has(table), detail: names.has(table) ? 'exists' : 'missing' });
+
+    checks.push(await rejectionCheck(db, 'versions:duplicate', '23505', async tx => {
+      const pluginId = await preparePlugin(tx);
+      await insertVersion(tx, pluginId, '1.0.0', 'a'.repeat(64));
+      await insertVersion(tx, pluginId, '1.0.0', 'b'.repeat(64));
+    }));
+    checks.push(await rejectionCheck(db, 'versions:sha256', '23514', async tx => {
+      await insertVersion(tx, await preparePlugin(tx), '1.0.0', 'a'.repeat(63));
+    }));
+    checks.push(await rejectionCheck(db, 'versions:pricing_model', '23514', async tx => {
+      await insertVersion(tx, await preparePlugin(tx), '1.0.0', 'a'.repeat(64), 'paid');
+    }));
+    checks.push(await signedIndexCheck(db));
+    for (const [name, statement] of [
+      ['version', "update versions set version = '2.0.0' where id = $1"],
+      ['sha256', "update versions set sha256 = repeat('b', 64) where id = $1"],
+      ['signature', "update versions set signed_index_signature = '{\"alg\":\"ed25519\"}'::jsonb where id = $1"],
+    ]) {
+      checks.push(await rejectionCheck(db, `versions:immutable:${name}`, 'P0001', async tx => {
+        const id = await insertVersion(tx, await preparePlugin(tx), '1.0.0', 'a'.repeat(64));
+        await tx.unsafe(statement, [id]);
+      }));
+    }
+    checks.push(await rejectionCheck(db, 'versions:unsigned', '23502', async tx => {
+      await tx.unsafe(`insert into versions (plugin_id, version, sha256, bytes, artifact_key)
+        values ($1, 'unsigned-probe', $2, 1, 'check-artifact')`,
+        [await preparePlugin(tx), 'a'.repeat(64)]);
+    }));
+    checks.push(await rejectionCheck(db, 'audit_log:update', 'P0001', async tx => {
+      const [entry] = await tx.unsafe("insert into audit_log (actor, action) values ('db-check', 'probe') returning id");
+      await tx.unsafe("update audit_log set action = 'mutated' where id = $1", [entry.id]);
+    }));
+    checks.push(await rejectionCheck(db, 'audit_log:delete', 'P0001', async tx => {
+      const [entry] = await tx.unsafe("insert into audit_log (actor, action) values ('db-check', 'probe') returning id");
+      await tx.unsafe('delete from audit_log where id = $1', [entry.id]);
+    }));
+    checks.push(await rejectionCheck(db, 'audit_log:truncate', 'P0001', async tx => {
+      await tx.unsafe('truncate audit_log');
+    }));
+  } catch {
+    checks.push({ name: 'migration', ok: false, detail: 'migration or inspection failed' });
+  }
+  return { ok: checks.length === tables.length + 12 && checks.every(check => check.ok), applied, checks };
+}
+
+export async function executeDbCheck(
+  url: string,
+  connectFn: (url: string) => DbClient = connect,
+  output: (line: string) => void = console.log,
+): Promise<DbCheckResult> {
+  let db: DbClient | undefined;
+  let result: DbCheckResult;
+  try {
+    db = connectFn(url);
+    result = await runDbCheck(db);
+  } catch {
+    result = { ok: false, applied: false, checks: [{ name: 'connection', ok: false, detail: 'connection failed' }] };
+  } finally {
+    try { await db?.close(); } catch { /* Driver errors can contain credentials. */ }
+  }
+  output(JSON.stringify(result));
+  return result;
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const url = args.length === 2 && args[0] === '--url' ? args[1] : undefined;
+  if (!url) {
+    console.log(JSON.stringify({ ok: false, applied: false, checks: [{ name: 'arguments', ok: false, detail: 'expected --url <postgres URL>' }] }));
+    process.exitCode = 1;
+  } else {
+    const result = await executeDbCheck(url);
+    if (!result.ok) process.exitCode = 1;
+  }
+}

