elanous 0.2.10 → 0.2.12

package/src/harness/harness-pod-dispatch.ts

@@ -7,8 +7,9 @@
  *    매니페스트가 실은 런 계약(`ELANOUS_RUN_CONTRACT`)으로 자기가 Pod 인 줄 안다(graph-run-contract.ts).
  */
 import { spawn } from 'node:child_process';
-import { readFileSync, realpathSync } from 'node:fs';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { debug } from '../debug/log.js';
 import { ELANOUS_ENTRY_SCRIPT } from '../self-implement/seams.js';
@@ -23,6 +24,8 @@ export interface HarnessPodDispatchInput {
   readonly dispatchRecorded?: boolean;
   /** Pod 메모리 등급(standard|high) — 오케스트레이터 환경 `ELANOUS_POD_MEMORY_TIER` 로 Job 까지 간다. */
   readonly podMemory?: string;
+  /** L7c — Pod queue predecessor (goal ID or PR) — `ELANOUS_POD_AFTER` carries it to every Pod Job admission. */
+  readonly after?: string;
   readonly autoMerge?: boolean;
   readonly base?: string;
   readonly json?: boolean;
@@ -30,16 +33,9 @@ export interface HarnessPodDispatchInput {
   readonly source?: string;
 }
 
-/** 오케스트레이터가 `;;` 로 골을 나누므로 한 골 안의 `;;` 는 풀어 둔다(한 발 = 한 골). */
-export function podGoalText(input: HarnessPodDispatchInput, readFile: (path: string) => string = (p) => readFileSync(p, 'utf8')): string {
-  // 오케스트레이터에는 내용도 보내고, 저장소 안의 ask 는 별도로 Secret 을 통해 Pod 클론에 심는다.
-  const text = input.entrance === 'cli-harness-ask' ? readFile(input.input) : input.input;
-  return text.replace(/;;/gu, '; ;');
-}
-
-export function podOrchestrateArgs(input: HarnessPodDispatchInput, goal: string): string[] {
+export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: string): string[] {
   return [
-    ELANOUS_ENTRY_SCRIPT, 'self', 'orchestrate', goal,
+    ELANOUS_ENTRY_SCRIPT, 'self', 'orchestrate', '--goal-file', goalFile,
     '--substrate', 'pod',
     ...(input.podPool ? ['--pod-pool', input.podPool] : []),
     // 하니스 기본(자동 병합)을 따른다 · 끄면 PR 까지 — 어느 쪽이든 Pod 가 사라져도 결과가 남는다.
@@ -66,13 +62,30 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
       return 2;
     }
   }
-  const goal = podGoalText(input, deps.readFile ?? ((p) => readFileSync(resolve(cwd, p), 'utf8')));
-  const args = podOrchestrateArgs(input, goal);
+  let tempDir: string | undefined;
+  let goalFile: string;
+  let goalChars: number;
+  if (input.entrance === 'cli-harness-ask') {
+    goalFile = resolve(cwd, input.input);
+    goalChars = (deps.readFile ?? ((p) => readFileSync(p, 'utf8')))(goalFile).length;
+  } else {
+    const goal = input.input;
+    const runsDir = selfDevRunsDir();
+    mkdirSync(runsDir, { recursive: true });
+    tempDir = mkdtempSync(join(runsDir, 'pod-goal-'));
+    goalFile = join(tempDir, 'goal.txt');
+    writeFileSync(goalFile, goal, { mode: 0o600 });
+    goalChars = goal.length;
+  }
+  const args = podOrchestrateArgs(input, goalFile);
+  debug.log('harness.substrate', 'goal-file', { entrance: input.entrance, mode: tempDir ? 'temp' : 'path' });
   const env = { ...process.env };
   delete env.ELANOUS_POD_GOAL_DOC;
   delete env.ELANOUS_DISPATCH_RECORDED;
   if (input.dispatchRecorded) env.ELANOUS_DISPATCH_RECORDED = '1';
   if (input.podMemory) env.ELANOUS_POD_MEMORY_TIER = input.podMemory;
+  delete env.ELANOUS_POD_AFTER;
+  if (input.after) env.ELANOUS_POD_AFTER = input.after;
   if (input.entrance === 'cli-harness-ask') {
     const root = findGitDir(cwd)?.root;
     const path = resolve(cwd, input.input);
@@ -84,8 +97,8 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     }
   }
   debug.log('harness.substrate', 'dispatch-pod', {
-    entrance: input.entrance, podPool: input.podPool ?? null, podMemory: input.podMemory ?? null, autoMerge: input.autoMerge !== false,
-    goalChars: goal.length, ...(input.entrance === 'cli-harness-ask' ? { goalPath: input.input } : {}),
+    entrance: input.entrance, podPool: input.podPool ?? null, podMemory: input.podMemory ?? null, after: input.after ?? null, autoMerge: input.autoMerge !== false,
+    goalChars, ...(input.entrance === 'cli-harness-ask' ? { goalPath: input.input } : {}),
   });
   const run = deps.run ?? ((cmd: string, a: readonly string[], childEnv: NodeJS.ProcessEnv) => new Promise<number>((resolveStatus) => {
     const child = (deps.spawnChild ?? spawn)(cmd, [...a], { stdio: deps.onOutput ? ['inherit', 'pipe', 'inherit'] : 'inherit', env: childEnv });
@@ -104,13 +117,20 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     child.once('error', () => { cleanup(); resolveStatus(1); });
     child.once('close', (code, signal) => { cleanup(); resolveStatus(code ?? ((signal ?? forwarded) === 'SIGINT' ? 130 : 143)); });
   }));
-  const status = run(process.execPath, args, env);
-  if (typeof status === 'number' || status === null) {
-    debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status });
-    return status ?? 1;
+  const cleanup = () => { if (tempDir) rmSync(tempDir, { recursive: true, force: true }); };
+  try {
+    const status = run(process.execPath, args, env);
+    if (typeof status === 'number' || status === null) {
+      cleanup();
+      debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status });
+      return status ?? 1;
+    }
+    return status.then((code) => {
+      debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status: code });
+      return code;
+    }).finally(cleanup);
+  } catch (error) {
+    cleanup();
+    throw error;
   }
-  return status.then((code) => {
-    debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status: code });
-    return code;
-  });
 }

