elanous 0.2.0 → 0.2.5

package/scripts/publish-internal-dist.ts

@@ -0,0 +1,118 @@
+#!/usr/bin/env bun
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { spawnSyncText } from '../src/util/spawn-sync-output.js';
+
+export function publishInternalDist(checkout: string, out: string, keep = 3): { ok: true; version: string; commit: string; sha256: string; out: string; pwaBuild: 'present' | 'missing' } {
+  checkout = resolve(checkout);
+  out = resolve(out);
+  if (!Number.isSafeInteger(keep) || keep < 1) throw new Error('--keep must be a positive integer');
+  const pkg = JSON.parse(readFileSync(join(checkout, 'package.json'), 'utf8')) as { name?: string; version?: string };
+  if (pkg.name !== 'elanous' || !pkg.version || !/^[0-9A-Za-z][0-9A-Za-z._-]*$/.test(pkg.version)) throw new Error('invalid elanous package version');
+  if (!existsSync(join(checkout, 'scripts/install.sh')) || !existsSync(join(checkout, 'scripts/botlab/bot-canary.ts'))) {
+    throw new Error('checkout must contain scripts/install.sh and scripts/botlab/bot-canary.ts');
+  }
+  const git = spawnSync('git', ['rev-parse', '--verify', 'HEAD'], { cwd: checkout, encoding: 'utf8' });
+  const commit = git.stdout?.trim() ?? '';
+  if (git.status !== 0 || !/^[0-9a-f]{40,64}$/.test(commit)) throw new Error(`checkout commit unavailable: ${git.stderr}`);
+  const name = `v${pkg.version}-${commit.slice(0, 12)}`;
+  const download = join(out, 'download');
+  const target = join(download, name);
+  mkdirSync(download, { recursive: true });
+  const staging = mkdtempSync(join(download, '.publish-'));
+  let link: string | undefined;
+  try {
+    const packed = spawnSync('bun', ['pm', 'pack', '--destination', staging], { cwd: checkout, encoding: 'utf8' });
+    if (packed.status !== 0) throw new Error(`bun pm pack failed: ${packed.stderr || packed.stdout}`);
+    const tgz = readdirSync(staging).find((file) => file.endsWith('.tgz'));
+    if (!tgz) throw new Error('bun pm pack produced no tgz');
+    const archive = join(staging, tgz);
+    const listed = spawnSync('tar', ['-tzf', archive], { encoding: 'utf8' });
+    if (listed.status !== 0 || !listed.stdout.split('\n').includes('package/scripts/botlab/bot-canary.ts')) {
+      throw new Error('packed archive is missing scripts/botlab/bot-canary.ts');
+    }
+    const packedPaths = listed.stdout.split('\n')
+      .filter((path) => path.startsWith('package/') && !path.endsWith('/'))
+      .map((path) => path.slice('package/'.length));
+    // The separately served installer is also part of this release, even if bun excludes it from the tarball.
+    // 빌드 산출물(PWA 정적 export)은 커밋되지 않는 것이 정상이다 — 설치기(`scripts/install.sh`)도 그것을 싣고 «없으면 말한다».
+    //   🩸 09-27 운영 체크아웃 실측: 04:33 설치가 PWA 를 먼저 빌드해 `apps/pwa/out/**` 가 있고, 커밋 검사가 그것을 막았다.
+    //   `src/version/packed-revision.json` 은 `bun pm pack` 의 prepack 훅이 «그 HEAD» 를 새기고 postpack 이 지우는 산출물이다(package.json scripts).
+    const isBuildOutput = (path: string): boolean => path.startsWith('apps/pwa/out/') || path === 'src/version/packed-revision.json';
+    const publishedPaths = [...new Set([...packedPaths, 'scripts/install.sh'])].filter((path) => !isBuildOutput(path));
+    const pwaBuild: 'present' | 'missing' = packedPaths.includes('apps/pwa/out/index.html') ? 'present' : 'missing';
+    const committed = new Set(spawnSyncText('git', ['ls-files', '--cached', '-z'], { cwd: checkout, encoding: 'utf8' }).split('\0').filter(Boolean));
+    const uncommitted = publishedPaths.filter((path) => !committed.has(path));
+    if (uncommitted.length) throw new Error(`packed files not committed at HEAD: ${uncommitted.join(', ')}`);
+    const changed = spawnSync('git', ['diff', '--quiet', 'HEAD', '--', ...publishedPaths], { cwd: checkout, encoding: 'utf8' });
+    if (changed.status !== 0) {
+      if (changed.status === 1) throw new Error('packed files differ from HEAD');
+      throw new Error(`cannot verify packed files against HEAD: ${changed.stderr}`);
+    }
+    // Ignore rules can change what bun packs without themselves appearing in the archive.