package/scripts/market-posture-cycle.ts

@@ -20,10 +20,11 @@ import { join } from 'node:path';
 import { latestRegimeVector, openRegimeDb } from '../src/domains/regime-store.js';
 import type { RegimeVector } from '../src/domains/regime-synth.js';
 import {
-  deriveMarketPosture,
-  type DeriveMarketPostureInput, type ThreatDriver, type TripwireInputs,
+  deriveMarketPosture, progressiveDefcon, tripwireDefcon, normalizeLeveragedReturn, DEFAULT_DEFCON_THRESHOLDS,
+  type DeriveMarketPostureInput, type MarketPosture, type ThreatDriver, type TripwireInputs,
 } from '../src/domains/market-posture.js';
-import { publishMarketPosture, type PublishResult } from '../src/domains/market-posture-store.js';
+import { loadMarketPosture, publishMarketPosture, type PublishResult } from '../src/domains/market-posture-store.js';
+import { debug, redactSecretText } from '../src/debug/log.js';
 import { decideLeverage, type LeveragePlan } from '../src/domains/capstone-leverage.js';
 import type { CapstoneTarget } from '../src/domains/capstone-signals.js';
 
@@ -73,6 +74,7 @@ export interface MarketPostureCycleDeps {
   readEmergency?: () => TripwireInputs | null;
   now?: () => number;
   publish?: (posture: ReturnType<typeof deriveMarketPosture>) => PublishResult;
+  load?: () => MarketPosture | null;
 }
 
 /** 입력 조립(순수·dep 주입) — regime+capstone+emergency 융합 → DeriveMarketPostureInput. */
@@ -104,13 +106,66 @@ export function assembleMarketPostureInput(regime: RegimeVector, deps: MarketPos
 
 export interface MarketPostureCycleResult { published: boolean; defcon?: number; note: string; }
 
+function postureLog(event: string, data: unknown, warn = false): void {
+  try { debug.log('posture.defcon', event, data, warn ? { level: 'warn' } : undefined); }
+  catch { /* 관측 실패가 산정·게시를 막지 않는다. */ }
+}
+
 /** 생산자 사이클 — regime+capstone+emergency 융합 → derive → publish(단일 canonical sink). */
 export function runMarketPostureCycle(deps: MarketPostureCycleDeps = {}): MarketPostureCycleResult {
   const regime = (deps.loadRegime ?? defaultLoadRegime)();
-  if (!regime) return { published: false, note: 'regime.db 최신 벡터 없음 — posture 미산정(입력 결측·게시 스킵)' };
+  if (!regime) {
+    postureLog('skipped', { reason: 'regime-missing' });
+    return { published: false, note: 'regime.db 최신 벡터 없음 — posture 미산정(입력 결측·게시 스킵)' };
+  }
   const input = assembleMarketPostureInput(regime, deps);
   const posture = deriveMarketPosture(input);
+  // Before publication: the canonical/last-good reader is the source of the previous value.
+  let previousDefcon: MarketPosture['defcon'] | null = null;
+  try { previousDefcon = (deps.load ?? loadMarketPosture)()?.defcon ?? null; }
+  catch { /* 관측용 이전값 읽기 실패는 게시를 막지 않는다. */ }
+  const changed = previousDefcon !== null && previousDefcon !== posture.defcon;
+  let cause: 'tripwire' | 'drivers' = 'drivers';
+  let tripwires: Array<{ type: string; name?: string; value?: number }> = [];
+  try {
+    const thresholds = { ...DEFAULT_DEFCON_THRESHOLDS, ...input.thresholds };
+    cause = tripwireDefcon(input.tripwire, thresholds) < progressiveDefcon(input.drivers, thresholds)
+      ? 'tripwire' : 'drivers';
+    const tw = input.tripwire;
+    tripwires = [
+      ...(tw?.indices ?? []).filter(index => index.circuitBreaker ||
+        (Number.isFinite(index.dayReturn) && index.dayReturn <= thresholds.indexLevel2)).map(index => ({
+        type: 'index', name: redactSecretText(index.symbol), value: index.dayReturn,
+      })),
+      ...(tw?.spots ?? []).filter(spot => Number.isFinite(spot.dayReturn) && spot.dayReturn <= thresholds.spotLevel2)
+        .map(spot => ({ type: 'spot', name: redactSecretText(spot.symbol), value: spot.dayReturn })),
+      ...(tw?.leveragedEtfs ?? []).filter(etf => {
+        const equivalent = normalizeLeveragedReturn(etf.dayReturn, etf.leverage);
+        return Number.isFinite(equivalent) && equivalent <= thresholds.leverageEquivalentLevel2 + 1e-9;
+      }).map(etf => ({
+        type: 'leveragedEtf', name: redactSecretText(etf.symbol),
+        value: normalizeLeveragedReturn(etf.dayReturn, etf.leverage),
+      })),
+      ...(tw?.futures ?? []).filter(future => future.limitDown || future.gapDown)
+        .map(future => ({ type: 'future', name: redactSecretText(future.symbol) })),
+      ...(tw?.systemCrisis ? [{ type: 'systemCrisis' }] : []),
+    ];
+  } catch { /* 관측용 원인·트립와이어 투영 실패는 게시를 막지 않는다. */ }
+  try {
+    postureLog('computed', {
+      defcon: posture.defcon, previousDefcon, changed,
+      regimeLabel: redactSecretText(regime.regimeLabel),
+      drivers: (input.drivers ?? []).map(d => ({ name: redactSecretText(d.key), value: d.contribution, weight: d.weight })),
+      tripwires,
+      freshness: input.freshness,
+    });
+  } catch { /* 관측용 페이로드 실패는 게시를 막지 않는다. */ }
   const r = (deps.publish ?? publishMarketPosture)(posture);
+  if (r?.ok && changed) postureLog('changed', { from: previousDefcon, to: posture.defcon, cause });
+  if (!r?.ok) {
+    try { postureLog('publish-rejected', { reason: redactSecretText(r?.reason ?? '알 수 없음') }, true); }
+    catch { /* 관측용 사유 투영 실패는 결과를 바꾸지 않는다. */ }
+  }
   return {
     published: !!r?.ok, defcon: posture.defcon,
     note: r?.ok
@@ -126,6 +181,10 @@ function defaultLoadRegime(): RegimeVector | null {
 