package/src/harness/harness-seams.ts

@@ -23,6 +23,7 @@ import { buildReviewSeam, gateEvidenceNote, reviewResultToCritiqueLike, type Gat
 import { buildExecuteProgressJudge } from './execute-progress-judge.js';
 import type { StagedHarnessSeams } from './staged-harness.js';
 import { debug } from '../debug/log.js';
+import { releasePathHold, releasePathHoldComment, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { setEventLoopActivity } from '../debug/event-loop-watchdog.js';
 import { nestInfo } from '../agent/nest-depth.js';
 import { originObservationFields } from '../agent/origin-observation.js';
@@ -721,10 +722,43 @@ export function buildHarnessSeams(deps: HarnessSeamsDeps): StagedHarnessSeams {
         suppressedRiskHits: eligibility?.suppressedRiskHits.length ?? 0,
         ...(declineReasons ? { reasons: declineReasons } : {}),
       });
-      const pr = await deps.seams.openPr({ title, body, head: branch, ...(deps.base ? { base: deps.base } : {}), draft: true, ...(labels ? { labels } : {}), cwd });
-      // ★ 리뷰 반영(#5338) — 라벨 관측은 openPr 성공 후 PR 번호와 함께(생성 실패 시 거짓 운영 증거 방지).
-      if (labels) observe('auto-review-labeled', { branch, number: pr.number, label: AUTO_REVIEW_LABEL });
-      observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: !!labels });
+      const pr = await deps.seams.openPr({ title, body, head: branch, ...(deps.base ? { base: deps.base } : {}), draft: true, cwd });
+      let holdPath: string | undefined;
+      let inspectionError: string | undefined;
+      try {
+        if (!deps.seams.readPrFiles) throw new Error('readPrFiles seam unavailable');
+        const prFiles = await deps.seams.readPrFiles({ number: pr.number, cwd });
+        if (!Array.isArray(prFiles) || !prFiles.every((path) => typeof path === 'string')) throw new Error('invalid PR file list');
+        holdPath = releasePathHold(prFiles);
+      } catch (error) { inspectionError = String(error); }
+      if (holdPath) {
+        const protectedPath = holdPath;
+        const prCwd = cwd;
+        debug.log('self-dev.merge', 'release-path-hold', { number: pr.number, path: protectedPath, label: RELEASE_PATH_LABEL });
+        for (const [action, annotate] of [
+          ['add-label', deps.seams.addPrLabel && (() => deps.seams.addPrLabel!({ number: pr.number, label: RELEASE_PATH_LABEL, cwd: prCwd }))],
+          ['comment', deps.seams.postPrComment && (() => deps.seams.postPrComment!({ number: pr.number, body: releasePathHoldComment(protectedPath), cwd: prCwd }))],
+        ] as const) {
+          if (!annotate) { observe('release-path-annotation-failed', { number: pr.number, action, error: 'annotation seam unavailable' }); continue; }
+          try { await annotate(); } catch (error) { observe('release-path-annotation-failed', { number: pr.number, action, error: String(error) }); }
+        }
+        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-hold' });
+      } else if (inspectionError) {
+        observe('release-path-inspection-failed', { number: pr.number, error: inspectionError });
+        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-inspection-failed' });
+      } else {
+        let autoReviewLabeled = false;
+        if (labels?.includes(AUTO_REVIEW_LABEL)) {
+          if (deps.seams.addPrLabel) {
+            try {
+              await deps.seams.addPrLabel({ number: pr.number, label: AUTO_REVIEW_LABEL, cwd });
+              autoReviewLabeled = true;
+              observe('auto-review-labeled', { branch, number: pr.number, label: AUTO_REVIEW_LABEL });
+            } catch (error) { observe('auto-review-label-failed', { number: pr.number, error: String(error) }); }
+          } else observe('auto-review-label-failed', { number: pr.number, error: 'addPrLabel seam unavailable' });
+        }
+        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: autoReviewLabeled });
+      }
       // B(대표 2026-07-21): post-PR 자율 리뷰 — 리뷰기가 PR 에 커멘트(fail-soft). 게이트가 놓친 품질 블로커 표면화.
       await postPrReview(cwd, pr.number, objective, deps.llmReview, deps.spawnSyncFn ?? spawnSync, deps.goalDocument);
       return { ok: true, ref: pr.url, kind: 'pr' };