+    // ⛔ `--ignored` 를 쓰지 않는다 — 무시된 폴더(node_modules · .elanous-test) 안의 ignore 파일은 묶음에 안 들어가 결과를 못 바꾼다.
+    //   🩸 09-27 운영 체크아웃 실측: `--ignored` 가 node_modules 안 `.npmignore` 28개를 «pack 입력 변경»으로 잡아 늘 실패했다.
+    const packInputs = spawnSync('git', ['status', '--porcelain', '--untracked-files=all', '--', 'package.json', '.npmignore', ':(glob)**/.npmignore', '.gitignore', ':(glob)**/.gitignore'], { cwd: checkout, encoding: 'utf8' });
+    if (packInputs.status !== 0) throw new Error(`cannot verify pack inputs against HEAD: ${packInputs.stderr}`);
+    if (packInputs.stdout.trim()) throw new Error(`pack inputs differ from HEAD: ${packInputs.stdout.trim()}`);
+    renameSync(archive, join(staging, 'elanous.tgz'));
+    const sha256 = createHash('sha256').update(readFileSync(join(staging, 'elanous.tgz'))).digest('hex');
+    writeFileSync(join(staging, 'SHA256SUMS'), `${sha256}  elanous.tgz\n`);
+    writeFileSync(join(staging, 'install.sh'), readFileSync(join(checkout, 'scripts/install.sh')));
+    if (existsSync(target)) {
+      const existing = join(target, 'elanous.tgz');
+      const publishedHash = createHash('sha256').update(readFileSync(existing)).digest('hex');
+      if (readFileSync(join(target, 'SHA256SUMS'), 'utf8') !== `${publishedHash}  elanous.tgz\n` ||
+        !existsSync(join(target, 'install.sh')) ||
+        !readFileSync(join(target, 'install.sh')).equals(readFileSync(join(staging, 'install.sh'))) ||
+        !spawnSync('tar', ['-tzf', existing], { encoding: 'utf8' }).stdout.split('\n').includes('package/scripts/botlab/bot-canary.ts')) {
+        throw new Error(`published version is incomplete or has invalid checksum: ${name}`);
+      }
+      if (sha256 !== publishedHash) throw new Error(`checkout contents differ from published version: ${name}`);
+    } else {
+      renameSync(staging, target);
+    }
+    mkdirSync(join(out, 'latest'), { recursive: true });
+    link = join(out, 'latest', `.download-${process.pid}-${Date.now()}`);
+    symlinkSync(`../download/${name}`, link, 'dir');
+    renameSync(link, join(out, 'latest', 'download'));
+    link = undefined;
+    const versions = readdirSync(download, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && /^v[0-9A-Za-z][0-9A-Za-z._-]*-[0-9a-f]{12}$/.test(entry.name))
+      .map((entry) => ({ name: entry.name, mtime: statSync(join(download, entry.name)).mtimeMs }))
+      .sort((a, b) => b.mtime - a.mtime);
+    const retained = new Set([name, ...versions.filter((version) => version.name !== name).slice(0, keep - 1).map((version) => version.name)]);
+    for (const version of versions) {
+      if (!retained.has(version.name)) rmSync(join(download, version.name), { recursive: true });
+    }
+    return { ok: true, version: pkg.version, commit, sha256, out, pwaBuild };
+  } finally {
+    if (link) rmSync(link, { force: true });
+    rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) {
+  try {
+    const args = process.argv.slice(2);
+    let checkout: string | undefined;
+    let out: string | undefined;
+    let keep = 3;
+    while (args.length) {
+      const flag = args.shift();
+      const value = args.shift();
+      if (!value) throw new Error(`missing value for ${flag}`);
+      if (flag === '--checkout') checkout = value;
+      else if (flag === '--out') out = value;
+      else if (flag === '--keep') keep = Number(value);
+      else throw new Error(`unknown option: ${flag}`);
+    }
+    if (!checkout || !out) throw new Error('usage: bun scripts/publish-internal-dist.ts --checkout <checkout> --out <folder> [--keep 3]');
+    console.log(JSON.stringify(publishInternalDist(checkout, out, keep)));
+  } catch (error) {
+    console.error(String(error));
+    process.exitCode = 1;
+  }
+}

package/scripts/pwa-scenarios.ts

@@ -0,0 +1,106 @@
+#!/usr/bin/env bun
+/**
+ * 1. Start isolated daemon: bun bin/elanous.mjs nexus run --test --tool-cwd <empty-folder>
+ * 2. Run: bun scripts/pwa-scenarios.ts --base-url http://127.0.0.1:31455 --shots ./shots
+ * 3. Stop: bun bin/elanous.mjs nexus run --test --stop
+ * Compare operational daemon PIDs before and after the run; they must remain identical.
