elanous 0.2.11 → 0.2.12

package/src/graph-runner/runner.ts

@@ -69,7 +69,7 @@ function safeSegment(value: string): string {
   return value;
 }
 
-type CommandRecipe = { command: string; timeout_ms?: number };
+type CommandRecipe = { command: string; dry_run_command?: string; timeout_ms?: number };
 type Recipe = CommandRecipe | { approval: string };
 
 /** 접두 없는 recipe 가 카탈로그 역할이고, 그래프 옆 recipes.yaml 에 같은 키의 `{ command }` 가 있을 때만 cmd 처럼 실행한다. */
@@ -117,10 +117,13 @@ function recipesFor(path: string, recipeSource: string): Record<string, Recipe>
       recipes[id] = { approval: item.approval };
     } else {
       if (typeof item.command !== 'string' || !item.command.trim() ||
-        (item.timeout_ms !== undefined && (!Number.isSafeInteger(item.timeout_ms) || (item.timeout_ms as number) <= 0))) {
+        (item.timeout_ms !== undefined && (!Number.isSafeInteger(item.timeout_ms) || (item.timeout_ms as number) <= 0)) ||
+        (item.dry_run_command !== undefined && (typeof item.dry_run_command !== 'string' || !item.dry_run_command.trim()))) {
         throw new Error(`invalid recipe: ${id}`);
       }
-      recipes[id] = { command: item.command, ...(item.timeout_ms === undefined ? {} : { timeout_ms: item.timeout_ms as number }) };
+      recipes[id] = { command: item.command,
+        ...(item.dry_run_command === undefined ? {} : { dry_run_command: item.dry_run_command as string }),
+        ...(item.timeout_ms === undefined ? {} : { timeout_ms: item.timeout_ms as number }) };
     }
   }
   return recipes;
@@ -590,7 +593,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     let exit: number | null = null;
     let error: string | undefined;
     let output: unknown;
-    if (command && !state.dryRun && !resumingCompleted) {
+    if (command && (!state.dryRun || command.dry_run_command) && !resumingCompleted) {
       const outputs: Record<string, unknown> = Object.create(null);
       // 구조 산출(마지막 JSON 줄)이 있으면 그것을, 없으면 원문을 준다 — 다음 노드가 판단을 «값»으로 받는다.
       for (const previous of state.nodes) outputs[previous.nodeId] = lastJsonObject(previous.output) ?? previous.output ?? null;
@@ -635,9 +638,10 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
         debug.log('graph-runner', 'child-universe-pinned', { graphId, runId, node: current, configDir: env.ELANOUS_CONFIG_DIR, stateDir: env.ELANOUS_STATE_DIR });
       }
       env.ELANOUS_GRAPH_CONTEXT = contextPath;
+      env.ELANOUS_GRAPH_DRY_RUN = state.dryRun ? '1' : '0';
       env.ELANOUS_GRAPH_DIR = dirname(resolve(path));
       const ctx = { arguments: '', artifactsDir: dirname(statePath), outputs: {}, resolvedProvider: undefined, resolvedModel: undefined, toolPolicy: {}, env } as NodeExecContext;
-      const result = await executeBashNode({ id: current, type: 'bash', bash: command.command, ...(command.timeout_ms ? { idle_timeout: command.timeout_ms } : {}) } as BashNode, ctx, { runBash } as WorkflowDeps);
+      const result = await executeBashNode({ id: current, type: 'bash', bash: state.dryRun ? command.dry_run_command! : command.command, ...(command.timeout_ms ? { idle_timeout: command.timeout_ms } : {}) } as BashNode, ctx, { runBash } as WorkflowDeps);
       output = result.output;
       ok = result.ok;
       exit = code;
@@ -654,14 +658,14 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       if (approval && !state.dryRun && !command) {
         output = JSON.stringify({ outcome: ok ? 'approved' : 'rejected', ...(state.pending?.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending?.decidedAt ?? null });
       }
-      state.nodes.push({ nodeId: current, ok, exit, executed: !!command && !state.dryRun, ...((command || approval) && !state.dryRun && output !== undefined ? { output } : {}), ...(error ? { error } : {}),
+      state.nodes.push({ nodeId: current, ok, exit, executed: !!command && (!state.dryRun || !!command.dry_run_command), ...((command || approval) && (!state.dryRun || !!command?.dry_run_command) && output !== undefined ? { output } : {}), ...(error ? { error } : {}),
         ...(approval && state.pending ? { ...(state.pending.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending.decidedAt } : {}) });
     }
     if (approval) {
       delete state.pending;
       delete state.approvalSourceHash;
     }
-    const reported = command && !state.dryRun ? lastJsonObject(resumingCompleted ? completed?.output : output)?.outcome : undefined;
+    const reported = command && (!state.dryRun || command.dry_run_command) ? lastJsonObject(resumingCompleted ? completed?.output : output)?.outcome : undefined;
     const namedOutcome = typeof reported === 'string' ? reported : undefined;
     const seconds = Number(((performance.now() - startedAt) / 1000).toFixed(2));
     console.error(`[graph] ${current} ${ok ? 'ok' : 'fail'} (${seconds.toFixed(2)}s)`);
@@ -709,7 +713,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       }
       persist();
     }
-    current = nextNode(graph.edges, current, state.dryRun ? 'ok' : ok ? 'ok' : 'fail', state.dryRun ? undefined : namedOutcome);
+    current = nextNode(graph.edges, current, state.dryRun && !command?.dry_run_command ? 'ok' : ok ? 'ok' : 'fail', namedOutcome);
     if (current !== undefined) publishInsideEvent({ kind: 'edge', graphId, runId, from: fromNodeId, to: current });
     if (current === undefined) {
       state.status = 'failed';