package/src/harness/harness-stop.ts

@@ -14,6 +14,7 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
+import { launchBindingRunIds, launchRegistryDir, readLaunchBinding } from './launch-registry.js';
 import { loadRunLedger, resolveFederatedRunLedgerDirectories, runLedgerDir } from '../self-implement/run-ledger.js';
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
@@ -173,6 +174,16 @@ export function readPidRecordFrom(runsDir: string, runId: string): PidRecord | n
   }
 }
 
+/** The launching universe's pid.json when the binding names it, else the binding's own pid — both still pass the start-time check. */
+export function pidRecordFromLaunchBinding(runId: string, registryDir = launchRegistryDir()): PidRecord | null {
+  const binding = readLaunchBinding(runId, registryDir);
+  if (!binding) return null;
+  const fromRunsDir = binding.runsDir ? readPidRecordFrom(binding.runsDir, runId) : null;
+  if (fromRunsDir) return fromRunsDir;
+  debug.log('harness.stop', 'pid-from-launch-binding', { runId, pid: binding.pid });
+  return { pid: binding.pid, startedAt: binding.startedAt, ...(binding.argv0 ? { argv0: binding.argv0 } : {}) };
+}
+
 /** macOS·Linux 공통 — `ps -o lstart=` 는 로컬 시각 문자열(초 단위)이다. */
 export function psProcessStartMs(pid: number): number | null {
   const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5_000 });
@@ -183,7 +194,8 @@ export function psProcessStartMs(pid: number): number | null {
   return Number.isFinite(ms) ? ms : null;
 }
 
-export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {}): HarnessStopDeps {
+export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {}, opts: { launchRegistryDir?: string } = {}): HarnessStopDeps {
+  const registry = opts.launchRegistryDir ?? launchRegistryDir();
   const env = { ...process.env };
   for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
   const kubectl = (args: readonly string[]) => {
@@ -191,12 +203,19 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {})
     return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
   };
   return {
-    readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId),
+    // This universe first; then the host-wide launch binding, so a run launched from another worktree is still found.
+    readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId) ?? pidRecordFromLaunchBinding(runId, registry),
     runIdCandidates: (given) => {
       const ledgerDirs = new Set([runLedgerDir(), ...resolveFederatedRunLedgerDirectories({})]);
-      return stopRunIdCandidates(given, [...ledgerDirs], selfDevRunsDir());
+      const found = new Set(stopRunIdCandidates(given, [...ledgerDirs], selfDevRunsDir()));
+      for (const id of launchBindingRunIds(registry)) if (id.startsWith(given) && FULL_RUN_ID.test(id)) found.add(id);
+      return [...found].sort();
+    },
+    readGoalPath: (runId) => {
+      let fromLedger: string | null = null;
+      try { fromLedger = stopGoalPathFromLedger(runId); } catch { fromLedger = null; }
+      return fromLedger ?? readLaunchBinding(runId, registry)?.goalPath ?? null;
     },
-    readGoalPath: stopGoalPathFromLedger,
     scanProcesses: scanStopProcessTable,
     processStartMs: psProcessStartMs,
     kill: (pid, signal) => { process.kill(pid, signal); },