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { createCdpPageDriver } from './lib/pwa-scenarios/cdp-driver.js';
+import { runScenarios, summarize, type CellResult, type SaveShot } from './lib/pwa-scenarios/runner.js';
+import { createScenarios, selectScenarios, validateBaseUrl } from './lib/pwa-scenarios/scenarios.js';
+
+interface CliOptions {
+  baseUrl: string;
+  only?: string[];
+  json: boolean;
+  cdpPort?: number;
+  shots?: string;
+  headed: boolean;
+  allowPort: boolean;
+}
+
+function parseArgs(args: readonly string[]): CliOptions {
+  const options: CliOptions = { baseUrl: '', json: false, headed: false, allowPort: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') options.json = true;
+    else if (arg === '--headed') options.headed = true;
+    else if (arg === '--allow-port') options.allowPort = true;
+    else if (['--base-url', '--only', '--cdp-port', '--shots'].includes(arg ?? '')) {
+      const value = args[++i];
+      if (!value || value.startsWith('--')) throw new Error(`${arg} requires a value`);
+      if (arg === '--base-url') options.baseUrl = value;
+      if (arg === '--only') options.only = value.split(',').map((id) => id.trim());
+      if (arg === '--shots') options.shots = value;
+      if (arg === '--cdp-port') {
+        const port = Number(value);
+        if (!/^\d+$/.test(value) || !Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`invalid CDP port: ${value}`);
+        options.cdpPort = port;
+      }
+    } else throw new Error(`unknown option: ${arg}`);
+  }
+  if (!options.baseUrl) throw new Error('--base-url <http://127.0.0.1:PORT> is required');
+  options.baseUrl = validateBaseUrl(options.baseUrl, options.allowPort);
+  if (options.only?.some((id) => !id)) throw new Error('--only requires comma-separated scenario IDs');
+  return options;
+}
+
+async function freeCdpPort(requested?: number): Promise<number> {
+  const server = createServer();
+  try {
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(requested ?? 0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') throw new Error('no free CDP port');
+    return address.port;
+  } finally {
+    if (server.listening) await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}
+
+export function formatCell(result: CellResult): string {
+  return `${result.id} ${result.title} ${result.blocked ? `blocked: ${result.blocked}` : result.pass ? 'pass' : 'fail'} (${result.ms}ms)${result.chipMs === undefined ? '' : ` chipMs=${result.chipMs}ms`}${result.failure ? ` — ${result.failure}` : ''}`;
+}
+
+export async function main(args: readonly string[] = process.argv.slice(2)): Promise<number> {
+  let options: CliOptions;
+  try { options = parseArgs(args); }
+  catch (error) { console.error(error instanceof Error ? error.message : String(error)); return 2; }
+  const all = createScenarios();
+  const { selected, unknown } = selectScenarios(all, options.only);
+  if (unknown.length > 0) { console.error(`unknown scenario ID: ${unknown.join(',')}`); return 2; }
+  let driver: Awaited<ReturnType<typeof createCdpPageDriver>> | undefined;
+  try {
+    const port = await freeCdpPort(options.cdpPort);
+    driver = await createCdpPageDriver(port, options.headed, options.baseUrl);
+    const saveShot: SaveShot | undefined = options.shots ? async (id, image) => {
+      await mkdir(options.shots!, { recursive: true });
+      const path = join(options.shots!, `${id}.png`);
+      await writeFile(path, image);
+      return path;
+    } : undefined;
+    const results = await runScenarios(driver, selected, options.baseUrl, saveShot);
+    const summary = summarize(results, options.baseUrl);
