elanous 0.2.10 → 0.2.11

package/src/self-implement/gate-scope.ts

@@ -29,6 +29,10 @@
 //      → 유도 결과는 **반드시 존재하는 파일**이어야 한다.
 
 import { importerTestsNotInRunSet, type ImporterTestIndex } from './importer-test-index.js';
+import type { RouteConsumerTestIndex } from './route-consumer-test-index.js';
+
+export const GATE_CALLER_TEST_LIMIT = 30;
+export type GateCallerReason = 'import' | 'route';
 
 /** 테스트 파일 판정(기존 `seams.ts` 정규식과 동일 — 어휘 분기 금지). */
 const TEST_RE = /\.(test|spec)\.[cm]?[tj]sx?$/;
@@ -258,6 +262,10 @@ interface GateScopeDecision {
     readonly truncated: boolean;
     readonly unresolvedRelativeSpecifiers: number;
   } | null;
+  /** Selected reverse-dependent tests and why they were pulled into the gate. */
+  readonly callerTests: readonly { readonly file: string; readonly reasons: readonly GateCallerReason[] }[];
+  /** Caller tests exceeding the cap, retained in full for warning and diagnosis. */
+  readonly callerTestsOverflow: readonly { readonly file: string; readonly reasons: readonly GateCallerReason[] }[];
 }
 
 /**
@@ -274,7 +282,7 @@ export function resolveGateScope(
   changed: readonly string[],
   exists: (path: string) => boolean,
   importerTestIndex?: ImporterTestIndex,
-  opts?: { mode?: GateScopeMode; isDeleted?: (path: string) => boolean },
+  opts?: { mode?: GateScopeMode; isDeleted?: (path: string) => boolean; routeConsumerTestIndex?: RouteConsumerTestIndex },
 ): GateScopeDecision {
   // ⚠️ **실존 검증(리뷰 must-fix 4R)** — `gitChangedFiles` 는 `git diff --name-only HEAD` 라
   //   **삭제·rename 前 경로도 포함**한다. 그걸 그대로 `testArgs` 로 넘기면 필터가 아무것도 매치하지
@@ -328,15 +336,36 @@ export function resolveGateScope(
   const observationFor = (runSet: readonly string[]) => importerTestIndex
     ? importerTestsNotInRunSet(importerTestIndex, userChanged, runSet)
     : null;
-  const base = { sourceFiles, documentPaths, ignoredOutsideSrc, missingTestFiles, elanousRuntimeArtifacts,
+  const conventional = deriveRelatedTests(userChanged, exists);
+  const alreadySelected = new Set([...testFiles, ...conventional]);
+  const callers = new Map<string, Set<GateCallerReason>>();
+  for (const source of userChanged) {
+    for (const [reason, tests] of [
+      ['import', importerTestIndex?.testsBySource.get(source) ?? []],
+      ['route', opts?.routeConsumerTestIndex?.testsBySource.get(source) ?? []],
+    ] as const) {
+      for (const test of tests) {
+        if (!exists(test) || alreadySelected.has(test)) continue;
+        const reasons = callers.get(test) ?? new Set<GateCallerReason>();
+        reasons.add(reason);
+        callers.set(test, reasons);
+      }
+    }
+  }
+  const candidates = [...callers].sort(([a], [b]) => a.localeCompare(b, undefined, { numeric: true }))
+    .map(([file, reasons]) => ({ file, reasons: [...reasons] }));
+  const callerTests = candidates.slice(0, GATE_CALLER_TEST_LIMIT);
+  const callerTestsOverflow = candidates.slice(GATE_CALLER_TEST_LIMIT);
+  const runWithCallers = (tests: readonly string[]) => [...new Set([...tests, ...callerTests.map(({ file }) => file)])];
+  const base = { sourceFiles, documentPaths, ignoredOutsideSrc, missingTestFiles, elanousRuntimeArtifacts, callerTests, callerTestsOverflow,
     unverified: [] as readonly string[], derived: [] as readonly string[], pulledInRelatedTests: [] as readonly string[] };
   const withDocumentNonContribution = (runSet: readonly string[]) => ({
     documentsWithoutDerivedTests: documentsWithoutDerivedTestsFor(runSet),
   });
 