package/src/harness/harness-cli-command.ts

@@ -24,7 +24,7 @@ import { debug } from '../debug/log.js';
 import { dispatchTask, type DispatchTaskInput, type DispatchTaskDeps } from '../execution-loop/dispatch-task.js';
 import { launchRequestId, preLaunchGate, type PreLaunchGateDeps } from '../execution-loop/launch-gate.js';
 import { PR_LABELS } from '../github/pr-labels.js';
-import { CODEX_PROVIDER, GROK_PROVIDER, decideBudget, readBudgetInputsLive, type BudgetDecision, type BudgetInputs } from '../self-implement/budget-gate.js';
+import { CODEX_PROVIDER, GROK_PROVIDER, decideBudget, decideLaunchBudget, readBudgetInputsLive, type BudgetDecision, type BudgetInputs } from '../self-implement/budget-gate.js';
 import { DEFAULT_FALLBACK_CHAIN } from '../oauth/fallback-chain.js';
 import { installDeliverableVerifyCliCommand, type InstallDeliverableVerifyCliDeps } from './deliverable-verify-cli.js';
 import { getUserConfig } from '../user-config.js';
@@ -338,6 +338,8 @@ function resolveLaunchSubstrate(opts: HarnessSubstrateOpts): ResolvedHarnessSubs
 }
 type PodExit = { status: number | null; signal?: string | null };
 type PodExitReason = 'signal' | 'human-stop' | 'supervisor' | 'no-launch' | 'unknown';
+/** GitHub lists at most this many files for one pull request; a list that reaches it is not provably complete. */
+export const GITHUB_PR_FILES_LIST_CAP = 3000;
 const STOPPING_SUPERVISOR_VERDICTS = new Set(['UNCONVERGEABLE', 'CONTRACT-CONFLICT']);
 // Ledger events that only exist once the child actually ran — any of them rules out «never reached the Pod».
 const LAUNCH_EVIDENCE_EVENTS = new Set(['job-applied', 'pod-child-run', 'reviewed', 'rework-budget', 'pr-opened']);
@@ -578,8 +580,12 @@ const LAUNCH_BUDGET_PROVIDER: Readonly<Record<string, string>> = { 'codex-rotate
 export function harnessLaunchBudgetDecision(
   inputs: BudgetInputs,
   opts: { readonly childLlmProvider?: string; readonly childLlmModel?: string } = {},
-): { readonly decision: BudgetDecision; readonly warning?: string } {
+): { readonly decision: BudgetDecision; readonly warning?: string; readonly unmeasuredProvider?: string } {
   const explicit = opts.childLlmProvider?.trim();
+  const judged = (selected: BudgetInputs) => {
+    const { decision, unmeasuredProvider } = decideLaunchBudget(selected);
+    return { decision, ...(unmeasuredProvider ? { unmeasuredProvider, warning: `budget: ${unmeasuredProvider} usage unmeasured — launching` } : {}) };
+  };
   if (explicit) {
     if (explicit !== CODEX_PROVIDER && explicit !== GROK_PROVIDER) {
       return {
@@ -588,13 +594,14 @@ export function harnessLaunchBudgetDecision(
       };
     }
     const chain = [{ provider: explicit, ...(opts.childLlmModel ? { model: opts.childLlmModel } : {}) }];
-    return { decision: decideBudget({ ...inputs, preference: { ...inputs.preference, chain } }) };
+    return judged({ ...inputs, preference: { ...inputs.preference, chain } });
   }
-  if (inputs.preference.chain.length > 0) return { decision: decideBudget(inputs) };
+  if (inputs.preference.chain.length > 0) return judged(inputs);
   const chain = DEFAULT_FALLBACK_CHAIN.map((step) => ({ provider: LAUNCH_BUDGET_PROVIDER[step] ?? step }));
+  const result = judged({ ...inputs, preference: { ...inputs.preference, chain } });
   return {
-    decision: decideBudget({ ...inputs, preference: { ...inputs.preference, chain } }),
-    warning: `budget: no chain in this universe's config — judged with the code default ${DEFAULT_FALLBACK_CHAIN.join(',')}`,
+    ...result,
+    warning: `budget: no chain in this universe's config — judged with the code default ${DEFAULT_FALLBACK_CHAIN.join(',')}${result.warning ? ` · ${result.warning}` : ''}`,
   };
 }
 
