elanous 0.2.12 → 0.2.14

package/scripts/coord-channel-watch.sh

@@ -47,6 +47,7 @@
 # 환경 노브: CH_PR · CH_REPO · CH_INTERVAL(기본 60) · CH_BODY_CHARS(기본 1500) · CH_WATCH_BODY(기본 1)
 
 set -u
+set -o pipefail
 
 PR_NUM="${CH_PR:-23032}"  # ⛔ 2026-10-03: #20798 가 2,500 상한 → 채널 «6»(OP)  # ⛔ 2026-09-27: #16815 가 2,500 상한에 닿아 채널 «5» 로 옮김(🅞 · 벽에 «닿은 뒤» — 미리 못 옮겼다)
 #   📏 이력: #5730(07-28~08-12) → #8328(08-11~08-25) → #12577(08-25~09-10) → #16815(09-10~09-27) → #20798(09-27~10-03) → #23032.

package/scripts/coord-post.sh

@@ -220,7 +220,17 @@ fi
 echo "[coord-post] 발신 성공$VIA · 채널 #$PR · 신원 [$ID] · 시각 $TS" >&2
 # Only a successfully sent post is recorded; never pass the body or later lines to the ledger.
 POST_URL=$(printf '%s\n' "$POST_OUTPUT" | grep -oE 'https://github\.com/[^[:space:]]+/issues/[0-9]+#issuecomment-[0-9]+|https://github\.com/[^[:space:]]+/pull/[0-9]+#issuecomment-[0-9]+' | head -1 || true)
-if ! bun bin/elanous.mjs coord event record --seat "$ID" --header "$(head -1 "$TMP")" --url "$POST_URL" >/dev/null 2>&1; then
+# The channel is a production surface, so its record belongs in the production ledger, not this tree's
+# test universe (OP 10-04 18:00). An explicit ELANOUS_STATE_DIR is the caller's chosen universe and wins;
+# otherwise prefer the installed CLI (resolves prod from any tree), else pin the source CLI to prod.
+if [ -n "${ELANOUS_STATE_DIR:-}" ]; then
+  RECORD=(bun bin/elanous.mjs coord event record)
+elif command -v eln >/dev/null 2>&1; then
+  RECORD=(eln coord event record)
+else
+  RECORD=(env ELANOUS_STATE_DIR="$HOME/.elanous" bun bin/elanous.mjs --config-dir "$HOME/.elanous" coord event record)
+fi
+if ! "${RECORD[@]}" --seat "$ID" --header "$(head -1 "$TMP")" --url "$POST_URL" >/dev/null 2>&1; then
   echo '⚠️ 맥락 원장 기록 실패(발신은 됐다)' >&2
 fi
 exit 0