   if (testFiles.length > 0) {
-    const allRelatedTests = deriveRelatedTests(userChanged, exists);
-    const runSet = [...new Set([...testFiles, ...allRelatedTests])];
+    const allRelatedTests = conventional;
+    const runSet = runWithCallers([...testFiles, ...allRelatedTests]);
     // 편집된 테스트만 돌렸다면 빠졌을 것들 — 이 목록이 비어있지 않다는 것은 합집합이 실제로 구제했다는 뜻이다.
     const pulledInRelatedTests = allRelatedTests.filter((f) => !testFiles.includes(f));
     return { ...base, ...withDocumentNonContribution(runSet), testArgs: runSet, unverified: unverifiedFor(runSet), pulledInRelatedTests, importerTestsNotRun: observationFor(runSet), skipTestStep: false, reason: 'changed-tests' };
@@ -348,9 +377,10 @@ export function resolveGateScope(
   if (nonDoc.length === 0) {
     return { ...base, ...withDocumentNonContribution([]), importerTestsNotRun: observationFor([]), skipTestStep: true, reason: 'docs-only' };
   }
-  const derived = deriveRelatedTests(userChanged, exists);
-  if (derived.length > 0) {
-    return { ...base, ...withDocumentNonContribution(derived), derived, testArgs: derived, unverified: unverifiedFor(derived), importerTestsNotRun: observationFor(derived), skipTestStep: false, reason: 'derived' };
+  const derived = conventional;
+  const runSet = runWithCallers(derived);
+  if (runSet.length > 0) {
+    return { ...base, ...withDocumentNonContribution(runSet), derived, testArgs: runSet, unverified: unverifiedFor(runSet), importerTestsNotRun: observationFor(runSet), skipTestStep: false, reason: 'derived' };
   }
   // 실행 집합이 비었으므로 비문서 전부가 미검증이다.
   return { ...base, ...withDocumentNonContribution([]), unverified: unverifiedFor([]), importerTestsNotRun: observationFor([]), skipTestStep: true, reason: 'no-related-tests' };