package/src/harness/launch-registry.ts

@@ -0,0 +1,91 @@
+/** Host-wide run → process binding for `harness stop`, independent of the launching worktree and its universe.
+ *  A run launched from another worktree writes `pid.json` and its ledger under that tree's state dir, so a stop from
+ *  any other tree found «no pid.json · goal path 0» while the launcher was alive (10-03 · 09-29). The binding below lives
+ *  in a per-user directory under the OS temp dir — it only has to outlive the process it names, not a reboot. */
+import { closeSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir, userInfo } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { debug } from '../debug/log.js';
+
+export interface LaunchBinding {
+  readonly pid: number;
+  /** Same approximation as `pid.json` (`Date.now() − uptime`) — compared with `ps` start time before any signal. */
+  readonly startedAt: number;
+  readonly argv0?: string;
+  /** The launching process's working directory (absolute). */
+  readonly cwd: string;
+  /** Absolute goal document path when the launcher was given one (`--goal-file`/`--ask`/`--goal`). */
+  readonly goalPath?: string;
+  /** The `self-dev-runs` directory that holds this run's `pid.json` — tells a stop which universe launched it. */
+  readonly runsDir?: string;
+}
+
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+/** One directory per OS user: `$TMPDIR` is per-user on macOS, `/tmp` is shared on Linux. */
+export function launchRegistryDir(): string {
+  let uid: string;
+  try { uid = String(userInfo().uid); } catch { uid = 'unknown'; }
+  return join(tmpdir(), `elanous-harness-launches-${uid}`);
+}
+
+/** The goal document named in an argv, resolved against `cwd` — the same option set `harness stop` already matches. */
+export function goalPathFromArgv(argv: readonly string[], cwd: string): string | undefined {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]!;
+    let value: string | undefined;
+    for (const flag of ['--goal-file', '--ask', '--goal']) {
+      if (arg === flag) value = argv[i + 1];
+      else if (arg.startsWith(`${flag}=`)) value = arg.slice(flag.length + 1);
+    }
+    if (value?.trim()) return isAbsolute(value) ? resolve(value) : resolve(cwd, value);
+  }
+  return undefined;
+}
+
+export function writeLaunchBinding(runId: string, binding: LaunchBinding, dir = launchRegistryDir()): string | null {
+  if (!RUN_ID.test(runId)) return null;
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, `${runId}.json`);
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    const fd = openSync(temporary, 'wx', 0o600);
+    try { writeFileSync(fd, JSON.stringify(binding)); } finally { closeSync(fd); }
+    renameSync(temporary, path);
+    debug.log('harness.launch-registry', 'bound', { runId, pid: binding.pid, goalPath: binding.goalPath ?? null });
+    return path;
+  } catch (error) {
+    debug.log('harness.launch-registry', 'bind-failed', { runId, error: String(error) }, { level: 'warn' });
+    return null;
+  }
+}
+
+export function readLaunchBinding(runId: string, dir = launchRegistryDir()): LaunchBinding | null {
+  if (!RUN_ID.test(runId)) return null;
+  try {
+    const value = JSON.parse(readFileSync(join(dir, `${runId}.json`), 'utf8')) as Partial<LaunchBinding>;
+    if (!Number.isSafeInteger(value.pid) || (value.pid as number) <= 0 || !Number.isFinite(value.startedAt)) return null;
+    if (typeof value.cwd !== 'string' || !isAbsolute(value.cwd)) return null;
+    return {
+      pid: value.pid as number, startedAt: value.startedAt as number, cwd: value.cwd,
+      ...(typeof value.argv0 === 'string' ? { argv0: value.argv0 } : {}),
+      ...(typeof value.goalPath === 'string' && isAbsolute(value.goalPath) ? { goalPath: value.goalPath } : {}),
+      ...(typeof value.runsDir === 'string' && isAbsolute(value.runsDir) ? { runsDir: value.runsDir } : {}),
+    };
+  } catch { return null; }
+}
+
+export function removeLaunchBinding(runId: string, dir = launchRegistryDir()): void {
+  if (!RUN_ID.test(runId)) return;
+  try { unlinkSync(join(dir, `${runId}.json`)); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') debug.log('harness.launch-registry', 'unbind-failed', { runId, error: String(error) }, { level: 'warn' });
+  }
+}
+
+/** Run IDs with a live-looking binding — used for stop's prefix resolution next to ledgers and `pid.json` names. */
+export function launchBindingRunIds(dir = launchRegistryDir()): string[] {
+  try { return readdirSync(dir).filter((name) => name.endsWith('.json')).map((name) => name.slice(0, -5)).filter((id) => RUN_ID.test(id)); }
+  catch { return []; }
+}