@@ -602,10 +609,13 @@ async function readHarnessLaunchBudget(
   opts: { readonly childLlmProvider?: string; readonly childLlmModel?: string } = {},
 ): Promise<BudgetDecision | 'unknown'> {
   try {
-    const { decision, warning } = harnessLaunchBudgetDecision(await readBudgetInputsLive(), opts);
+    const { decision, warning, unmeasuredProvider } = harnessLaunchBudgetDecision(await readBudgetInputsLive(), opts);
     if (warning) {
       console.error(`⚠️ launch gate: ${warning}`);
-      try { debug.log('execution-loop.launch-gate', 'budget-chain-defaulted', { warning, action: decision.action, provider: decision.provider }); } catch { /* observation is fail-soft */ }
+      try {
+        if (unmeasuredProvider) debug.log('execution-loop.launch-gate', 'budget-unmeasured', { provider: unmeasuredProvider });
+        if (!opts.childLlmProvider?.trim() && warning.includes('code default')) debug.log('execution-loop.launch-gate', 'budget-chain-defaulted', { warning, action: decision.action, provider: decision.provider });
+      } catch { /* observation is fail-soft */ }
     }
     return decision;
   }
@@ -644,8 +654,8 @@ async function dispatchHarnessAskSay(
     }
     goalId ??= launchRequestId(identity);
     // Under bun test with no injected gate deps, skip the live reads (≈5 s of codex rotation + run scans) —
-    // CLI wiring tests time out on them. Gate tests inject deps and still run the gate (0.2.11 gate 10-03).
-    if (process.env.NODE_ENV === 'test' && Object.keys(gate).length === 0) {
+    // CLI wiring tests time out on them. Gate tests inject deps or opt in with ELANOUS_LAUNCH_GATE_LIVE=1.
+    if (process.env.NODE_ENV === 'test' && Object.keys(gate).length === 0 && process.env.ELANOUS_LAUNCH_GATE_LIVE !== '1') {
       try { debug.log('execution-loop.launch-gate', 'skipped-test-env', { goalId }); } catch { /* observation is fail-soft */ }
       await dispatch(resolved);
       return;
@@ -1577,10 +1587,13 @@ type GithubPull = {
   draft: boolean;
   state: 'open' | 'closed';
   head: { ref: string };
+  base?: { ref: string };
   labels: Array<{ name: string }>;
   created_at: string;
   updated_at?: string;
   merged_at: string | null;
+  body?: string | null;
+  merge_commit_sha?: string | null;
 };
 
 type GhExecute = (args: string[]) => string;
@@ -1629,9 +1642,25 @@ export function draftSweepRunStatus(ledgerMatches: readonly RunLedgerMatch[], ru
       ['completed', 'failed', 'cancelled', 'abandoned'].includes(terminal) ? terminal : undefined);
     if (status && status !== 'unknown') statuses.add(status);
   }
+  if (statuses.has('running')) return 'running';
+  if (statuses.has('probable-running')) return 'probable-running';
   return statuses.size === 1 ? [...statuses][0] : undefined;
 }
 
+function currentDraftSweepRunId(matches: readonly RunLedgerMatch[], repository: string, number: number): string | undefined {
+  const owners = matches.flatMap((match) => {
+    const events = match.entries.filter((entry) => entry.event === 'pr-opened' && entry.data.number === number);
+    if (events.length === 0 || events.some((entry) => ledgerPrRepository(entry.data, number) !== repository)) return [];
+    const times = events.map((entry) => Date.parse(entry.timestamp ?? ''));
+    return [{ runId: match.runId, time: times.every(Number.isFinite) ? Math.max(...times) : NaN }];
+  });
+  if (owners.length === 1) return owners[0]!.runId;
+  if (owners.some((owner) => !Number.isFinite(owner.time))) return undefined;
+  owners.sort((a, b) => b.time - a.time);
+  if (owners.length > 1 && owners[0]!.time === owners[1]!.time) return undefined;
+  return owners[0]?.runId;
+}
+
 type DraftSweepGitExecute = (cwd: string, args: string[]) => Pick<ReturnType<typeof runGitCommand>, 'status' | 'stdout' | 'stderr'>;
 