package/src/self-implement/graph-variant.ts

@@ -0,0 +1,171 @@
+import { createHash } from 'node:crypto';
+import { applyGraphOverlays, type GraphOverlaySpec, type OverlayPatchOp, type OverlayRejection } from './graph-overlay-yaml.js';
+import { edgeMapOf, graphVersionHash, type GraphEdgeSpec, type GraphNodeSpec, type GraphTemplateSpec } from './graph-yaml.js';
+import { inspectPipelineGraph } from './pipeline-shape.js';
+import { hasNodeKind } from '../graph-kinds/registry.js';
+
+/** A proposed change to one existing outcome of a conditional route. Unconditional and fallback edges are protected. */
+export interface GraphVariantRoute {
+  readonly from: string;
+  readonly outcome: string;
+  readonly to: string;
+}
+
+export interface GraphVariantGrowth {
+  readonly node: GraphNodeSpec;
+  readonly from: string;
+  readonly outcome: string;
+  readonly returnTo?: string;
+}
+
+export interface GraphVariantPlan {
+  readonly maxVisits?: Readonly<Record<string, number>>;
+  readonly routes?: readonly GraphVariantRoute[];
+  readonly growth?: GraphVariantGrowth;
+}
+
+export type GraphVariantRejection =
+  | { readonly kind: 'invalid-goal' }
+  | { readonly kind: 'unknown-node'; readonly node: string }
+  | { readonly kind: 'invalid-budget'; readonly node: string; readonly value: number }
+  | { readonly kind: 'protected-edge'; readonly from: string; readonly outcome: string }
+  | { readonly kind: 'unknown-outcome'; readonly from: string; readonly outcome: string }
+  | { readonly kind: 'duplicate-route'; readonly from: string; readonly outcome: string }
+  | { readonly kind: 'ambiguous-outcome'; readonly from: string; readonly outcome: string }
+  | { readonly kind: 'unreachable-terminal'; readonly node: string }
+  | { readonly kind: 'invalid-graph'; readonly defects: ReturnType<typeof inspectPipelineGraph> }
+  | { readonly kind: 'overlay-rejected'; readonly rejections: readonly OverlayRejection[] }
+  | { readonly kind: 'invalid-growth'; readonly reason: string };
+
+export type GraphVariantResult =
+  | { readonly ok: true; readonly overlay: GraphOverlaySpec; readonly template: GraphTemplateSpec; readonly patches: readonly OverlayPatchOp[] }
+  | { readonly ok: false; readonly rejections: readonly GraphVariantRejection[] };
+
+/** Pure, deterministic variant authoring. Never mutates the supplied template and never writes an overlay. */
+export function createGraphVariant(input: {
+  readonly template: GraphTemplateSpec;
+  readonly goal: string;
+  readonly plan: GraphVariantPlan;
+}): GraphVariantResult {
+  const { template, goal, plan } = input;
+  const known = new Set(template.nodes.map((node) => node.nodeId));
+  const rejections: GraphVariantRejection[] = [];
+  if (!/^g_[a-z0-9_-]+$/i.test(goal)) rejections.push({ kind: 'invalid-goal' });
+  if (plan.growth) {
+    const { node, from, outcome, returnTo } = plan.growth;
+    if (!node || typeof node !== 'object') return { ok: false, rejections: [{ kind: 'invalid-growth', reason: 'growth requires one new contracted node' }] };
+    const edgeIndex = template.edges.findIndex((edge) => edge.from === from);
+    const edge = template.edges[edgeIndex];
+    if (!known.has(from) || known.has(node.nodeId) || template.terminalNodes.includes(from) ||
+        typeof node.nodeId !== 'string' || !node.nodeId || typeof node.recipe !== 'string' || !node.recipe ||
+        typeof node.kind !== 'string' || !hasNodeKind('harness', node.kind) || !Number.isSafeInteger(node.maxVisits) || node.maxVisits < 1 ||
+        typeof node.contract?.tools !== 'string' || !node.contract.tools.trim() || !Array.isArray(node.contract.inputs) ||
+        !Array.isArray(node.contract.outputs) || typeof outcome !== 'string' || !outcome || !edge || edge.to !== undefined || edge.on !== 'outcome' ||
+        !edge.map || Object.hasOwn(edge.map, outcome) ||
+        template.edges.filter((candidate) => candidate.from === from).length !== 1 ||
+        typeof returnTo !== 'string' || !known.has(returnTo) || plan.routes?.length || Object.keys(plan.maxVisits ?? {}).length) {
+      rejections.push({ kind: 'invalid-growth', reason: 'growth requires one new contracted node, one missing conditional outcome and an existing return destination' });
+    }
+    if (rejections.length) return { ok: false, rejections };
+    const addedEdge: GraphEdgeSpec = { from: node.nodeId, to: returnTo as string };
+    const patches: OverlayPatchOp[] = [
+      { op: 'add', path: '/nodes/-', value: node },
+      { op: 'add', path: `/edges/${edgeIndex}/map/${outcome.replace(/~/g, '~0').replace(/\//g, '~1')}`, value: node.nodeId },
+      { op: 'add', path: '/edges/-', value: addedEdge },
+    ];
+    const normalized = JSON.stringify({ graph: graphVersionHash(template), goal, patches });
+    const overlay: GraphOverlaySpec = { overlayId: `variant-${createHash('sha256').update(normalized).digest('hex').slice(0, 16)}`,
+      target: template.graphId, stage: 'runtime', appliesWhen: `goal_key == ${goal}`, patch: patches };
+    // Existing YAML runner nodes predate contracts; only the newly proposed node must supply one.
+    const validationTemplate: GraphTemplateSpec = { ...template, nodes: template.nodes.map((existing) => ({
+      ...existing, contract: existing.contract?.tools ? existing.contract : { inputs: [], tools: 'existing', outputs: [] },
+    })) };
+    const applied = applyGraphOverlays(validationTemplate, [overlay]);
+    if (!applied.ok) return { ok: false, rejections: [{ kind: 'overlay-rejected', rejections: applied.rejections }] };