+    if (options.json) console.log(JSON.stringify({ results, summary }));
+    else {
+      for (const result of results) {
+        console.log(formatCell(result));
+        for (const line of result.evidence) console.log(`  ${line}`);
+      }
+      console.log(summary);
+    }
+    return results.some((r) => !r.pass && !r.blocked) ? 1 : 0;
+  } catch (error) {
+    console.error(`pwa-scenarios: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  } finally {
+    await driver?.close();
+  }
+}
+
+if (import.meta.main) process.exitCode = await main();

package/scripts/rebrand-elanous.ts

@@ -9,7 +9,7 @@
 //   monadagent → elanous (패키지 이름) · MONAD → ELANOUS · Monad → Elanous · monad → elanous · 모나드 → 엘라누스
 //   경로(파일·디렉토리 이름)에도 같은 규칙.
 // 보호(안 바꾼다):
-//   - 운영 저장소 식별자 `ElanvitalAI/monad` 와 체크아웃 이름 `monad-agent`(저장소 이름은 별도 결정)
+//   - 운영 저장소 식별자 `ElanvitalAI/elanous` 와 체크아웃 이름 `monad-agent`(저장소 이름은 별도 결정)
 //   - S3 에 실데이터가 있는 접두·버킷(2026-09-26 실측: elanvital-public 4 · openclaw-image-ref 1 · monad-webclone-archive)
 //   ⚠️ AWS Secrets 접두는 보호하지 «않는다» — 이 기계 secrets backend 가 aws 가 아니다(실측) · 영상 폴더는 이행이 옮긴다
 //   - 제3자 이름 `Monad, Inc`(상표 사유를 적은 문서)

package/scripts/red-sweep-diff.ts

@@ -71,7 +71,7 @@ export async function main(argv: readonly string[]): Promise<number> {
   const grown = diffs.filter((d) => d.newRed.length > 0);
   if (argv.includes('--notify') && grown.length > 0) {
     const { sendOutbound } = await import('../src/domains/outbound-alert.js');
-    sendOutbound(`⚠️ **파일별 빨강 스윕 — 새 빨강**\n\n${grown.map(renderDiff).join('\n\n')}`, 'alert');
+    sendOutbound(`⚠️ **파일별 빨강 스윕 — 새 빨강**\n\n${grown.map(renderDiff).join('\n\n')}`, 'ops-alert');
   }
   return diffs.length === 0 ? 2 : 0;
 }

package/scripts/release-loop/auto-approve-node.ts

@@ -0,0 +1,72 @@
+#!/usr/bin/env bun
+import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
+import { emitNodeResult, readGraphContext, type GraphContext } from './node-verdict.js';
+
+export type MetricVerdict = 'pass' | 'fail' | 'unmeasured';
+export interface ApprovalMetric { name: string; value: string; verdict: MetricVerdict }
+
+const outcomeMetric = (name: string, node: Record<string, unknown> | undefined): ApprovalMetric => ({
+  name, value: node?.outcome === undefined ? 'missing' : String(node.outcome),
+  verdict: node?.outcome === undefined ? 'unmeasured' : node.outcome === 'ok' ? 'pass' : 'fail',
+});
+
+export function runAutoApprove(context: GraphContext = readGraphContext(), deps: { instanceRoot?: string; repo?: string; bunVersion?: string } = {}) {
+  const { version } = context.input;
+  const root = deps.instanceRoot ?? effectiveInstanceRoot();
+  const repo = deps.repo ?? resolve(import.meta.dir, '../..');
+  const gate = context.outputs.gate;
+  const prepare = context.outputs.prepare;
+  let pinned: string | undefined;
+  try { pinned = readFileSync(join(repo, '.bun-version'), 'utf8').trim(); } catch { pinned = undefined; }
+  const bunVersion = deps.bunVersion ?? Bun.version;
+  const out = prepare?.out;
+  let distCount: number | undefined;
+  if (prepare?.outcome === 'ok' && typeof out === 'string' && isAbsolute(out)
+    && resolve(out) === join(root, 'release', version, 'prepared')) {
+    try { distCount = readdirSync(join(out, 'dist'), { withFileTypes: true }).filter((entry) => entry.isFile()).length; }
+    catch { distCount = undefined; }
+  }
+  const gateErrorAbsent = gate && !Object.hasOwn(gate, 'error');
+  const metrics: ApprovalMetric[] = [
+    { name: 'gate regressions and measurement', value: JSON.stringify({ outcome: gate?.outcome ?? null, introduced: gate?.introduced ?? null, error: gate?.error ?? null }),