package/scripts/discord-seat-probe.ts

@@ -0,0 +1,144 @@
+import { Database } from 'bun:sqlite';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { discordDecisionOwner } from '../src/decisions/discord-decision-cards.js';
+import { handleDiscordSeatWork, type DiscordSeatWorkDeps } from '../src/intake-plane/discord-seat-work.js';
+import { submitIntakeWork } from '../src/intake-plane/submit-intake-work.js';
+import type { MsgStore } from '../src/msg/msg-store.js';
+import { dispatchCeoTask } from '../src/seat-dispatch/ceo-commands.js';
+import { resolveSeat } from '../src/seat-address/seat-address.js';
+import { getUserConfig, type UserConfig } from '../src/user-config.js';
+
+export type ProbeResult = {
+  text: string;
+  ms: number;
+  route: 'dispatch' | 'ask' | 'submit' | 'none';
+  seat: string | null;
+  body: string | null;
+  reply: string | null;
+};
+
+type ProbeOptions = { config?: UserConfig; dm?: boolean; live?: boolean; liveDeps?: DiscordSeatWorkDeps; messageId?: string };
+
+/** Execute the real Discord seat router; dry dependencies never open a live store or delivery channel. */
+export async function probeDiscordSeatWork(text: string, options: ProbeOptions = {}): Promise<ProbeResult> {
+  const config = options.config ?? getUserConfig();
+  const ownerId = discordDecisionOwner(config);
+  if (options.dm && !ownerId) throw new Error('Discord 소유자 ID가 없어 DM을 재현할 수 없습니다.');
+  const messageId = options.messageId ?? 'probe-1';
+  const msg = { channelId: options.dm ? `probe-dm-${ownerId}` : 'probe-channel', messageId,
+    ...(ownerId ? { userId: ownerId } : {}), isDm: options.dm ?? false };
+  let route: ProbeResult['route'] = 'none';
+  let seat: string | null = null;
+  let body: string | null = null;
+  const capture = (path: ProbeResult['route'], seatId: string | null, forwarded: string) => {
+    route = path;
+    seat = seatId;
+    body = Array.from(forwarded).slice(0, 80).join('');
+  };
+  const dry: DiscordSeatWorkDeps = {
+    config,
+    // An unknown address must not cause registry I/O or a persona/LLM answer in a dry run.
+    personaSource: { list: () => [], get: () => undefined },
+    personaAnswer: async () => { throw new Error('dry persona answer unavailable'); },
+    answer: async () => null,
+    commandDeps: { ownerId, replyTarget: null, runGh: async () => { throw new Error('dry channel delivery unavailable'); },
+      append: () => { throw new Error('dry seat delivery unavailable'); } },
+    dispatch: async (seatId, forwarded) => {
+      capture('dispatch', seatId, forwarded);
+      return { channel: 'unknown', reply: `마른 실행 — ${seatId}에 맡길 예정 (실제 맡김 없음).` };
+    },
+    submit: async (input) => {
+      capture('submit', resolveSeat(input.text.split(/\s+/)[0] ?? '')?.id ?? null, input.text);
+      return { ok: true, track: 'graph', acceptanceId: 'DRY-RUN (모의 · 실제 접수 없음)' };
+    },
+    askDeps: {
+      open: () => { const db = new Database(':memory:'); return { db, close: () => db.close() } as unknown as MsgStore; },
+      dispatch: async (seatId, forwarded) => {
+        capture('ask', seatId, forwarded);
+        return { channel: 'unknown', reply: '마른 실행 — 질문을 맡기지 않았습니다.' };
+      },
+      send: async () => { throw new Error('dry Discord delivery unavailable'); },
+    },
+  };
+  const live: DiscordSeatWorkDeps = {
+    ...options.liveDeps,
+    config,
+    dispatch: async (seatId, forwarded, deps, extra) => {
+      capture('dispatch', seatId, forwarded);
+      return (options.liveDeps?.dispatch ?? dispatchCeoTask)(seatId, forwarded, deps, extra);
+    },
+    submit: async (input, deps) => {
+      capture('submit', resolveSeat(input.text.split(/\s+/)[0] ?? '')?.id ?? null, input.text);
+      return (options.liveDeps?.submit ?? submitIntakeWork)(input, deps);
+    },
+    askDeps: {
+      ...options.liveDeps?.askDeps,
+      dispatch: async (seatId, forwarded, deps, extra) => {
+        capture('ask', seatId, forwarded);
+        return (options.liveDeps?.askDeps?.dispatch ?? dispatchCeoTask)(seatId, forwarded, deps, extra);
+      },
+      // This CLI has no Discord transport: even live mode must not post to Discord.
+      send: async () => { throw new Error('probe does not send Discord messages'); },
+    },
+  };
+  const start = performance.now();
+  const reply = await handleDiscordSeatWork(text, msg, options.live ? live : dry);
+  return { text: Array.from(text).slice(0, 80).join(''), ms: Math.round((performance.now() - start) * 100) / 100,
+    route, seat, body, reply: reply === null ? null : Array.from(reply).slice(0, 120).join('') };
+}
+
+/** Extract only the '치는 문장' column of a Markdown runbook table, in row order. */
+export function runbookTexts(markdown: string): string[] {
+  const lines = markdown.split(/\r?\n/);
+  const header = lines.findIndex((line) => /^\|.*\|\s*치는 문장(?:\s*\([^|]*\))?\s*\|/.test(line));
+  if (header < 0) throw new Error('대본의 «치는 문장» 표를 찾지 못했습니다.');
+  const columns = lines[header]!.split('|').slice(1, -1).map((cell) => cell.trim());
+  const index = columns.findIndex((cell) => cell.startsWith('치는 문장'));
+  const texts: string[] = [];
+  for (const line of lines.slice(header + 2)) {
+    if (!line.startsWith('|')) break;
+    const cells = line.split('|').slice(1, -1);
+    if (cells.length !== columns.length) throw new Error('대본 표의 열 수가 맞지 않습니다.');
+    const cell = cells[index]?.trim() ?? '';
+    if (!cell.startsWith('`') || !cell.endsWith('`')) throw new Error('치는 문장 칸이 백틱으로 둘러싸여 있지 않습니다.');
+    texts.push(cell.slice(1, -1));
+  }
+  if (!texts.length) throw new Error('대본에 치는 문장이 없습니다.');
+  return texts;
+}
+
+export async function runProbeCli(argv: string[], config: UserConfig = getUserConfig()): Promise<ProbeResult[]> {
+  let text: string | undefined;
+  let runbook: string | undefined;
+  let dm = false;
+  let live = false;
+  let json = false;
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag === '--text' || flag === '--runbook') {
+      const value = argv[++i];
+      if (!value || value.startsWith('--')) throw new Error(`${flag} 값이 필요합니다.`);
+      if (flag === '--text') text = value;
+      else runbook = value;
+    } else if (flag === '--dm') dm = true;
+    else if (flag === '--live') live = true;
+    else if (flag === '--json') json = true;
+    else throw new Error(`알 수 없는 옵션: ${flag}`);
+  }
+  if (Boolean(text) === Boolean(runbook)) throw new Error('--text 또는 --runbook 중 하나만 지정하세요.');
+  const texts = runbook ? runbookTexts(readFileSync(resolve(runbook), 'utf8')) : [text!];
+  const results: ProbeResult[] = [];
+  for (const [index, line] of texts.entries()) {
+    const result = await probeDiscordSeatWork(line, { config, dm, live, messageId: `probe-${index + 1}` });
+    results.push(result);
+    if (!json) console.log(`글: ${result.text} | ${result.ms}ms | 길: ${result.route} | 자리: ${result.seat ?? '-'} | 본문: ${result.body ?? '-'} | 봇 답: ${result.reply ?? '-'}`);
+  }
+  if (json) console.log(JSON.stringify(results));
+  return results;
+}
+
+if (import.meta.main) {
+  try { await runProbeCli(process.argv.slice(2)); }
+  catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+}