+    const projected: GraphTemplateSpec = { ...applied.template, nodes: [...template.nodes, node] };
+    const edges = edgeMapOf(projected);
+    const reached = new Set<string>();
+    const pending = [projected.entryNode];
+    while (pending.length) {
+      const at = pending.pop()!;
+      if (reached.has(at)) continue;
+      reached.add(at);
+      pending.push(...(edges[at] ?? []));
+    }
+    const unreachable = projected.terminalNodes.filter((terminal) => !reached.has(terminal) || (edges[terminal]?.length ?? 0) !== 0);
+    if (unreachable.length) return { ok: false, rejections: unreachable.map((terminal) => ({ kind: 'unreachable-terminal', node: terminal })) };
+    return { ok: true, overlay, template: projected, patches };
+  }
+  const patches: OverlayPatchOp[] = [];
+
+  for (const [node, value] of Object.entries(plan.maxVisits ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+    if (!known.has(node)) { rejections.push({ kind: 'unknown-node', node }); continue; }
+    if (!Number.isSafeInteger(value) || value < 1) { rejections.push({ kind: 'invalid-budget', node, value }); continue; }
+    const index = template.nodes.findIndex((candidate) => candidate.nodeId === node);
+    if (template.nodes[index]!.maxVisits !== value) patches.push({ op: 'replace', path: `/nodes/${index}/maxVisits`, value });
+  }
+
+  const seen = new Set<string>();
+  for (const route of [...(plan.routes ?? [])].sort((a, b) => {
+    const left = JSON.stringify([a.from, a.outcome, a.to]);
+    const right = JSON.stringify([b.from, b.outcome, b.to]);
+    return left < right ? -1 : left > right ? 1 : 0;
+  })) {
+    if (!known.has(route.from)) { rejections.push({ kind: 'unknown-node', node: route.from }); continue; }
+    if (!known.has(route.to)) { rejections.push({ kind: 'unknown-node', node: route.to }); continue; }
+    const key = JSON.stringify([route.from, route.outcome]);
+    if (seen.has(key)) { rejections.push({ kind: 'duplicate-route', from: route.from, outcome: route.outcome }); continue; }
+    seen.add(key);
+    const matches = template.edges.filter((edge) => edge.from === route.from && edge.map && Object.hasOwn(edge.map, route.outcome));
+    // One patch addresses one edge, so an outcome declared on two conditional edges would validate a graph we do not return.
+    if (matches.length > 1) { rejections.push({ kind: 'ambiguous-outcome', from: route.from, outcome: route.outcome }); continue; }
+    const conditional = matches[0];
+    if (!conditional) {
+      const protectedEdge = template.edges.some((edge) => edge.from === route.from && (edge.to !== undefined || edge.fallback?.length));
+      rejections.push(protectedEdge
+        ? { kind: 'protected-edge', from: route.from, outcome: route.outcome }
+        : { kind: 'unknown-outcome', from: route.from, outcome: route.outcome });
+      continue;
+    }
+    const index = template.edges.indexOf(conditional);
+    if (conditional.map![route.outcome] !== route.to) {
+      // JSON Pointer escaping keeps even unusual, already-declared outcome labels addressable.
+      const label = route.outcome.replace(/~/g, '~0').replace(/\//g, '~1');
+      patches.push({ op: 'replace', path: `/edges/${index}/map/${label}`, value: route.to });
+    }
+  }
+  if (rejections.length > 0) return { ok: false, rejections };
+
+  const projected: GraphTemplateSpec = {
+    ...template,
+    nodes: template.nodes.map((node) => ({ ...node, maxVisits: plan.maxVisits?.[node.nodeId] ?? node.maxVisits })),
+    edges: template.edges.map((edge) => edge.map === undefined ? edge : {
+      ...edge,
+      map: Object.fromEntries(Object.entries(edge.map).map(([outcome, to]) => [outcome,
+        plan.routes?.find((route) => route.from === edge.from && route.outcome === outcome)?.to ?? to])),
+    }),
+  };
+  const edges = edgeMapOf(projected);
+  const defects = inspectPipelineGraph(edges, projected.entryNode);
+  const reached = new Set<string>();
+  const pending = [projected.entryNode];
+  while (pending.length) {
+    const node = pending.pop()!;
+    if (reached.has(node)) continue;
+    reached.add(node);
+    for (const to of edges[node] ?? []) pending.push(to);
+  }
+  const unreachable = projected.terminalNodes.filter((node) => !reached.has(node) || (edges[node]?.length ?? 0) !== 0);
+  if (unreachable.length > 0) return { ok: false, rejections: unreachable.map((node) => ({ kind: 'unreachable-terminal', node })) };
+  if (defects.length > 0) return { ok: false, rejections: [{ kind: 'invalid-graph', defects }] };
+  const normalized = JSON.stringify({ graph: graphVersionHash(template), goal, patches });
+  const overlayId = `variant-${createHash('sha256').update(normalized).digest('hex').slice(0, 16)}`;
+  const overlay: GraphOverlaySpec = { overlayId, target: template.graphId, stage: 'launch', appliesWhen: `goal_key == ${goal}`, patch: patches };
+  // Existing runner YAML nodes may predate contracts; the plan only changes routes and visits.
+  const validationTemplate: GraphTemplateSpec = { ...template, nodes: template.nodes.map((node) => ({
+    ...node, contract: node.contract?.tools ? node.contract : { inputs: [], tools: 'existing', outputs: [] },
+  })) };
+  const applied = applyGraphOverlays(validationTemplate, [overlay]);
+  if (!applied.ok) return { ok: false, rejections: [{ kind: 'overlay-rejected', rejections: applied.rejections }] };
+  return { ok: true, overlay, template: projected, patches };
+}