+      verdict: !gate || gate.outcome === undefined || !Array.isArray(gate.introduced) ? 'unmeasured'
+        : gate.outcome === 'ok' && gate.introduced.length === 0 && gateErrorAbsent ? 'pass' : 'fail' },
+    { name: 'bun version', value: `running=${bunVersion}; pinned=${pinned ?? 'missing'}`,
+      verdict: !pinned ? 'unmeasured' : bunVersion === pinned ? 'pass' : 'fail' },
+    outcomeMetric('upgrade', context.outputs.upgrade),
+    outcomeMetric('tui', context.outputs.tui),
+    outcomeMetric('notes-check', context.outputs['notes-check']),
+    { name: 'public leak and prepare completeness', value: `prepare=${prepare?.outcome ?? 'missing'}`,
+      verdict: prepare?.outcome === undefined ? 'unmeasured' : prepare.outcome === 'ok' ? 'pass' : 'fail' },
+    { name: 'docs notes page', value: `docs=${context.outputs.docs?.outcome ?? 'missing'}; notes=${String(context.outputs.docs?.notes ?? 'missing')}`,
+      verdict: context.outputs.docs?.outcome === undefined || context.outputs.docs.notes === undefined ? 'unmeasured'
+        : context.outputs.docs.outcome === 'ok' && typeof context.outputs.docs.notes === 'string' && context.outputs.docs.notes.trim() ? 'pass' : 'fail' },
+    { name: 'installation files', value: `dist files=${distCount ?? 'missing'}; prepare.out=${String(out ?? 'missing')}`,
+      verdict: prepare?.outcome !== 'ok' ? prepare?.outcome === undefined ? 'unmeasured' : 'fail'
+        : distCount === undefined ? 'unmeasured' : distCount === 5 ? 'pass' : 'fail' },
+  ];
+  const outcome = metrics.every((metric) => metric.verdict === 'pass') ? 'ok' as const : 'fail' as const;
+  const report = join(root, 'release', version, 'auto-approval.md');
+  const lines = [`# v${version} auto-approval`, '', `Outcome: ${outcome}`, '', '| # | Metric | Value | Verdict |', '|---|---|---|---|',
+    ...metrics.map((metric, i) => `| ${i + 1} | ${metric.name} | ${metric.value.replaceAll('|', '\\|').replace(/[\r\n]/g, ' ')} | ${metric.verdict} |`),
+    '', '## 되돌리는 법', `gh release edit v${version} --draft`, `git tag -d v${version} && git push origin :refs/tags/v${version}`, '해당 docs PR revert', ''];
+  mkdirSync(dirname(report), { recursive: true });
+  writeFileSync(report, lines.join('\n'));
+  debug.log('release-loop.approve', 'auto-decision', { version, outcome, metrics });
+  return { outcome, verdict: outcome === 'ok' ? 'pass' as const : 'fail' as const, summary: `auto approval ${outcome}: ${metrics.filter((metric) => metric.verdict === 'pass').length}/8`,
+    ...(outcome === 'ok' ? { decidedBy: 'release-loop metrics' as const } : {}), metrics, report };
+}
+
+if (import.meta.main) {
+  try {
+    const result = runAutoApprove();
+    emitNodeResult(result);
+    process.exitCode = result.outcome === 'ok' ? 0 : 1;
+  } catch (error) {
+    emitNodeResult({ outcome: 'fail', verdict: 'fail', summary: `auto approval unmeasured: ${error instanceof Error ? error.message : String(error)}` });
+    process.exitCode = 1;
+  }
+}

package/scripts/release-loop/cutoff.ts

@@ -0,0 +1,139 @@
+#!/usr/bin/env bun
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, realpathSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
+import { buildReleaseManifest, type ReleaseLanding } from '../../src/release-loop/manifest.js';
+import { readReleaseNotes, releaseNotesDir } from '../../src/release-loop/release-note.js';
+import { queryRunningRuns } from '../../src/self-implement/running-runs.js';
+import { loadFederatedRunLedger } from '../../src/self-implement/run-ledger.js';
+
+const SEED = 'c1cc37478';
+const CLI_DOC = 'release/public/docs/cli.md';
+