 // CLI 진입 — 크론이 직접 실행(scripts/market-posture-cycle.ts). import 시엔 실행 안 함.
 if (import.meta.main) {
+  try {
+    const { registerStandaloneLogSink } = await import('../src/domains/standalone-log-sink.js');
+    await registerStandaloneLogSink('market-posture-cycle');
+  } catch { /* 로그 싱크 장애는 사이클을 막지 않는다. */ }
   // ★ 루프 에이전트 자기등록(대표 2026-07-16 점검) — DEFCON 국면 감시 루프(autonomous 생산자)를
   //   loop-agent-registry 에 매 실행 자기등록(계약루프 패턴 동일). 부팅마다 supersede·좀비 감지·
   //   elanous loops 자산 원장 신선. 미션(apm)·크론(schedule id) 귀속. fail-soft(등록 실패가 사이클 안 막음).

package/scripts/measure-front-route-classifier.ts

@@ -0,0 +1,56 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { ResolveRoleProviderFn } from '../src/intake-plane/runtime-callables.js';
+import type { LLMProvider } from '../src/llm.js';
+import { formatFrontRouteReport, loadFrontRouteCorpus, measureFrontRoute } from './lib/front-route-measurement.js';
+
+interface RunnerOptions { providers: string[]; runs: number; json: boolean }
+
+export function parseFrontRouteArgs(args: readonly string[]): RunnerOptions {
+  const options: RunnerOptions = { providers: [], runs: 1, json: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') options.json = true;
+    else if (arg === '--provider') {
+      const value = args[++i];
+      if (!value || value.startsWith('--') || !/^[\w-]+(?:\/\S+)?$/.test(value)) throw new Error('--provider requires <name>[/<model>]');
+      options.providers.push(value);
+    } else if (arg === '--runs') {
+      const value = args[++i];
+      if (!value || !/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(Number(value))) throw new Error('--runs requires a positive integer');
+      options.runs = Number(value);
+    } else throw new Error(`Unknown option: ${arg}`);
+  }
+  return options;
+}
+
+export function frontRouteProviders(specs: readonly string[], registry: Record<string, LLMProvider>): { label: string; resolve: ResolveRoleProviderFn }[] {
+  return specs.map((label) => {
+    const slash = label.indexOf('/');
+    const name = slash < 0 ? label : label.slice(0, slash);
+    const model = slash < 0 ? undefined : label.slice(slash + 1);
+    const provider = registry[name];
+    if (!provider) throw new Error(`Unknown provider: ${name}`);
+    const selectedModel = model ?? provider.defaultModel;
+    const resolveRole: ResolveRoleProviderFn = (_role) => ({ provider: provider as unknown as ReturnType<ResolveRoleProviderFn>['provider'], ...(typeof selectedModel === 'string' ? { model: selectedModel } : {}) });
+    return { label, resolve: resolveRole };
+  });
+}
+
+export async function main(args: readonly string[] = process.argv.slice(2), env: NodeJS.ProcessEnv = process.env): Promise<void> {
+  const options = parseFrontRouteArgs(args);
+  if (!env.CORPUS_PATH?.trim()) throw new Error('CORPUS_PATH is required (path to front-route corpus JSON)');
+  const corpus = loadFrontRouteCorpus(readFileSync(resolve(process.cwd(), env.CORPUS_PATH), 'utf8'));
+  const { PROVIDERS } = await import('../src/llm.js');
+  let selected = options.providers;
+  if (!selected.length) {
+    const { resolveRoleLlm } = await import('../src/user-config.js');
+    const { provider, model } = resolveRoleLlm('classify');
+    selected = [model ? `${provider}/${model}` : provider];
+  }
+  const providers = frontRouteProviders(selected, PROVIDERS);
+  const result = await measureFrontRoute(corpus.items, { providers, runs: options.runs });
+  console.log(options.json ? JSON.stringify(result, null, 2) : formatFrontRouteReport(result));
+}
+
+if (import.meta.main) await main();