package/src/self-implement/harness-policy-gates.ts

@@ -28,7 +28,7 @@ export function runHarnessPolicyGates(input: {
     ['mock-module-restore-gate', input.gates?.['mock-module-restore-gate'] ?? runMockModuleRestoreGate],
     ['model-hardcode-gate', input.gates?.['model-hardcode-gate'] ?? runModelHardcodeGate],
     ['daemon-port-gate', input.gates?.['daemon-port-gate'] ?? ((out) => runDaemonPortGate({ log: out.log, error: out.error, cwd: out.cwd, args: [] }))],
-    // LEAK1 — the check release prepare fails on, before the harness lands (0.2.7: a mark in a test title).
+    // LEAK1 — the same pre-export check as pr land; an unmeasured result is a nonzero failure, not a pass.
     ['public-export-leak', input.gates?.['public-export-leak'] ?? runPublicExportLeakGate],
   ];
   const failures: Array<{ gate: GateName; lines: string[] }> = [];

package/src/self-implement/headless-elanous-driver.ts

@@ -58,11 +58,13 @@ import { childRunContextEnv, childProviderKeyEnv, childLlmSelectionEnv, type Chi
 import { childToolProfile } from '../agent/tool-profile.js';
 import { escalationAllowedForProvider } from './rework-policy.js';
 import { getUserConfig, resolveActiveProvider, resolveRoleLlm } from '../user-config.js';
+import { goalDifficultySignals, classifyGoalDifficulty, resolveImplementDifficulty } from '../llm/difficulty.js';
 import { childNestEnv } from '../agent/nest-depth.js';
 import { childPtyIdentityEnv } from '../agent/pty-identity.js';
 import { elanousTuiSpawnOptions } from './elanous-tui-spawn.js';
 import { describeGrokCredentialFreshness, readGrokTokenFreshness, type GrokCredentialFreshnessSnapshot } from '../acp/grok-auth.js';
 import { debug } from '../debug/log.js';
+import { observeExternalEvent } from '../context-bus/external-events.js';
 import { sendOutbound } from '../domains/outbound-alert.js';
 import { formatPtyLinkMessage, readReportOrigin } from './report-origin.js';
 import { DETACHED_PROGRESS_FRAME_PREFIX, decodeDetachedProgressFrame } from '../harness/dispatch-detached.js';
@@ -920,6 +922,8 @@ export interface HeadlessGoalLoopPtyOptions {
   cwd: string;
   /** 이미 featurePrompt() 적용된 프롬프트(범위제한·클린빌드 앵커 포함). */
   featurePrompt: string;
+  /** Original goal document before the execution prompt is decorated. */
+  goalDocument?: string;
   configDir?: string;
   /** ★ K run-identity — 이 실행이 속한 per-run join anchor. 미지정 시 상속(env) → 없으면 canonical mint
    *  (`perCallRunId`). 호출자(runSelfImplement)가 지정하면 **리워크 라운드가 하나의 runId 를 공유**해
@@ -1164,14 +1168,25 @@ export interface HeadlessGoalLoopPtyResult {
   ptyId: string;
 }
 