 function githubRemoteRepository(url: string): string | undefined {
@@ -1669,24 +1698,117 @@ export function githubDraftSweepAdapters(execute: GhExecute = executeGh, git: Dr
     if (!cache.has(repository)) cache.set(repository, inventory(repository, state));
     return cache.get(repository)!;
   };
+  // GitHub stops listing a pull request's files at 3,000, and the cut looks like a normal last page.
+  // A list that reaches the cap cannot prove it is complete, so it is reported as unknown (undefined):
+  // a draft without a provable file list never qualifies for the all-files-landed close.
+  const filesFor = (repository: string, number: number): string[] | undefined => {
+    const files: string[] = [];
+    for (let page = 1; page <= 100; page++) {
+      const batch = ghJson<Array<{ filename: string }>>(['api', `repos/${repository}/pulls/${number}/files?per_page=100&page=${page}`], execute);
+      if (!Array.isArray(batch) || batch.length > 100 || batch.some((file) => typeof file.filename !== 'string')) throw new Error('Incomplete PR file inventory');
+      files.push(...batch.map((file) => file.filename));
+      if (files.length >= GITHUB_PR_FILES_LIST_CAP) {
+        debug.log('drafts.cleanup', 'file-inventory-capped', { number, listed: files.length });
+        return undefined;
+      }
+      if (batch.length < 100) return files;
+    }
+    throw new Error('PR file inventory exceeded pagination limit');
+  };
+  const latestFileChangesFor = (draft: SweepDraft, repository: string): Record<string, string> | undefined => {
+    if (!draft.changedFiles?.length) return undefined;
+    const changes: Record<string, string> = {};
+    for (let page = 1; page <= 100; page++) {
+      const batch = ghJson<Array<{ sha: string; commit: { committer: { date: string } } }>>(
+        ['api', `repos/${repository}/pulls/${draft.number}/commits?per_page=100&page=${page}`], execute);
+      if (!Array.isArray(batch) || batch.length > 100) throw new Error('Incomplete draft commit inventory');
+      for (const commit of batch) {
+        const changedAt = commit.commit?.committer?.date;
+        if (!commit.sha || !changedAt || !Number.isFinite(Date.parse(changedAt))) return undefined;
+        const detail = ghJson<{ files?: Array<{ filename: string; previous_filename?: string }> }>(
+          ['api', `repos/${repository}/commits/${commit.sha}?per_page=100`], execute);
+        // GitHub truncates very large commit file lists; never infer coverage from a partial list.
+        if (!Array.isArray(detail.files) || detail.files.length >= 100) return undefined;
+        for (const file of detail.files) {
+          for (const name of [file.filename, file.previous_filename]) {
+            if (!name || !draft.changedFiles.includes(name)) continue;
+            if (!changes[name] || Date.parse(changes[name]) < Date.parse(changedAt)) changes[name] = changedAt;
+          }
+        }
+      }
+      if (batch.length < 100) return draft.changedFiles.every((file) => changes[file]) ? changes : undefined;
+    }
+    return undefined;
+  };
+  const landingCommentsFor = (repository: string, number: number): string[] => {
+    const comments: string[] = [];
+    for (let page = 1; page <= 100; page++) {
+      const batch = ghJson<Array<{ body?: string }>>(['api', `repos/${repository}/issues/${number}/comments?per_page=100&page=${page}`], execute);
+      if (!Array.isArray(batch) || batch.length > 100) throw new Error('Incomplete landing comment inventory');
+      comments.push(...batch.filter((comment) => /\blanding-verified\b/i.test(comment.body ?? '')).map((comment) => comment.body!));
+      if (batch.length < 100) return comments;
+    }
+    throw new Error('Landing comment inventory exceeded pagination limit');
+  };
   let ledgerMatches: readonly RunLedgerMatch[] | undefined;
   let running: ReadonlyMap<string, string> | undefined;
-  const runStatusFor = (repository: string, number: number): string | undefined => {
+  const runStatusFor = (draft: SweepDraft, repository: string): string | undefined => {
     ledgerMatches ??= listRunLedgers().matches;
     running ??= new Map(queryRunningRuns().entries.map((entry) => [entry.runId, entry.status]));