package/scripts/docs-cli-check.ts

@@ -2,7 +2,7 @@
 // 공개 문서에 적힌 `elanous …` 명령·하위 명령·플래그가 «실제 CLI» 에 있나 — 문서가 실제와 어긋나는 1순위 원인을 잡는다.
 //   bun scripts/docs-cli-check.ts [--json] [files…]      (기본 = release/public/내부 문서 `*` ⊕ README.md)
 // 🩸 계기(2026-09-25 🅢 RFC 피드백 ③): README·install.md 가 거짓이 된 원인이 전부 «설치기·doctor 가 바뀌었는데 문서가 모름»이었다.
-// 자 = `bun bin/elanous.mjs <cmd> [<sub>] --help` 산출(원천) — 문서의 코드 블록과 인라인 코드에서 `elanous ` 로 시작하는 것만 본다.
+// 자 = `bun bin/elanous.mjs <cmd> [<sub>] [<subsub>] --help` 산출(원천) — 문서의 코드 블록과 인라인 코드에서 `elanous ` 로 시작하는 것만 본다.
 // ⛔ 못 본 것은 «없다»로 적지 않는다: `--help` 가 실패하면 그 명령은 `unmeasured` 로 따로 센다.
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative, resolve } from 'node:path';
@@ -10,7 +10,7 @@ import { spawnSync } from 'node:child_process';
 
 const REPO = resolve(import.meta.dir, '..');
 
-export interface DocCommand { file: string; line: number; text: string; cmd: string; sub?: string; flags: string[] }
+export interface DocCommand { file: string; line: number; text: string; cmd: string; sub?: string; subsub?: string; flags: string[] }
 export interface Finding { kind: 'unknown-command' | 'unknown-subcommand' | 'unknown-flag' | 'unmeasured'; ref: DocCommand; detail: string }
 