package/src/harness/process-garbage.ts

@@ -12,7 +12,9 @@ export interface GarbageProcess extends Pick<GarbageProcessRow, 'pid' | 'ppid' |
 
 const TEST_PATH = /elanous|repo\.worktrees|self-impl|\.elanous-test|gate-baseline/i;
 const TEST_DAEMON = /(?:^|[\s/])daemon\.ts(?:\s|$)/;
-const TEST_RUNNER = /\bbun\s+test\b|\bgate(?:[-\s]baseline|\b)/i;
+const TEST_RUNNER = /^(?:\S*\/)?bun\s+test(?:\s|$)/i;
+// Only the command itself counts — `bun [run|x] <…gate…>`; goal text later in argv must not (PROC1).
+const GATE_RUNNER = /^(?:\S*\/)?bun\s+(?:(?:run|x)\s+)?\S*gate(?:[-\s]baseline|\b)/i;
 const NEXUS_RUN = /\bnexus\s+run\b/;
 const TEST_MARKER = /\.elanous-test|(?:^|\s)--test(?:\s|$)/;
 
@@ -20,7 +22,7 @@ const TEST_MARKER = /\.elanous-test|(?:^|\s)--test(?:\s|$)/;
 export function isGarbageProcessTarget(command: string): boolean {
   return command.includes('elanous.mjs')
     || (TEST_DAEMON.test(command) && /elanous-nexus-|\.elanous-test/.test(command))
-    || (TEST_RUNNER.test(command) && TEST_PATH.test(command));
+    || ((TEST_RUNNER.test(command) || GATE_RUNNER.test(command)) && TEST_PATH.test(command));
 }
 
 export function classifyGarbage(
@@ -36,7 +38,7 @@ export function classifyGarbage(
     const reason: GarbageProcess['reason'] = TEST_DAEMON.test(row.command)
       && /elanous-nexus-|\.elanous-test/.test(row.command)
       ? 'orphan-test-daemon'
-      : TEST_RUNNER.test(row.command) && TEST_PATH.test(row.command)
+      : (TEST_RUNNER.test(row.command) || GATE_RUNNER.test(row.command)) && TEST_PATH.test(row.command)
         ? 'orphan-test-runner'
         : 'orphan-elanous';
     garbage.push({ pid: row.pid, ppid: row.ppid, elapsedSeconds: row.elapsedSeconds, command: row.command, reason });