-    return draftSweepRunStatus(ledgerMatches, running, repository, number);
+    if (draft.runId) {
+      const match = ledgerMatches.find((entry) => entry.runId === draft.runId);
+      return match ? draftSweepRunStatus([match], running, repository, draft.number) : undefined;
+    }
+    return draftSweepRunStatus(ledgerMatches, running, repository, draft.number);
   };
   return {
     listDrafts: async (page, perPage, repository): Promise<SweepDraft[]> =>
       (await listed(open, repository, 'open')).filter((pr) => pr.draft)
         .slice((page - 1) * perPage, page * perPage)
         .map((pr) => ({ number: pr.number, title: pr.title, branch: pr.head.ref,
-          labels: pr.labels.map((item) => item.name), createdAt: pr.created_at, ...(pr.updated_at ? { updatedAt: pr.updated_at } : {}) })),
+          labels: pr.labels.map((item) => item.name), createdAt: pr.created_at, body: pr.body ?? undefined,
+          changedFiles: filesFor(repository, pr.number), ...(pr.updated_at ? { updatedAt: pr.updated_at } : {}),
+          runId: currentDraftSweepRunId(ledgerMatches ??= listRunLedgers().matches, repository, pr.number) })),
     listMerged: async (page, perPage, repository): Promise<SweepMergedPr[]> =>
-      (await listed(closed, repository, 'closed')).filter((pr) => pr.merged_at !== null)
+      (await listed(closed, repository, 'closed')).filter((pr) => pr.merged_at !== null && pr.base?.ref === 'main')
         .slice((page - 1) * perPage, page * perPage)
-        .map((pr) => ({ number: pr.number, title: pr.title, branch: pr.head.ref })),
-    getRunStatus: async (draft, repository) => runStatusFor(repository, draft.number),
+        .map((pr) => ({ number: pr.number, title: pr.title, branch: pr.head.ref, body: pr.body ?? undefined,
+          mergedAt: pr.merged_at ?? undefined, changedFiles: filesFor(repository, pr.number),
+          mergeCommitMessage: pr.merge_commit_sha ? ghJson<{ commit: { message: string } }>(
+            ['api', `repos/${repository}/commits/${pr.merge_commit_sha}`], execute).commit.message : undefined,
+          landingVerifiedComments: landingCommentsFor(repository, pr.number) })),
+    getRunStatus: async (draft, repository) => runStatusFor(draft, repository),
+    getLatestFileChanges: async (draft, repository) => latestFileChangesFor(draft, repository),
+    hasFinalRunResult: async (draft, repository) => {
+      ledgerMatches ??= listRunLedgers().matches;
+      const ownedRuns = new Set(ledgerMatches.filter((match) => {
+        const prEvents = match.entries.filter((entry) => entry.event === 'pr-opened' && entry.data.number === draft.number);
+        return prEvents.length > 0 && prEvents.every((entry) => ledgerPrRepository(entry.data, draft.number) === repository);
+      }).map((match) => match.runId));
+      if (ownedRuns.size === 0) return false;
+      // A previous owner's final does not establish finality for a later owner of this PR.
+      if (draft.runId && !ownedRuns.has(draft.runId)) return false;
+      if (!draft.runId && ownedRuns.size > 1) return false;
+      const currentOwners = draft.runId ? new Set([draft.runId]) : ownedRuns;
+      const path = logsDbPath();
+      if (!existsSync(path)) return false;
+      const store = LogStore.openReadOnly(path);
+      try {
+        let beforeId: number | undefined;
+        for (;;) {
+          const rows = store.query({ exactCategories: ['self-implement.result'], events: ['final'], grep: String(draft.number),
+            limit: 1_000, ...(beforeId === undefined ? {} : { beforeId }) });
+          for (const row of rows) {
+            try {
+              const data = JSON.parse(row.data ?? '{}') as { runId?: string; prNumber?: number };
+              if (data.prNumber === draft.number && data.runId && currentOwners.has(data.runId)) return true;
+            } catch { /* A malformed result cannot establish finality. */ }
+          }
+          if (rows.length < 1_000) return false;
+          beforeId = rows.at(-1)!.id;
+        }
+      } finally { store.close(); }
+    },
     listLiveBranches: async (repository) => {
       const cwd = process.cwd();
       const remote = git(cwd, ['config', '--get', 'remote.origin.url']);