+function git(args: string[], optional = false): string | null {
+  const result = spawnSync('git', args, { cwd: process.cwd(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (result.status === 0) return result.stdout.trimEnd();
+  if (optional && result.status === 128) return null;
+  throw new Error(`git ${args[0]} failed: ${(result.stderr || result.error || 'unknown error').toString().trim()}`);
+}
+
+function requiredGit(args: string[]): string {
+  return git(args)!;
+}
+
+function versionParts(value: string): number[] | null {
+  if (!/^\d+\.\d+\.\d+$/.test(value)) return null;
+  return value.split('.').map(Number);
+}
+
+function compareVersions(a: number[], b: number[]): number {
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i]! - b[i]!;
+  return 0;
+}
+
+function baselineFor(version: string, cutoff: string, flag?: string): { ref: string; source: 'flag' | 'tag' | 'seed' } {
+  if (flag) return { ref: flag, source: 'flag' };
+  const current = versionParts(version)!;
+  const tags = requiredGit(['tag', '--list', 'v[0-9]*', '--merged', cutoff]).split('\n')
+    .filter((tag) => versionParts(tag.slice(1)) !== null && compareVersions(versionParts(tag.slice(1))!, current) < 0)
+    .sort((a, b) => compareVersions(versionParts(b.slice(1))!, versionParts(a.slice(1))!));
+  return tags.length ? { ref: tags[0]!, source: 'tag' } : { ref: SEED, source: 'seed' };
+}
+
+function commandsAt(sha: string): string[] {
+  const doc = requiredGit(['show', `${sha}:${CLI_DOC}`]);
+  // The generated reference defines public command surfaces at its section headings.
+  return [...doc.matchAll(/^## `((?:elanous)(?: [^`]+))`\s*$/gm)].map((match) => match[1]!);
+}
+
+function landingAt(sha: string, title: string): ReleaseLanding {
+  const changedFiles = requiredGit(['show', '-m', '--first-parent', '--format=', '--name-only', sha]).split('\n').filter(Boolean);
+  const goalPath = changedFiles.find((file) => /^docs\/goals\/[^/]+\.md$/.test(file));
+  const header = goalPath ? git(['show', `${sha}:${goalPath}`], true)?.split(/^##?\s/m, 1)[0] ?? '' : '';
+  const releaseTarget = /^release-target:\s*(next|later)\s*$/m.exec(header)?.[1] as 'next' | 'later' | undefined;
+  const pr = /\s*\(#(\d+)\)$/.exec(title);
+  return {
+    sha, title: pr ? title.slice(0, pr.index) : title,
+    ...(pr ? { prNumber: Number(pr[1]) } : {}), changedFiles,
+    ...(goalPath ? { goalPath } : {}), ...(releaseTarget ? { releaseTarget } : {}),
+  };
+}
+
+function runningGoalPaths(): string[] {
+  const repo = process.cwd();
+  const paths: string[] = [];
+  for (const entry of queryRunningRuns().entries) {
+    if (entry.status !== 'running' && entry.status !== 'probable-running') continue;
+    const start = loadFederatedRunLedger(entry.runId)?.find((row) => row.event === 'start');
+    const goalFile = start?.data.goalFile;
+    if (typeof goalFile !== 'string') continue;
+    const absolute = resolve(repo, goalFile);
+    if (!isAbsolute(goalFile)) {
+      const path = relative(repo, absolute).replaceAll('\\', '/');
+      if (/^docs\/goals\/[^/]+\.md$/.test(path)) paths.push(path);
+      continue;
+    }
+    const worktreeRoot = git(['-C', dirname(absolute), 'rev-parse', '--show-toplevel'], true);
+    if (!worktreeRoot) continue;
+    let path: string;
+    try {
+      path = relative(realpathSync(worktreeRoot), realpathSync(absolute)).replaceAll('\\', '/');
+    } catch {
+      continue;
+    }
+    if (/^docs\/goals\/[^/]+\.md$/.test(path)) paths.push(path);
+  }
+  return paths;
+}
+
+export function main(args: string[] = process.argv.slice(2)): void {
+  let version: string | undefined;