+export function pickImplementRoleForGoal(document: string): ReturnType<typeof resolveRoleLlm> | undefined {
+  try {
+    const role = resolveRoleLlm('implement');
+    const signals = goalDifficultySignals(document);
+    const level = classifyGoalDifficulty(signals);
+    const picked = resolveImplementDifficulty(role, level);
+    try { debug.log('llm.difficulty', 'pick', { level, tier: picked.tier ?? null, signals }); } catch { /* observation is fail-soft */ }
+    return picked;
+  } catch { return undefined; }
+}
+
 export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions): Promise<HeadlessGoalLoopPtyResult> {
   const childLlm = opts.childLlm;
   if (childLlm && (typeof childLlm.provider !== 'string' || typeof childLlm.model !== 'string' || !childLlm.provider.trim() || !childLlm.model.trim())) {
     throw new Error('childLlm.provider and childLlm.model must both be non-empty');
   }
-  // ⭐ B14 — 역할 `implement` 해석(명시 자식 LLM · 런 단위 모델이 없을 때만). 실패하면 종전(주 모델 상속)으로.
+  // ⭐ B14 — 명시 자식 LLM · 런 단위 모델이 없을 때 골 난이도에 따라 역할 `implement` 기본 등급을 고른다.
   const implementRole = !childLlm && !process.env.ELANOUS_LLM_MODEL?.trim()
-    ? (() => { try { return resolveRoleLlm('implement'); } catch { return undefined; } })()
+    ? pickImplementRoleForGoal(opts.goalDocument ?? opts.featurePrompt)
     : undefined;
   // ⭐ B9 — 승급 판정에 쓸 «유효 provider»: 명시 자식 → 역할 → 런 env → config(auto 는 실제 결정으로).
   const effectiveChildProvider = childLlm?.provider ?? implementRole?.provider ?? process.env.ELANOUS_LLM_PROVIDER?.trim()
@@ -1202,6 +1217,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
   const controlInboxDir = resolveControlInboxDir(space.id);
   const { key: screenKey } = resolveHarnessScreenKey(space.id, opts.cwd);
   const executionId = mintPtyId('self');
+  const contextSource = `elanous://harness/${encodeURIComponent(runId)}/${encodeURIComponent(executionId)}`;
   const boundaryRequestsEnv = harnessBoundaryRequestsEnv(executionId);
   const boundaryResponsesEnv = harnessBoundaryResponsesEnv(executionId);
   const boundaryRequestsPath = boundaryRequestsEnv.ELANOUS_HARNESS_BOUNDARY_REQUESTS ?? '';
@@ -1213,6 +1229,8 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
   const emitDone = (data: Record<string, unknown>): void => {
     if (doneEmitted) return;
     doneEmitted = true;
+    if (spawned) observeExternalEvent({ origin: 'harness-child', kind: 'finished',
+      summary: `Harness child finished: ${String(data.exitReason ?? 'unknown').slice(0, 60)}`, source: contextSource });
     debug.log('self-implement', 'headless.done', {
       ptyId: executionId,
       runId,
@@ -1326,7 +1344,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
       ...(space ? harnessSpaceEnv(space.kind, space.id, runId) : {}),   // 자식 goal-loop 자기인지(#4948 프리앰블) + ★K runId 명시 전파(captured-env 경계)
       ...harnessBoundaryEnv(opts.cwd),   // ★ #4 명시 쓰기 경계 — worktree(cwd) 전파 → 자식 부팅 시 결정론 경계 활성(정본 오염 봉쇄)
       ...(opts.documentReferences?.length ? { ELANOUS_DOCUMENT_REFERENCES: JSON.stringify(opts.documentReferences) } : {}),
-      // ⭐ BACKLOG B14 (대표 2026-09-25) — 명시 자식 LLM 도 런 단위 모델(`ELANOUS_LLM_MODEL`)도 없으면 역할 `implement`(better)로 고른다.
+      // ⭐ B14/E2 — 명시 자식 LLM·런 단위 모델이 없으면 골 난이도를 적용한 구현 역할 모델을 릴레이한다.
       ...childLlmSelectionEnv(childLlm ?? (implementRole ? { provider: implementRole.provider, model: implementRole.model, source: 'config' } : undefined)),
       // 결정 2026-09-23 — 명시 childLlm 은 «같은 provider» 사다리 안에서만 한 칸 승급한다(없으면 승급 안 함).
       //   미지정 경로는 기존 티어(codex sol 등)를 그대로 쓴다.
@@ -1351,6 +1369,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
     },
     });
     spawned = true;
+    observeExternalEvent({ origin: 'harness-child', kind: 'started', summary: 'Harness child started', source: contextSource });
     phase = 'initialization';
   const ptyId = h.id;
   // ⭐⭐ M5 — 그 판정을 «런 슈퍼바이저 레코드»로 올린다. 종전엔 경계 판정이 자기 로그에만 남아