package/src/hooks/consult-intake.ts

@@ -0,0 +1,153 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const CONSULT_MAX_BYTES = 8 * 1024;
+export const CONSULT_QUEUE_MAX_AGE_MS = 7 * 24 * 3600_000;
+
+export interface ConsultInput {
+  name: string;
+  org?: string;
+  kind: 'company' | 'personal';
+  interest: 'A' | 'B';
+  contact: string;
+  consent: true;
+}
+
+export interface QueuedConsult { id: string; receivedAt: string; consult: ConsultInput }
+
+const singleLine = (value: string): string => value.trim().replace(/[\r\n\u2028\u2029]+/g, ' ');
+
+/** The Primary accepts optional org and requires nonblank name/contact, kind, interest and explicit consent. */
+export function validateConsult(body: unknown): { ok: true; consult: ConsultInput } | { ok: false; field: string } {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return { ok: false, field: 'body' };
+  const b = body as Record<string, unknown>;
+  if (typeof b.name !== 'string' || !b.name.trim() || b.name.length > 256) return { ok: false, field: 'name' };
+  if (b.org !== undefined && (typeof b.org !== 'string' || !b.org.trim() || b.org.length > 256)) return { ok: false, field: 'org' };
+  if (b.kind !== 'company' && b.kind !== 'personal') return { ok: false, field: 'kind' };
+  if (b.interest !== 'A' && b.interest !== 'B') return { ok: false, field: 'interest' };
+  if (typeof b.contact !== 'string' || !b.contact.trim() || b.contact.length > 512) return { ok: false, field: 'contact' };
+  if (b.consent !== true) return { ok: false, field: 'consent' };
+  return { ok: true, consult: { name: singleLine(b.name), ...(typeof b.org === 'string' ? { org: singleLine(b.org) } : {}),
+    kind: b.kind, interest: b.interest, contact: b.contact.trim(), consent: true } };
+}
+
+/** Sliding windows; neither rejected hits nor invalid submissions consume quota. */
+export class ConsultLimiter {
+  private readonly ips = new Map<string, number[]>();
+  private daily: number[] = [];
+  constructor(private readonly now: () => number = Date.now) {}
+
+  admit(ip: string): number | null {
+    const t = this.now();
+    const hits = (this.ips.get(ip) ?? []).filter(x => t - x < 600_000);
+    this.daily = this.daily.filter(x => t - x < 86_400_000);
+    const wait = hits.length >= 3 ? 600_000 - (t - hits[0]!) :
+      this.daily.length >= 200 ? 86_400_000 - (t - this.daily[0]!) : null;
+    if (wait !== null) { this.ips.set(ip, hits); return Math.max(1, Math.ceil(wait / 1000)); }
+    hits.push(t);
+    this.ips.set(ip, hits);
+    this.daily.push(t);
+    return null;
+  }
+}
+
+/** Atomic JSONL rewrite on every mutation, with a private file and directory. */
+export class ConsultQueue {
+  readonly path: string;
+  constructor(root: string, private readonly log: (event: string, data: Record<string, unknown>) => void = () => {}) {
+    this.path = join(root, 'hooks', 'consult-queue.jsonl');
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+  }
+
+  private read(): QueuedConsult[] {
+    try { return readFileSync(this.path, 'utf8').split('\n').filter(Boolean).map(line => JSON.parse(line) as QueuedConsult); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return []; throw error; }
+  }
+
+  private write(items: QueuedConsult[]): void {
+    const temp = `${this.path}.${randomUUID()}.tmp`;
+    try {
+      const fd = openSync(temp, 'wx', 0o600);
+      try { writeSync(fd, items.map(item => JSON.stringify(item)).join('\n') + (items.length ? '\n' : '')); fsyncSync(fd); }
+      finally { closeSync(fd); }
+      renameSync(temp, this.path);
+    } finally { rmSync(temp, { force: true }); }
+  }
+
+  enqueue(item: QueuedConsult): void { this.write([...this.read(), item]); }
+  entries(now: number = Date.now()): QueuedConsult[] {
+    const items = this.read();
+    const kept = items.filter(item => Number.isFinite(Date.parse(item.receivedAt)) && now - Date.parse(item.receivedAt) <= CONSULT_QUEUE_MAX_AGE_MS);
+    if (kept.length !== items.length) { this.write(kept); this.log('dropped', { expired: items.length - kept.length }); }
+    return kept;
+  }
+  count(): number { return existsSync(this.path) ? this.read().length : 0; }
+  delivered(id: string): void { this.write(this.read().filter(item => item.id !== id)); }
+}
+
+/** Accept only a validated body; responses and logs never contain user-provided values. */
+export async function handleConsultPost(request: Request, deps: {
+  limiter: ConsultLimiter; queue: ConsultQueue; now?: () => number; ip?: string;
+  log?: (event: string, data: Record<string, unknown>) => void; wake?: () => void;
+}): Promise<Response> {
+  const log = deps.log ?? (() => {});
+  const declared = Number(request.headers.get('content-length') ?? '0');
+  if (declared > CONSULT_MAX_BYTES) { log('rejected', { reason: 'too-large' }); return Response.json({ error: 'too-large' }, { status: 413 }); }
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  const reader = request.body?.getReader();
+  try {
+    if (reader) {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > CONSULT_MAX_BYTES) {
+          await reader.cancel().catch(() => {});
+          log('rejected', { reason: 'too-large' });
+          return Response.json({ error: 'too-large' }, { status: 413 });
+        }
+        chunks.push(value);
+      }
+    }
+  } catch {
+    log('rejected', { reason: 'body' });
+    return Response.json({ error: 'invalid', field: 'body' }, { status: 400 });
+  } finally { reader?.releaseLock(); }
+  let body: unknown;
+  try {
+    const raw = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) { raw.set(chunk, offset); offset += chunk.byteLength; }
+    body = JSON.parse(new TextDecoder().decode(raw));
+  }
+  catch { log('rejected', { reason: 'body' }); return Response.json({ error: 'invalid', field: 'body' }, { status: 400 }); }
+  const checked = validateConsult(body);
+  if (!checked.ok) { log('rejected', { reason: checked.field }); return Response.json({ error: 'invalid', field: checked.field }, { status: 400 }); }
+  const ip = deps.ip ?? 'unknown';
+  const wait = deps.limiter.admit(ip);
+  if (wait !== null) {
+    log('rejected', { reason: 'rate-limited' });
+    return Response.json({ error: 'rate-limited', retryAfterSec: wait }, { status: 429, headers: { 'Retry-After': String(wait) } });
+  }
+  const id = randomUUID();
+  try { deps.queue.enqueue({ id, receivedAt: new Date((deps.now ?? Date.now)()).toISOString(), consult: checked.consult }); }
+  catch { log('rejected', { reason: 'queue-unavailable' }); return Response.json({ error: 'queue-unavailable' }, { status: 503 }); }
+  log('received', { queued: true, kind: checked.consult.kind, interest: checked.consult.interest,
+    nameLength: checked.consult.name.length, contactLength: checked.consult.contact.length, orgLength: checked.consult.org?.length ?? 0 });
+  deps.wake?.();
+  return Response.json({ id }, { status: 202 });
+}
+
+/** Forward in arrival order; a failure leaves that item and all following items queued. */
+export async function drainConsults(queue: ConsultQueue, forward: (item: QueuedConsult) => Promise<boolean>, now: number = Date.now()): Promise<{ delivered: number; failed: number }> {
+  let delivered = 0;
+  let failed = 0;
+  for (const item of queue.entries(now)) {
+    let ok = false;
+    try { ok = await forward(item); } catch { ok = false; }
+    if (ok) { queue.delivered(item.id); delivered++; } else { failed++; break; }
+  }
+  return { delivered, failed };
+}