package/src/hooks/consult-intake.ts

@@ -0,0 +1,153 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const CONSULT_MAX_BYTES = 8 * 1024;
+export const CONSULT_QUEUE_MAX_AGE_MS = 7 * 24 * 3600_000;
+
+export interface ConsultInput {
+  name: string;
+  org?: string;
+  kind: 'company' | 'personal';
+  interest: 'A' | 'B';
+  contact: string;
+  consent: true;
+}
+
+export interface QueuedConsult { id: string; receivedAt: string; consult: ConsultInput }
+
+const singleLine = (value: string): string => value.trim().replace(/[\r\n\u2028\u2029]+/g, ' ');
+
+/** The Primary accepts optional org and requires nonblank name/contact, kind, interest and explicit consent. */
+export function validateConsult(body: unknown): { ok: true; consult: ConsultInput } | { ok: false; field: string } {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return { ok: false, field: 'body' };
+  const b = body as Record<string, unknown>;
+  if (typeof b.name !== 'string' || !b.name.trim() || b.name.length > 256) return { ok: false, field: 'name' };
+  if (b.org !== undefined && (typeof b.org !== 'string' || !b.org.trim() || b.org.length > 256)) return { ok: false, field: 'org' };
+  if (b.kind !== 'company' && b.kind !== 'personal') return { ok: false, field: 'kind' };
+  if (b.interest !== 'A' && b.interest !== 'B') return { ok: false, field: 'interest' };
+  if (typeof b.contact !== 'string' || !b.contact.trim() || b.contact.length > 512) return { ok: false, field: 'contact' };
+  if (b.consent !== true) return { ok: false, field: 'consent' };
+  return { ok: true, consult: { name: singleLine(b.name), ...(typeof b.org === 'string' ? { org: singleLine(b.org) } : {}),
+    kind: b.kind, interest: b.interest, contact: b.contact.trim(), consent: true } };
+}
+
+/** Sliding windows; neither rejected hits nor invalid submissions consume quota. */
+export class ConsultLimiter {
+  private readonly ips = new Map<string, number[]>();
+  private daily: number[] = [];
+  constructor(private readonly now: () => number = Date.now) {}
+
+  admit(ip: string): number | null {
+    const t = this.now();
+    const hits = (this.ips.get(ip) ?? []).filter(x => t - x < 600_000);
+    this.daily = this.daily.filter(x => t - x < 86_400_000);
+    const wait = hits.length >= 3 ? 600_000 - (t - hits[0]!) :
+      this.daily.length >= 200 ? 86_400_000 - (t - this.daily[0]!) : null;
+    if (wait !== null) { this.ips.set(ip, hits); return Math.max(1, Math.ceil(wait / 1000)); }
+    hits.push(t);
+    this.ips.set(ip, hits);
+    this.daily.push(t);
+    return null;
+  }
+}
+
+/** Atomic JSONL rewrite on every mutation, with a private file and directory. */
+export class ConsultQueue {
+  readonly path: string;
+  constructor(root: string, private readonly log: (event: string, data: Record<string, unknown>) => void = () => {}) {
+    this.path = join(root, 'hooks', 'consult-queue.jsonl');
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+  }
+
+  private read(): QueuedConsult[] {
+    try { return readFileSync(this.path, 'utf8').split('\n').filter(Boolean).map(line => JSON.parse(line) as QueuedConsult); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return []; throw error; }
+  }
+
+  private write(items: QueuedConsult[]): void {
+    const temp = `${this.path}.${randomUUID()}.tmp`;
+    try {
+      const fd = openSync(temp, 'wx', 0o600);
+      try { writeSync(fd, items.map(item => JSON.stringify(item)).join('\n') + (items.length ? '\n' : '')); fsyncSync(fd); }
+      finally { closeSync(fd); }
+      renameSync(temp, this.path);
+    } finally { rmSync(temp, { force: true }); }
+  }
+
+  enqueue(item: QueuedConsult): void { this.write([...this.read(), item]); }
+  entries(now: number = Date.now()): QueuedConsult[] {