 /** 코드 블록(``` … ```) 줄과 인라인 코드(`elanous …`)에서 elanous 호출을 뽑는다. 자리표(`<x>`)·셸 변수는 인자로 보고 넘긴다. */
@@ -24,15 +24,17 @@ export function extractElanousCommands(file: string, text: string): DocCommand[]
     for (const m of raw.matchAll(/`(elanous [^`]+)`/g)) candidates.push(m[1]!);
     for (const c of candidates) {
       for (const seg of c.split(/&&|\|\||;|\|/)) {
-        const m = /(?:^|\s)elanous\s+(.+)$/.exec(seg.trim());
+        const m = /^(?:(?:\$\s+|>\s+|sudo\s+|[A-Za-z_][A-Za-z0-9_]*=\S+\s+))*elanous\s+(.+)$/.exec(seg.trim());
         if (!m) continue;
         const tokens = m[1]!.trim().split(/\s+/).filter(Boolean);
         const cmd = tokens[0];
         if (!cmd || !/^[a-z][a-z0-9:-]*$/.test(cmd)) continue;
         const second = tokens[1];
         const sub = second && /^[a-z][a-z0-9-]*$/.test(second) ? second : undefined;
+        const third = tokens[2];
+        const subsub = sub && third && /^[a-z][a-z0-9-]*$/.test(third) ? third : undefined;
         const flags = tokens.filter((t) => /^--[a-z]/.test(t)).map((t) => t.replace(/[=,.)].*$/, ''));
-        out.push({ file, line: i + 1, text: seg.trim(), cmd, ...(sub ? { sub } : {}), flags });
+        out.push({ file, line: i + 1, text: seg.trim(), cmd, ...(sub ? { sub } : {}), ...(subsub ? { subsub } : {}), flags });
       }
     }
   });
@@ -63,13 +65,28 @@ export function checkCommands(refs: readonly DocCommand[], help: HelpRunner = de
     const cmdHelp = get([ref.cmd]);
     if (!cmdHelp.ok) { findings.push({ kind: 'unmeasured', ref, detail: `elanous ${ref.cmd} --help 실패` }); continue; }
     let flagsHelp = cmdHelp.out;
+    let flagsPath = `elanous ${ref.cmd}`;
     if (ref.sub && /\nCommands:\n/.test(cmdHelp.out)) {
       if (!listed(cmdHelp.out, ref.sub)) { findings.push({ kind: 'unknown-subcommand', ref, detail: `elanous ${ref.cmd} ${ref.sub}` }); continue; }
+      flagsPath = `elanous ${ref.cmd} ${ref.sub}`;
       const subHelp = get([ref.cmd, ref.sub]);
-      if (subHelp.ok) flagsHelp = subHelp.out;
+      if (!subHelp.ok) {
+        findings.push({ kind: 'unmeasured', ref, detail: `${flagsPath} --help 실패` });
+        continue;
+      }
+      flagsHelp = subHelp.out;
+      if (ref.subsub && listed(subHelp.out, ref.subsub)) {
+        flagsPath += ` ${ref.subsub}`;
+        const subsubHelp = get([ref.cmd, ref.sub, ref.subsub]);
+        if (!subsubHelp.ok) {
+          findings.push({ kind: 'unmeasured', ref, detail: `${flagsPath} --help 실패` });
+          continue;
+        }
+        flagsHelp = subsubHelp.out;
+      }
     }
     for (const f of ref.flags) {
-      if (!new RegExp(`(^|[\\s,])${f}(\\b|[\\s,=<\\[])`, 'm').test(flagsHelp)) findings.push({ kind: 'unknown-flag', ref, detail: `${f} (elanous ${ref.cmd}${ref.sub ? ` ${ref.sub}` : ''})` });
+      if (!new RegExp(`(^|[\\s,])${f}(\\b|[\\s,=<\\[])`, 'm').test(flagsHelp)) findings.push({ kind: 'unknown-flag', ref, detail: `${f} (${flagsPath})` });
     }
   }
   return findings;