package/src/hooks/receiver.ts

@@ -7,6 +7,7 @@ import { HookQueue, type QueuedHook } from './queue.js';
 import { recordGithubShadow } from './github-shadow.js';
 import { toExternalTask, verifyWebhook, type HookProvider } from './providers.js';
 import { drainReports, handleReportPost, ReportLimiter, ReportQueue, type ReceivedReport } from './error-report.js';
+import { ConsultLimiter, ConsultQueue, drainConsults, handleConsultPost, type QueuedConsult } from './consult-intake.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 
 export interface HookSecrets {
@@ -27,6 +28,11 @@ export interface HookReceiverOptions {
   wakeSeat?: HookWake;
   /** ER2 — forward one queued error report to the Primary; default = POST /v1/reports/ingest over the tailnet. */
   forwardReport?: (item: ReceivedReport) => Promise<boolean>;
+  /** CS1 — forward a queued consultation to the Primary's consult ledger. */
+  forwardConsult?: (item: QueuedConsult) => Promise<boolean>;
+  /** CS1 — the public consult route is a write path from the open internet, so it stays closed (404) until
+   *  `hooks.consult.enabled === true` in user config (대표 decision D-20261003-09). Tests pass it directly. */
+  consultEnabled?: boolean;
   /** GET-only public metadata lookup; failure forces human review. */
   githubFetch?: typeof fetch;
 }
@@ -53,11 +59,66 @@ async function forwardReportToPrimary(item: ReceivedReport): Promise<boolean> {
   return response.ok;
 }
 
+async function forwardConsultToPrimary(item: QueuedConsult): Promise<boolean> {
+  const config = JSON.parse(readFileSync(userConfigPath(), 'utf8')) as { hooks?: { primaryTokenRef?: string; primaryUrl?: unknown } };
+  const ref = config.hooks?.primaryTokenRef;
+  if (!ref) throw new Error('primary token reference missing');
+  const token = await getSecretAsync(ref);
+  if (!token) throw new Error('primary token missing');
+  const response = await fetch(new URL('/v1/consult-requests', hooksPrimaryUrl(config)), {
+    method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+    body: JSON.stringify(item.consult), signal: AbortSignal.timeout(10_000),
+  });
+  return response.ok;
+}
+
+/** Raw read like the report forwarder: only an explicit `hooks.consult.enabled: true` opens the route. */
+function consultRouteEnabled(): boolean {
+  try {
+    const config = JSON.parse(readFileSync(userConfigPath(), 'utf8')) as { hooks?: { consult?: { enabled?: unknown } } };
+    return config.hooks?.consult?.enabled === true;
+  } catch {
+    return false;
+  }
+}
+
+function consultOrigin(origin: string | null): string | null {
+  if (!origin) return null;
+  try {
+    const url = new URL(origin);
+    if (url.protocol !== 'https:' || url.origin !== origin) return null;
+    return url.hostname === 'elanous.ai' || url.hostname === 'www.elanous.ai' ||
+      /^[a-z0-9-]+\.vercel\.app$/i.test(url.hostname) ? origin : null;
+  } catch { return null; }
+}
+
 export function startHookReceiver(options: HookReceiverOptions): { url: string; stop: () => void; queue: HookQueue } {
   const queue = new HookQueue(options.root);
   const reportQueue = new ReportQueue(options.root ?? effectiveInstanceRoot(), (event, data) => debug.log('hooks.reports', event, data));
   const reportLimiter = new ReportLimiter(options.now ?? Date.now);
   const forwardReport = options.forwardReport ?? forwardReportToPrimary;
+  const consultEnabled = options.consultEnabled ?? consultRouteEnabled();
+  debug.log('hooks.consult', consultEnabled ? 'route-open' : 'route-closed', {});
+  const consultQueue = new ConsultQueue(options.root ?? effectiveInstanceRoot(), (_event, data) =>
+    debug.log('hooks.consult', 'rejected', { reason: 'expired', ...data }));
+  const consultLimiter = new ConsultLimiter(options.now ?? Date.now);
+  const forwardConsult = options.forwardConsult ?? forwardConsultToPrimary;
+  let consultFailures = 0;
+  let consultNextAt = 0;
+  let consultsDraining = false;
+  async function drainConsultQueue(): Promise<void> {
+    if (stopped || consultsDraining || Date.now() < consultNextAt) return;
+    consultsDraining = true;
+    try {
+      const result = await drainConsults(consultQueue, forwardConsult, (options.now ?? Date.now)());
+      if (result.delivered) debug.log('hooks.consult', 'forwarded', { queued: consultQueue.count(), delivered: result.delivered });
+      if (result.failed) {
+        consultFailures++;
+        consultNextAt = Date.now() + Math.min(300_000, Math.max(1, options.retryBaseMs ?? 1000) * 2 ** Math.min(consultFailures - 1, 20));
+        debug.log('hooks.consult', 'forward-failed', { queued: consultQueue.count(), reason: 'delivery-failed' });
+      } else consultFailures = 0;
+    } finally { consultsDraining = false; }
+  }
   let reportFailures = 0;
   let reportNextAt = 0;
   let reportsDraining = false;
@@ -111,18 +172,34 @@ export function startHookReceiver(options: HookReceiverOptions): { url: string;
       }
     } finally {
       void drainReportQueue();
+      void drainConsultQueue();
       draining = false;
       if (!stopped) timer = setTimeout(() => { void drain(); }, Math.min(1000, options.retryBaseMs ?? 1000));
     }
   }
   const server = Bun.serve({ hostname: options.host ?? '127.0.0.1', port: options.port,
-    async fetch(request) {
+    async fetch(request, server) {
       const url = new URL(request.url);
       if (request.method === 'GET' && url.pathname === '/hooks/health')
         return Response.json({ ok: true, queued: queue.count(), reportsQueued: reportQueue.count() });
       if (request.method === 'POST' && url.pathname === '/v1/reports')
         return handleReportPost(request, { limiter: reportLimiter, queue: reportQueue, ...(options.now ? { now: options.now } : {}),
           log: (event, data) => debug.log('hooks.reports', event, data), wake: () => { reportNextAt = 0; void drainReportQueue(); } });
+      if (consultEnabled && url.pathname === '/v1/consult' && (request.method === 'POST' || request.method === 'OPTIONS')) {
+        const origin = consultOrigin(request.headers.get('origin'));
+        if (!origin) {
+          debug.log('hooks.consult', 'rejected', { reason: 'origin' });
+          return Response.json({ error: 'forbidden' }, { status: 403 });
+        }
+        const headers = { 'Access-Control-Allow-Origin': origin, Vary: 'Origin',
+          'Access-Control-Allow-Methods': 'POST, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type' };
+        if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers });
+        const response = await handleConsultPost(request, { limiter: consultLimiter, queue: consultQueue, ...(options.now ? { now: options.now } : {}),
+          ip: server.requestIP(request)?.address ?? 'unknown',
+          log: (event, data) => debug.log('hooks.consult', event, data), wake: () => { consultNextAt = 0; void drainConsultQueue(); } });
+        for (const [key, value] of Object.entries(headers)) response.headers.set(key, value);
+        return response;
+      }
       if (request.method !== 'POST' || !/^\/hooks\/(linear|asana|github)$/.test(url.pathname)) return new Response('Not Found', { status: 404 });
       const provider = url.pathname.slice('/hooks/'.length) as HookProvider;
       const reject = (reason: string) => {