package/scripts/media/ocr-leak-scan.sh

@@ -0,0 +1,21 @@
+#!/bin/zsh
+# 공개 영상 누출 관문 — 1초 한 장(또는 --fps N) 전수 OCR → 금지 목록 → 초 단위 표(hits.tsv).
+# 사용: scripts/media/ocr-leak-scan.sh <영상> <산출 폴더> [--fps N]
+# 한계: tesseract eng — 한글 칸·이모지는 사람 눈으로 따로 본다(내부 문서 `TC` §2). 걸림은 오독이 많다 → 그 초 프레임을 눈으로 대조한다.
+V=$1; O=$2; FPS=1
+[ "${3:-}" = "--fps" ] && FPS=${4:-1}
+[ -f "$V" ] && [ -n "$O" ] || { echo "사용: $0 <영상> <산출 폴더> [--fps N]" >&2; exit 2; }
+command -v tesseract >/dev/null && command -v ffmpeg >/dev/null || { echo "tesseract·ffmpeg 가 필요하다" >&2; exit 2; }
+mkdir -p "$O/f" && ffmpeg -loglevel error -i "$V" -vf "fps=$FPS" "$O/f/%05d.png" || exit 2
+# 금지: 홈 경로 · 실명 계정 표지 · 사설 호스트 · tailnet · 금액 · 크레딧 수 · 메일 · 키·토큰 모양(elanous 단기 토큰 elt_ · bearer · GitHub 토큰 · 40자+ 연속)
+PAT='/Users/|msb[0-9]|\bmbp\b|tail[0-9a-f]{4,}|ts\.net|\$[0-9]|USD|credit[s]? *[0-9]|@gmail|api[_-]?key|sk-[A-Za-z0-9]{8}|elt_[A-Za-z0-9_-]{6}|bearer|ghs_|gh[po]_|[A-Za-z0-9_-]{40,}'
+[ -n "${OCR_EXTRA_PATTERN:-}" ] && PAT="$PAT|$OCR_EXTRA_PATTERN"   # 계정 실명 등은 저장소에 적지 않고 환경변수로 준다
+: > "$O/hits.tsv"
+for f in "$O"/f/*.png; do
+  n=${${f:t:r}#0*}; s=$(( (n - 1) / FPS ))
+  t=$(tesseract "$f" - -l eng --psm 11 2>/dev/null)
+  print -r -- "$t" > "$O/f/${f:t:r}.txt"
+  print -r -- "$t" | grep -inE "$PAT" | grep -vE '^[0-9]+:[^ ]*run-[0-9a-f]{8}-[0-9a-f-]{27}$' \
+    | while read -r line; do print -r -- "$s\t$line" >> "$O/hits.tsv"; done
+done
+print "frames=$(ls "$O"/f/*.png | wc -l | tr -d ' ') hits=$(wc -l < "$O/hits.tsv" | tr -d ' ')"

package/scripts/nightly-docops.ts

@@ -119,7 +119,7 @@ const metrics = await runNightlyDocOpsCycle({
     if (!t) return 0;
     const linkWarnings = lintDocLinks(item.path, t, { fileExists, readText, vaultFiles });
     const issueCommentWarnings = await lintGitHubIssueCommentPointers(item.path, t, {
-      repository: { owner: 'ElanvitalAI', repo: 'monad-agent' },
+      repository: { owner: 'ElanvitalAI', repo: 'elanous-agent' },
       fetchStatus: issueCommentFetchStatus,
     });
     // ⛔⭐ **분류와 대상을 보존해 찍는다**(리뷰 2R should-fix) — 숫자만 합산하면 운영자가