package/scripts/expose-rubric-check.ts

@@ -0,0 +1,118 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, relative, resolve, sep } from 'node:path';
+import { parse } from 'yaml';
+import { debug } from '../src/debug/log.js';
+
+const DOCS = 'release/public/docs';
+const LEDGER = 'release/public/expose-rubric.yaml';
+const CRITERIA = ['maturity', 'value', 'reproducible', 'evidence', 'confidential', 'brand', 'support'] as const;
+type Criterion = { status: 'pass' | 'fail' | 'n/a'; reason: string };
+type Entry = {
+  path: string;
+  verdict: 'public' | 'beta' | 'internal';
+  criteria: Record<(typeof CRITERIA)[number], Criterion>;
+  judge: string;
+  techReview?: string;
+  at: string;
+};
+type RubricResult = { docs: number; missing: string[]; orphan: string[]; failing: Array<{ path: string; criteria: string[]; verdict?: 'beta' }>; internal: string[]; unreviewed: string[]; unjudged: string[] };
+
+function validEntry(value: unknown): value is Entry {
+  if (!value || typeof value !== 'object') return false;
+  const entry = value as Partial<Entry>;
+  if (typeof entry.path !== 'string' || !/^release\/public\/docs\/[^/]+\.md$/.test(entry.path)
+    || !['public', 'beta', 'internal'].includes(entry.verdict ?? '')
+    // The exposure judge is the CMO seat (EXPOSE-RUBRIC); any other non-empty name is not a judgement.
+    || entry.judge !== 'MK'
+    || (entry.techReview !== undefined && (typeof entry.techReview !== 'string' || !entry.techReview.trim()))
+    || typeof entry.at !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$/.test(entry.at)
+    || !Number.isFinite(Date.parse(entry.at)) || !entry.criteria || typeof entry.criteria !== 'object') return false;
+  const criteria = entry.criteria as Record<string, unknown>;
+  if (Object.keys(criteria).length !== CRITERIA.length) return false;
+  return CRITERIA.every((key) => {
+    const item = criteria[key] as Partial<Criterion> | undefined;
+    return item && ['pass', 'fail', 'n/a'].includes(item.status ?? '')
+      && typeof item.reason === 'string' && !!item.reason.trim() && !item.reason.includes('\n');
+  });
+}
+
+function selectedPath(input: string, root: string): string | undefined {
+  const path = relative(root, resolve(root, input)).split(sep).join('/');
+  return /^release\/public\/docs\/[^/]+\.md$/.test(path) ? path : undefined;
+}
+
+export function checkExposeRubric(root: string, files?: readonly string[]): RubricResult {
+  const data = parse(readFileSync(join(root, LEDGER), 'utf8')) as unknown;
+  if (!data || typeof data !== 'object' || !('entries' in data) || !Array.isArray(data.entries)) throw new Error(`invalid ledger: ${LEDGER}`);
+  const entries = new Map<string, Entry>();
+  for (const value of data.entries as unknown[]) {
+    if (!validEntry(value) || entries.has(value.path)) throw new Error(`invalid or duplicate ledger entry: ${JSON.stringify(value)}`);
+    entries.set(value.path, value);
+  }
+  const scope = files === undefined ? undefined : new Set(files.map((file) => selectedPath(file, root)).filter((path): path is string => path !== undefined));
+  const docs = readdirSync(join(root, DOCS)).filter((name) => name.endsWith('.md'))
+    .map((name) => `${DOCS}/${name}`).filter((path) => !scope || scope.has(path)).sort();
+  const missing = docs.filter((path) => !entries.has(path));
+  const orphan: string[] = [];
+  const failing: RubricResult['failing'] = [];
+  const internal: string[] = [];
+  const unreviewed: string[] = [];
+  const unjudged: string[] = [];
+  for (const entry of entries.values()) {
+    if (scope && !scope.has(entry.path)) continue;
+    if (!existsSync(join(root, entry.path))) {
+      orphan.push(entry.path);
+      continue;
+    }
+    if (entry.verdict === 'internal') internal.push(entry.path);
+    if (entry.verdict === 'public' || entry.verdict === 'beta') {
+      const failed = entry.verdict === 'public'
+        ? CRITERIA.filter((key) => entry.criteria[key].status === 'fail')
+        : (entry.criteria.confidential.status === 'fail' ? ['confidential'] : []);
+      if (failed.length) failing.push({ path: entry.path, criteria: failed, ...(entry.verdict === 'beta' ? { verdict: 'beta' as const } : {}) });
+      if (entry.verdict === 'public' && entry.techReview !== 'TC') unreviewed.push(entry.path);
+      // An outward verdict with no criterion actually passed is a placeholder, not a judgement (all n/a = never checked).
+      if (!CRITERIA.some((key) => entry.criteria[key].status === 'pass')) unjudged.push(entry.path);
+    }
+  }
+  orphan.sort();
+  failing.sort((a, b) => a.path.localeCompare(b.path));
+  internal.sort();
+  unreviewed.sort();
+  unjudged.sort();
+  const result = { docs: docs.length, missing, orphan, failing, internal, unreviewed, unjudged };
+  debug.log('expose.rubric', 'checked', { docs: result.docs, missing: missing.length, orphan: orphan.length, failing: failing.length, unjudged: unjudged.length });
+  return result;
+}
+
+if (import.meta.main) {
+  try {
+    const args = process.argv.slice(2);
+    if (args.includes('--help')) {
+      console.log('Usage: bun scripts/expose-rubric-check.ts [--strict] [--json] [--files <path...>]');
+    } else {
+      const options = new Set(['--strict', '--json', '--files']);
+      const index = args.indexOf('--files');
+      const beforeFiles = args.slice(0, index < 0 ? args.length : index);
+      const files = index < 0 ? undefined : args.slice(index + 1);
+      if (beforeFiles.some((arg) => !options.has(arg) || arg === '--files')
+        || (files && (!files.length || files.some((file) => file.startsWith('--'))))) throw new Error('invalid arguments: use --files <path...> last');
+      const result = checkExposeRubric(process.cwd(), files);
+      if (args.includes('--json')) console.log(JSON.stringify(result));
+      else {
+        for (const path of result.missing) console.error(`경고: 원장 없음: ${path}`);
+        for (const path of result.orphan) console.error(`경고: 파일 없음: ${path}`);
+        for (const item of result.failing) console.error(`경고: ${item.verdict ?? 'public'} 인데 fail (${item.criteria.join(', ')}): ${item.path}`);
+        for (const path of result.internal) console.error(`경고: internal 인데 공개 경로: ${path}`);
+        for (const path of result.unreviewed) console.error(`경고: public 기술 정확성 TC 미검토: ${path}`);
+        for (const path of result.unjudged) console.error(`경고: 미판정(일곱 기준 중 pass 0): ${path}`);
+        console.error(`expose-rubric — docs=${result.docs} missing=${result.missing.length} orphan=${result.orphan.length} failing=${result.failing.length} internal=${result.internal.length} unreviewed=${result.unreviewed.length} unjudged=${result.unjudged.length}`);
+      }
+      if (args.includes('--strict') && (result.missing.length || result.orphan.length || result.failing.length || result.internal.length || result.unjudged.length)) process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 2;
+  }
+}