package/src/self-implement/host-regate.ts

@@ -3,6 +3,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
+import { releaseGitDiffPaths, releasePathHold, releasePathHoldShouldPost, releasePathHoldComment, releasePathHoldCommentsArgs, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { detectTestInterference, parseFailureCount, runBunTest } from '../../scripts/detect-test-interference.js';
 import { runTestInterferenceGate } from '../../scripts/ci-test-interference-gate.js';
 
@@ -158,6 +159,26 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
       base = run('git', ['merge-base', baseCommit, input.headCommit], worktree);
       files = run('git', ['diff', '--name-only', base, input.headCommit], worktree).split('\n').filter(Boolean);
       if (!files.length) throw new Error('changed files unavailable');
+      if (!input.verifyOnly) {
+        // --name-only lists only the destination of a rename. Inspect both sides without
+        // changing the gate's existing changed-file list or its test selection.
+        const guardPaths = releaseGitDiffPaths(run('git', ['diff', '--find-renames', '--name-status', '-z', base, input.headCommit], worktree));
+        const heldPath = releasePathHold(guardPaths);
+        if (heldPath) {
+          debug.log('self-dev.merge', 'release-path-hold', { number: input.prNumber, path: heldPath, label: RELEASE_PATH_LABEL, surface: 'host-regate' });
+          try {
+            const existing: unknown = JSON.parse(run('gh', ['label', 'list', '--search', RELEASE_PATH_LABEL, '--json', 'name'], input.repoRoot));
+            if (!Array.isArray(existing)) throw new Error('invalid label list');
+            if (!existing.some((item: unknown) => !!item && typeof item === 'object' && 'name' in item && item.name === RELEASE_PATH_LABEL)) {
+              run('gh', ['label', 'create', RELEASE_PATH_LABEL, '--color', 'D93F0B', '--description', 'Release path requires OP approval'], input.repoRoot);
+            }
+            run('gh', ['pr', 'edit', String(input.prNumber), '--add-label', RELEASE_PATH_LABEL], input.repoRoot);
+          } catch (error) { debug.log('self-dev.merge', 'release-path-annotation-failed', { number: input.prNumber, action: 'label', error: String(error) }); }
+          try { if (releasePathHoldShouldPost(() => JSON.parse(run('gh', releasePathHoldCommentsArgs(input.prNumber), input.repoRoot)))) run('gh', ['pr', 'comment', String(input.prNumber), '--body', releasePathHoldComment(heldPath)], input.repoRoot); }
+          catch (error) { debug.log('self-dev.merge', 'release-path-annotation-failed', { number: input.prNumber, action: 'comment', error: String(error) }); }
+          return result('failed', 'release-path-hold', `OP approval required: ${heldPath}`);
+        }
+      }
       // Materialize the proposed merge of this exact PR head into the observed base.
       // A clean head checkout cannot expose integration breaks introduced by the base.
       try { run('git', ['merge', '--no-ff', '--no-commit', input.headCommit], worktree); }
@@ -234,7 +255,7 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
     try { release?.(); }
     catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'lock', detail: String(e) }); }
-    if (failures.length) {
+    if (failures.length && failures[0]?.step !== 'release-path-hold') {
       const { step, detail } = failures[0]!;
       const body = `호스트 재게이트 실패(${process.platform}): ${step} — ${detail.replace(/\s+/g, ' ').slice(0, 180)}`;
       try { run('gh', ['pr', 'comment', String(input.prNumber), '--body', body], input.repoRoot); }

package/src/self-implement/importer-test-index.ts

@@ -6,6 +6,7 @@ const IMPORTER_TEST_DISPLAY_LIMIT = 20;
 
 export interface ImporterTestIndex {
   readonly testsBySource: ReadonlyMap<string, readonly string[]>;
+  readonly testPaths?: readonly string[];
   readonly unresolvedRelativeSpecifiers: number;
 }
 