+  let baselineFlag: string | undefined;
+  let cutoffFlag: string | undefined;
+  let json = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') { json = true; continue; }
+    if (arg === '--version' || arg === '--baseline' || arg === '--cutoff') {
+      const value = args[++i];
+      if (!value || value.startsWith('--')) throw new Error(`value required for ${arg}`);
+      if (arg === '--version') version = value;
+      else if (arg === '--baseline') baselineFlag = value;
+      else cutoffFlag = value;
+      continue;
+    }
+    throw new Error(`unknown argument: ${arg}`);
+  }
+  if (!version || !versionParts(version)) throw new Error('usage: bun scripts/release-loop/cutoff.ts --version <x.y.z> [--baseline <ref>] [--cutoff <ref>] [--json]');
+  const cutoff = requiredGit(['rev-parse', '--verify', `${cutoffFlag ?? 'origin/main'}^{commit}`]);
+  const baseline = baselineFor(version, cutoff, baselineFlag);
+  const baselineSha = requiredGit(['rev-parse', '--verify', `${baseline.ref}^{commit}`]);
+  const log = requiredGit(['log', '--first-parent', '--reverse', '--format=%H%x1f%s', `${baselineSha}..${cutoff}`]);
+  const landings = log ? log.split('\n').map((line) => {
+    const [sha, title] = line.split('\x1f');
+    return landingAt(sha!, title!);
+  }) : [];
+  const instanceRoot = effectiveInstanceRoot();
+  const notes = readReleaseNotes(releaseNotesDir(instanceRoot));
+  debug.log('release.notes', 'read', { fragments: notes.size, problems: notes.problems });
+  const manifest = buildReleaseManifest({
+    version, baseline: { ref: baseline.ref, sha: baselineSha }, cutoff: { sha: cutoff }, landings, notes,
+    runningGoalPaths: runningGoalPaths(), publicCommandsBefore: commandsAt(baselineSha), publicCommandsAfter: commandsAt(cutoff),
+  });
+  const output = { ...manifest, baselineSource: baseline.source };
+  const directory = join(instanceRoot, 'release', version);
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(join(directory, 'manifest.json'), JSON.stringify(output, null, 2) + '\n');
+  debug.log('release-loop.cutoff', 'manifest', {
+    version, baselineSource: baseline.source, in: output.in.length, deferred: output.deferred.length, escalate: output.escalate.length,
+  });
+  console.error(`조각 있음 ${landings.filter((landing) => landing.prNumber !== undefined && notes.has(landing.prNumber)).length} / 착지 ${landings.length}`);
+  if (json) console.log(JSON.stringify(output));
+}
+
+if (import.meta.main) {
+  try { main(); }
+  catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+}

package/scripts/release-loop/docs-land-node.ts

@@ -0,0 +1,65 @@
+#!/usr/bin/env bun
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { errorResult, finishNode, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
+
+export function runDocsLand(run: CommandRunner = runCommand) {
+  const context = readGraphContext();
+  const version = context.input.version;
+  if (context.outputs.publish?.outcome !== 'ok') throw new Error('publish must succeed before docs land');
+  if (nodeOutput(context, 'publish', 'tag') !== `v${version}`) throw new Error('published tag/version mismatch');
+  const branch = nodeOutput(context, 'docs', 'branch');
+  if (branch !== `release-docs/${version}`) throw new Error('docs branch/version mismatch');
+  const worktree = nodeOutput(context, 'docs', 'worktree');
+  const scratch = dirname(worktree);
+  if (dirname(scratch) !== tmpdir() || !/^release-docs-[A-Za-z0-9]+$/.test(scratch.split('/').at(-1) ?? '') || worktree !== join(scratch, 'tree')) throw new Error('invalid docs worktree');
+  // 재시도 멱등: 노트가 이미 main 에 있으면(앞 판에서 머지됐고 배포만 실패) 착지를 건너뛰고 배포부터.