+    const items = this.read();
+    const kept = items.filter(item => Number.isFinite(Date.parse(item.receivedAt)) && now - Date.parse(item.receivedAt) <= CONSULT_QUEUE_MAX_AGE_MS);
+    if (kept.length !== items.length) { this.write(kept); this.log('dropped', { expired: items.length - kept.length }); }
+    return kept;
+  }
+  count(): number { return existsSync(this.path) ? this.read().length : 0; }
+  delivered(id: string): void { this.write(this.read().filter(item => item.id !== id)); }
+}
+
+/** Accept only a validated body; responses and logs never contain user-provided values. */
+export async function handleConsultPost(request: Request, deps: {
+  limiter: ConsultLimiter; queue: ConsultQueue; now?: () => number; ip?: string;
+  log?: (event: string, data: Record<string, unknown>) => void; wake?: () => void;
+}): Promise<Response> {
+  const log = deps.log ?? (() => {});
+  const declared = Number(request.headers.get('content-length') ?? '0');
+  if (declared > CONSULT_MAX_BYTES) { log('rejected', { reason: 'too-large' }); return Response.json({ error: 'too-large' }, { status: 413 }); }
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  const reader = request.body?.getReader();
+  try {
+    if (reader) {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > CONSULT_MAX_BYTES) {
+          await reader.cancel().catch(() => {});
+          log('rejected', { reason: 'too-large' });
+          return Response.json({ error: 'too-large' }, { status: 413 });
+        }
+        chunks.push(value);
+      }
+    }
+  } catch {
+    log('rejected', { reason: 'body' });
+    return Response.json({ error: 'invalid', field: 'body' }, { status: 400 });
+  } finally { reader?.releaseLock(); }
+  let body: unknown;
+  try {
+    const raw = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) { raw.set(chunk, offset); offset += chunk.byteLength; }
+    body = JSON.parse(new TextDecoder().decode(raw));
+  }
+  catch { log('rejected', { reason: 'body' }); return Response.json({ error: 'invalid', field: 'body' }, { status: 400 }); }
+  const checked = validateConsult(body);
+  if (!checked.ok) { log('rejected', { reason: checked.field }); return Response.json({ error: 'invalid', field: checked.field }, { status: 400 }); }
+  const ip = deps.ip ?? 'unknown';
+  const wait = deps.limiter.admit(ip);
+  if (wait !== null) {
+    log('rejected', { reason: 'rate-limited' });
+    return Response.json({ error: 'rate-limited', retryAfterSec: wait }, { status: 429, headers: { 'Retry-After': String(wait) } });
+  }
+  const id = randomUUID();
+  try { deps.queue.enqueue({ id, receivedAt: new Date((deps.now ?? Date.now)()).toISOString(), consult: checked.consult }); }
+  catch { log('rejected', { reason: 'queue-unavailable' }); return Response.json({ error: 'queue-unavailable' }, { status: 503 }); }
+  log('received', { queued: true, kind: checked.consult.kind, interest: checked.consult.interest,
+    nameLength: checked.consult.name.length, contactLength: checked.consult.contact.length, orgLength: checked.consult.org?.length ?? 0 });
+  deps.wake?.();
+  return Response.json({ id }, { status: 202 });
+}
+
+/** Forward in arrival order; a failure leaves that item and all following items queued. */
+export async function drainConsults(queue: ConsultQueue, forward: (item: QueuedConsult) => Promise<boolean>, now: number = Date.now()): Promise<{ delivered: number; failed: number }> {
+  let delivered = 0;
+  let failed = 0;
+  for (const item of queue.entries(now)) {
+    let ok = false;
+    try { ok = await forward(item); } catch { ok = false; }
+    if (ok) { queue.delivered(item.id); delivered++; } else { failed++; break; }
+  }
+  return { delivered, failed };
+}