@@ -105,7 +106,7 @@ export function buildImporterTestIndex(cwd: string, testPaths: readonly string[]
       testsBySource.set(source, importers);
     }
   }
-  return { testsBySource, unresolvedRelativeSpecifiers };
+  return { testsBySource, testPaths, unresolvedRelativeSpecifiers };
 }
 
 export function importerTestsNotInRunSet(

package/src/self-implement/l8-merge-queue.ts

@@ -0,0 +1,130 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { NEXT_MD_PATH, resolveNextMdConflict } from '../release-loop/next-md-merge.js';
+
+type Command = (bin: string, args: readonly string[], cwd: string) => { status: number | null; stdout: string; stderr: string };
+export type L8MergeQueueInput = { number: number; cwd: string; matchHeadCommit: string };
+export type L8MergeQueueResult = { merged: boolean; baseRefName?: string; mergeCommit?: string; detail?: string };
+export type L8MergeQueueDeps = {
+  command?: Command;
+  /** Must identify the same shared repository across all harness processes. */
+  acquire?: (cwd: string) => Promise<() => void>;
+};
+
+const command: Command = (bin, args, cwd) => {
+  const r = spawnSync(bin, [...args], { cwd, encoding: 'utf8', timeout: 600_000, maxBuffer: 32 * 1024 * 1024 });
+  return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error?.message ?? '') };
+};
+
+/** Serialize the whole read/integrate/test/merge transaction, not just the final push. */
+export async function acquireL8MergeQueue(cwd: string): Promise<() => void> {
+  const git = command('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], cwd);
+  if (git.status !== 0 || !git.stdout.trim()) throw new Error('merge queue common git directory unavailable');
+  const slot = join(git.stdout.trim(), 'elanous-l8-merge-queue');
+  const deadline = Date.now() + 30 * 60_000;
+  for (;;) {
+    try {
+      mkdirSync(slot);
+      try { writeFileSync(join(slot, 'pid'), String(process.pid)); }
+      catch (error) { rmSync(slot, { recursive: true, force: true }); throw new Error(`merge queue pid write failed: ${String(error)}`); }
+      return () => rmSync(slot, { recursive: true, force: true });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      // Fail closed on abandoned slots: never steal a slot while a live merge can own it.
+      if (Date.now() >= deadline) throw new Error('merge queue occupied for 30 minutes');
+      await new Promise((resolve) => setTimeout(resolve, 250));
+    }
+  }
+}
+
+/** One PR per shared git directory, integrated on a freshly fetched main in a disposable worktree. */
+export async function runL8MergeQueue(input: L8MergeQueueInput, deps: L8MergeQueueDeps = {}): Promise<L8MergeQueueResult> {
+  if (!Number.isSafeInteger(input.number) || input.number <= 0 || !/^[0-9a-f]{40}$/i.test(input.matchHeadCommit)) {
+    return { merged: false, detail: 'invalid PR number or pinned head' };
+  }
+  const execute = deps.command ?? command;
+  const run = (bin: string, args: readonly string[], cwd: string): string => {
+    const result = execute(bin, args, cwd);
+    if (result.status !== 0) throw new Error(`${bin} ${args.join(' ')}: ${(result.stderr || result.stdout || `exit ${result.status}`).trim().slice(0, 500)}`);
+    return args.includes('-z') ? result.stdout : result.stdout.trim();
+  };
+  let release: (() => void) | undefined;
+  let temp: string | undefined;
+  let attached = false;
+  try {
+    release = await (deps.acquire ?? acquireL8MergeQueue)(input.cwd);
+    type View = { headRefOid?: string; headRefName?: string; baseRefName?: string; state?: string; isDraft?: boolean; isCrossRepository?: boolean; mergeCommit?: { oid?: string } | null };
+    const view = (): View => JSON.parse(run('gh', ['pr', 'view', String(input.number), '--json', 'headRefOid,headRefName,baseRefName,state,isDraft,isCrossRepository,mergeCommit'], input.cwd));
+    const first = view();
+    if (first.headRefOid !== input.matchHeadCommit || first.baseRefName !== 'main' || first.state !== 'OPEN' || first.isDraft !== false || first.isCrossRepository !== false || !first.headRefName || !/^[\w./-]+$/.test(first.headRefName) || first.headRefName.startsWith('-') || first.headRefName === 'main') {
+      throw new Error('PR head, base, or ready/open state changed');
+    }
+    run('git', ['fetch', 'origin', 'refs/heads/main'], input.cwd);
+    const base = run('git', ['rev-parse', 'FETCH_HEAD'], input.cwd);
+    run('git', ['fetch', 'origin', `refs/pull/${input.number}/head`], input.cwd);
+    if (run('git', ['rev-parse', 'FETCH_HEAD'], input.cwd) !== input.matchHeadCommit) throw new Error('fetched PR head changed');
+    temp = mkdtempSync(join(tmpdir(), 'elanous-l8-'));
+    run('git', ['worktree', 'add', '--detach', temp, input.matchHeadCommit], input.cwd);
+    attached = true;
+    const fork = run('git', ['merge-base', base, input.matchHeadCommit], temp);
+    const paths = run('git', ['diff', '--name-only', '-z', fork, input.matchHeadCommit], temp).split('\0').filter(Boolean);
+    if (!paths.length) throw new Error('PR changed-file paths unavailable');
+    if (paths.some((path) => path.startsWith('-') || path.startsWith('/') || path.split('/').includes('..') || path.includes('\\'))) throw new Error('unsafe PR changed-file path');
+    // Deleted tests are not runnable; a successful diff with no runnable paths is not a failed lookup.
+    const livePaths = run('git', ['diff', '--name-only', '-z', '--diff-filter=ACMRT', fork, input.matchHeadCommit], temp).split('\0').filter(Boolean);
+    const isBunTest = (path: string) => /(?:^|\/)[^/]+\.(?:test|spec)\.(?:[cm]?[jt]sx?)$/.test(path);
+    const tests = livePaths.filter(isBunTest);
+    const merge = execute('git', ['-c', 'user.name=elanous merge queue', '-c', 'user.email=queue@localhost', 'merge', '--no-ff', '--no-edit', base], temp);
+    if (merge.status !== 0) {
+      const unresolved = run('git', ['diff', '--name-only', '--diff-filter=U'], temp).split('\n').filter(Boolean);
+      if (unresolved.length !== 1 || unresolved[0] !== NEXT_MD_PATH) throw new Error(`merge conflicts: ${unresolved.join(', ') || merge.stderr}`);
+      const stage = (n: number): string => {
+        const result = execute('git', ['show', `:${n}:${NEXT_MD_PATH}`], temp!);
+        if (result.status !== 0) throw new Error(`release/next.md stage ${n} unavailable: ${result.stderr}`);
+        return result.stdout;
+      };
+      // Git stage 2 is the PR and stage 3 is main; the resolver preserves stage 2 and unions main's additions.
+      const resolved = resolveNextMdConflict(stage(1), stage(3), stage(2));
+      if (resolved === null) throw new Error('release/next.md conflict is not append-only');
+      writeFileSync(join(temp, NEXT_MD_PATH), resolved);
+      run('git', ['add', '--', NEXT_MD_PATH], temp);
+      run('git', ['-c', 'user.name=elanous merge queue', '-c', 'user.email=queue@localhost', 'commit', '-m', 'Integrate latest main for L8 merge queue'], temp);
+    }
+    if (tests.length) {
+      const unavailable = tests.filter((path) => !existsSync(join(temp!, path)));
+      if (unavailable.length) throw new Error(`changed test paths unavailable: ${unavailable.join(', ')}`);
+      // The disposable checkout must resolve the integrated candidate's lockfile, never the caller's modules.
+      run('bun', ['install', '--frozen-lockfile'], temp);
+      const result = execute('bun', ['test', ...tests], temp);
+      const output = `${result.stdout}\n${result.stderr}`;
+      if (result.status !== 0 || !/\b[1-9]\d* pass\b/.test(output) || !/\b0 fail\b/.test(output) || !/Ran [1-9]\d* tests? across [1-9]\d* files?/.test(output)) throw new Error(`changed tests failed or unmeasured: ${output.slice(-400)}`);
+    }
+    run('git', ['fetch', 'origin', 'refs/heads/main'], input.cwd);
+    if (run('git', ['rev-parse', 'FETCH_HEAD'], input.cwd) !== base) throw new Error('main advanced during queue verification; retry on latest main');
+    const current = view();
+    if (current.headRefOid !== first.headRefOid || current.headRefName !== first.headRefName || current.baseRefName !== 'main' || current.state !== 'OPEN' || current.isDraft !== false || current.isCrossRepository !== false) throw new Error('PR changed during queue verification');
+    const integrated = run('git', ['rev-parse', 'HEAD'], temp);
+    const remoteHead = run('git', ['ls-remote', 'origin', `refs/heads/${first.headRefName}`], temp).split(/\s+/)[0];
+    if (remoteHead !== input.matchHeadCommit) throw new Error('PR branch advanced before queue push');
+    run('git', ['fetch', 'origin', 'refs/heads/main'], input.cwd);
+    if (run('git', ['rev-parse', 'FETCH_HEAD'], input.cwd) !== base) throw new Error('main advanced before queue merge; retry on latest main');
+    // One atomic push (review must-fix: head check and merge were not atomic): the PR branch moves to the tested commit only
+    // while it still equals the pinned head (lease), and main moves to the same commit only as a fast-forward. The server
+    // applies both ref updates or neither, so an advanced PR head or main rejects the whole merge — nothing stale lands.
+    // main then contains the PR head, so GitHub records the PR as merged.
+    run('git', ['push', '--atomic', `--force-with-lease=refs/heads/${first.headRefName}:${input.matchHeadCommit}`, 'origin',
+      `HEAD:refs/heads/${first.headRefName}`, 'HEAD:refs/heads/main'], temp);
+    // The push itself is the merge decision; confirm main holds exactly the tested commit (a later push to the PR branch is a new change, not this merge).
+    run('git', ['fetch', 'origin', 'refs/heads/main'], input.cwd);
+    if (run('git', ['rev-parse', 'FETCH_HEAD'], input.cwd) !== integrated) throw new Error('main does not point to tested merge commit');
+    return { merged: true, baseRefName: 'main', mergeCommit: integrated };
+  } catch (error) {
+    return { merged: false, detail: String(error) };
+  } finally {
+    if (attached && temp) execute('git', ['worktree', 'remove', '--force', temp], input.cwd);
+    if (temp) rmSync(temp, { recursive: true, force: true });
+    release?.();
+  }
+}