package/src/index.ts

@@ -3035,15 +3035,39 @@ contextCmd.command('hooks').description('Claude Code 맥락 훅 설정').command
     const { claudeHooksSettings } = await import('./context-bus/claude-hooks-install.js');
     console.log(claudeHooksSettings(REPOSITORY_ROOT));
   });
-contextCmd.command('emit')
-  .requiredOption('--kind <kind>', 'claimed|done|asked|guide-changed')
-  .requiredOption('--summary <line>', '한 줄 요약')
-  .requiredOption('--source <link>', '출처 링크')
-  .action(async (opts: { kind: string; summary: string; source: string }) => {
-    if (!['claimed', 'done', 'asked', 'guide-changed'].includes(opts.kind)) throw new Error('context emit --kind must be claimed|done|asked|guide-changed');
-    const { recordExternalEvent } = await import('./context-bus/external-events.js');
-    recordExternalEvent({ origin: 'claude-code', kind: opts.kind as import('./context-bus/external-events.js').ContextHookKind,
-      summary: opts.summary, source: opts.source });
+contextCmd.command('emit [sessionKind]')
+  .description('외부 에이전트 세션 이벤트: emit <kind> --seat <자리> --text <한 줄> [--ref <PR|칸>]')
+  .option('--seat <seat>', 'OP|TC|MK|UX')
+  .option('--text <line>', '한 줄 이벤트')
+  .option('--ref <PR|cell>', '연결 PR 또는 칸')
+  .option('--kind <kind>', '기존 Claude Code 훅 이벤트 종류')
+  .option('--summary <line>', '기존 훅 한 줄 요약')
+  .option('--source <link>', '기존 훅 출처 링크')
+  .action(async (sessionKind: string | undefined, opts: { seat?: string; text?: string; ref?: string; kind?: string; summary?: string; source?: string }) => {
+    try {
+      if (sessionKind !== undefined) {
+        if (opts.seat === undefined || opts.text === undefined || opts.kind !== undefined || opts.summary !== undefined || opts.source !== undefined) {
+          throw new Error('context emit <kind> requires --seat and --text (not hook options)');
+        }
+        const { emitSessionEvent, SESSION_EVENT_KINDS } = await import('./context-bus/session-events.js');
+        if (!SESSION_EVENT_KINDS.includes(sessionKind as import('./context-bus/session-events.js').SessionEventKind)) {
+          throw new Error(`unknown context session kind: ${sessionKind}`);
+        }
+        emitSessionEvent({ kind: sessionKind as import('./context-bus/session-events.js').SessionEventKind,
+          seat: opts.seat, text: opts.text, ...(opts.ref === undefined ? {} : { ref: opts.ref }) });
+      } else {
+        if (opts.seat !== undefined || opts.text !== undefined || opts.ref !== undefined || !opts.kind || opts.summary === undefined || opts.source === undefined) {
+          throw new Error('context emit hook requires --kind, --summary and --source');
+        }
+        if (!['claimed', 'done', 'asked', 'guide-changed'].includes(opts.kind)) throw new Error(`unknown context hook kind: ${opts.kind}`);
+        const { recordExternalEvent } = await import('./context-bus/external-events.js');
+        recordExternalEvent({ origin: 'claude-code', kind: opts.kind as import('./context-bus/external-events.js').ContextHookKind,
+          summary: opts.summary, source: opts.source });
+      }
+    } catch (error) {
+      console.error(`context emit: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = 2;
+    }
   });
 
 const coordCmd = program.command('coord').description('조율 채널 맥락 원장');