+  const before = run('git', ['fetch', 'origin', 'main']);
+  if (before.status !== 0) throw new Error(`docs landing fetch failed: ${before.stderr}`);
+  const alreadyLanded = run('git', ['cat-file', '-e', `origin/main:release/public/docs/releases/${version}.md`]).status === 0;
+  if (!alreadyLanded) {
+    if (!existsSync(worktree)) throw new Error(`docs worktree missing and notes not on main: ${worktree}`);
+    const land = run('bun', ['bin/elanous.mjs', 'pr', 'land', '--cwd', worktree]);
+    if (land.stderr) process.stderr.write(land.stderr);
+    if (land.status === 1) return { outcome: 'fail' as const, verdict: 'fail' as const, summary: `docs land failed: ${land.stderr || land.stdout}` };
+    if (land.status !== 0 || !land.stdout.includes('✓ merge:')) throw new Error(`docs land incomplete (rc=${land.status}): ${land.stderr || land.stdout}`);
+  }
+  const fetch = run('git', ['fetch', 'origin', 'main']);
+  if (fetch.status !== 0) throw new Error(`docs landing fetch failed: ${fetch.stderr}`);
+  const merged = run('git', ['rev-parse', 'origin/main']);
+  if (merged.status !== 0 || !/^[0-9a-f]{40}\s*$/i.test(merged.stdout)) throw new Error(`merged main commit unavailable: ${merged.stderr}`);
+  const deployDir = mkdtempSync(join(tmpdir(), 'release-docs-deploy-'));
+  const deployTree = join(deployDir, 'tree');
+  let added = false;
+  try {
+    const add = run('git', ['worktree', 'add', '--detach', deployTree, merged.stdout.trim()]);
+    if (add.status !== 0) throw new Error(`docs deploy worktree failed: ${add.stderr}`);
+    added = true;
+    const install = run('bun', ['install', '--frozen-lockfile'], deployTree);
+    if (install.status !== 0) throw new Error(`docs deploy install failed: ${install.stderr}`);
+    const deploy = run('bun', ['website/scripts/deploy-pages.ts', '--remote', 'node-b', '--yes'], deployTree);
+    if (deploy.stderr) process.stderr.write(deploy.stderr);
+    if (deploy.status === 1) return { outcome: 'fail' as const, verdict: 'fail' as const, summary: `docs deploy failed: ${deploy.stderr || deploy.stdout}` };
+    if (deploy.status !== 0) throw new Error(`docs deploy incomplete (rc=${deploy.status}): ${deploy.stderr || deploy.stdout}`);
+    if (existsSync(worktree)) {
+      const remove = run('git', ['worktree', 'remove', '--force', worktree]);
+      if (remove.status !== 0) throw new Error(`docs worktree cleanup failed: ${remove.stderr}`);
+    }
+    rmSync(scratch, { recursive: true, force: true });
+    return { outcome: 'ok' as const, verdict: 'pass' as const, summary: `docs landed and deployed v${version}` };
+  } finally {
+    try {
+      if (added) {
+        const remove = run('git', ['worktree', 'remove', '--force', deployTree]);
+        if (remove.status !== 0) throw new Error(`docs deploy cleanup failed: ${remove.stderr}`);
+      }
+    } finally { rmSync(deployDir, { recursive: true, force: true }); }
+  }
+}
+
+if (import.meta.main) {
+  let version = '';
+  try { version = readGraphContext().input.version; process.exitCode = finishNode('docs-land', version, runDocsLand()); }
+  catch (error) { process.exitCode = finishNode('docs-land', version, errorResult(error)); }
+}