package/src/hooks/dispatch.ts

@@ -0,0 +1,82 @@
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { debug } from '../debug/log.js';
+import { runSeatLoopOnce } from '../seat-loop/seat-loop.js';
+import { getUserConfig } from '../user-config.js';
+import { openMsgStore } from '../msg/msg-store.js';
+import type { EventsConfig } from '../user-config.js';
+import type { QueuedHook } from './queue.js';
+
+export type HookWake = (seat: string) => Promise<unknown>;
+
+// A crashed wake can be reclaimed after the lease expires; a live wake renews it until completion.
+const WAKE_LEASE_MS = 120_000;
+const DEFAULT_SEAT_ROUTES = [
+  { source: 'linear', kind: 'Issue:update', seat: (event: QueuedHook, config: EventsConfig) =>
+    event.task.assigneeId ? config.linearAssignees[event.task.assigneeId] : undefined },
+  { source: 'github', kind: 'pull_request:review_requested', seat: 'TC' },
+  { source: 'github', kind: 'check_run:completed', seat: 'TC' },
+  { source: 'github', kind: 'check_suite:completed', seat: 'TC' },
+] as const;
+
+/** Record a work card and inbox delivery atomically. Wake state: 0 = retryable, 2 = leased, 1 = done, 3 = seat loop off (terminal).
+ *  `events.mode` decides only whether the card is delivered; the wake runs the seat loop under its own `loops.seat` mode.
+ *  So a delivered card with the seat loop off is not retried (the card waits in the inbox), and a shadow loop's wake is
+ *  recorded as `wake_status = 'shadow'` — visible as «not executed», not mistaken for a real run. */
+export async function dispatchHook(event: QueuedHook, root: string, config: EventsConfig,
+  wake: HookWake = seat => runSeatLoopOnce(seat, { root, config: getUserConfig().loops?.seat ?? { mode: 'off' } }),
+  now: () => number = Date.now): Promise<void> {
+  const key = `${event.provider}:${event.eventId}`;
+  const route = config.routes.find(candidate => candidate.source === event.provider && candidate.kind === event.kind);
+  const defaultSeat = DEFAULT_SEAT_ROUTES.find(candidate => candidate.source === event.provider && candidate.kind === event.kind)?.seat;
+  const defaultResolvedSeat = typeof defaultSeat === 'function' ? defaultSeat(event, config) : defaultSeat;
+  if (event.provider === 'linear' && event.kind === 'Issue:update' && !route && !defaultResolvedSeat)
+    throw new Error('Linear issue update assignee is not mapped to a seat');
+  const seat = route?.seat ?? defaultResolvedSeat ?? 'OP';
+  const store = openMsgStore(join(root, 'msg', 'messages.db'));
+  const claim = randomUUID();
+  try {
+    store.db.exec(`CREATE TABLE IF NOT EXISTS hook_work_cards (
+      event_key TEXT PRIMARY KEY, source TEXT NOT NULL, kind TEXT NOT NULL,
+      seat TEXT NOT NULL, loop TEXT NOT NULL, mode TEXT NOT NULL, title TEXT NOT NULL,
+      message_id INTEGER, woken INTEGER NOT NULL DEFAULT 0,
+      wake_claim TEXT, wake_lease_until INTEGER
+    )`);
+    const columns = store.db.query('PRAGMA table_info(hook_work_cards)').all() as Array<{ name: string }>;
+    if (!columns.some(column => column.name === 'wake_claim')) store.db.exec('ALTER TABLE hook_work_cards ADD COLUMN wake_claim TEXT');
+    if (!columns.some(column => column.name === 'wake_lease_until')) store.db.exec('ALTER TABLE hook_work_cards ADD COLUMN wake_lease_until INTEGER');
+    if (!columns.some(column => column.name === 'wake_status')) store.db.exec('ALTER TABLE hook_work_cards ADD COLUMN wake_status TEXT');
+    store.db.transaction(() => {
+      const existing = store.db.query('SELECT event_key FROM hook_work_cards WHERE event_key = ?').get(key);
+      if (existing) return;
+      const live = config.mode === 'on';
+      let messageId: number | null = null;
+      if (live) {
+        const body = `[작업 카드 · ${key} · ${event.kind ?? 'unknown'} · loop: seat] ${event.task.title}\n${event.task.external.url ?? event.task.external.ref}`;
+        messageId = store.append({ from: 'HOOKS', to: seat, kind: 'hook-task', body }).id;
+      }
+      store.db.query(`INSERT INTO hook_work_cards(event_key, source, kind, seat, loop, mode, title, message_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(key, event.provider, event.kind ?? 'unknown', seat, route?.loop ?? 'seat', live ? 'on' : 'shadow', event.task.title, messageId);
+    })();
+    const leaseAt = now();
+    const acquired = store.db.query(`UPDATE hook_work_cards SET woken = 2, wake_claim = ?, wake_lease_until = ?
+      WHERE event_key = ? AND message_id IS NOT NULL
+        AND (woken = 0 OR (woken = 2 AND (wake_lease_until IS NULL OR wake_lease_until <= ?)))`)
+      .run(claim, leaseAt + WAKE_LEASE_MS, key, leaseAt).changes === 1;
+    if (!acquired) return;
+    const renew = () => store.db.query(`UPDATE hook_work_cards SET wake_lease_until = ?
+      WHERE event_key = ? AND woken = 2 AND wake_claim = ?`).run(now() + WAKE_LEASE_MS, key, claim);
+    const heartbeat = setInterval(renew, WAKE_LEASE_MS / 4);
+    try {
+      const result = await wake(seat);
+      const status = result && typeof result === 'object' && 'status' in result && typeof result.status === 'string' ? result.status : 'woken';
+      // Seat loop off is a policy, not a transient failure: keep the card in the inbox and stop retrying.
+      const final = status === 'skipped-off' ? 3 : 1;
+      store.db.query('UPDATE hook_work_cards SET woken = ?, wake_status = ?, wake_claim = NULL, wake_lease_until = NULL WHERE event_key = ? AND woken = 2 AND wake_claim = ?').run(final, status, key, claim);
+      debug.log('hooks.dispatch', 'wake', { key, seat, status, retry: false });
+    } catch (error) {
+      store.db.query('UPDATE hook_work_cards SET woken = 0, wake_claim = NULL, wake_lease_until = NULL WHERE event_key = ? AND woken = 2 AND wake_claim = ?').run(key, claim);
+      throw error;
+    } finally { clearInterval(heartbeat); }
+  } finally { store.close(); }
+}