package/scripts/expose-rubric-suggest.ts

@@ -0,0 +1,163 @@
+#!/usr/bin/env bun
+/** Machine-measured suggestions only; MK judges and merges the exposure ledger. */
+import { readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join, relative, resolve, sep } from 'node:path';
+import { stringify } from 'yaml';
+import { debug } from '../src/debug/log.js';
+import { checkBrand } from './brand/check.js';
+import { checkCommands, extractElanousCommands, type HelpRunner } from './docs-cli-check.js';
+import { scanLeaks } from './public-export.js';
+
+const DOCS = 'release/public/docs';
+const LEDGER = 'release/public/expose-rubric.yaml';
+const KEYS = ['reproducible', 'confidential', 'brand'] as const;
+type Criterion = { status: 'pass' | 'fail' | 'n/a'; reason: string };
+type Suggestion = { path: string; criteria: Record<(typeof KEYS)[number], Criterion> };
+
+function unmeasured(error: unknown): Criterion {
+  const detail = error instanceof Error ? error.message : String(error);
+  return { status: 'n/a', reason: `측정 불가: ${detail.split(/\r?\n/)[0] || '알 수 없는 오류'}` };
+}
+
+function measure(run: () => Criterion): Criterion {
+  try { return run(); } catch (error) { return unmeasured(error); }
+}
+
+/** Files are repository-relative paths (or absolute paths within root); the ledger is never read or written. */
+export function suggestExposeRubric(root: string, files?: readonly string[], help?: HelpRunner): Suggestion[] {
+  const names = files ?? readdirSync(join(root, DOCS)).filter((name) => name.endsWith('.md')).map((name) => `${DOCS}/${name}`);
+  const paths = [...new Set(names.map((name) => relative(root, resolve(root, name)).split(sep).join('/')))];
+  if (paths.some((path) => !/^release\/public\/docs\/[^/]+\.md$/.test(path))) throw new Error('문서 경로는 release/public/docs/*.md 이어야 합니다');
+  type HelpResult = ReturnType<HelpRunner> & { failure?: string };
+  let helpRuns = 0;
+  const rootHelp: (args: string[]) => HelpResult = help ?? ((args) => {
+    helpRuns++;
+    const result = spawnSync('bun', ['bin/elanous.mjs', '--test', ...args, '--help'], {
+      cwd: resolve(import.meta.dir, '..'), encoding: 'utf8', timeout: 60_000, env: { ...process.env, NO_COLOR: '1' },
+    });
+    const error = result.error as NodeJS.ErrnoException | undefined;
+    return {
+      ok: result.status === 0 && !error,
+      out: `${result.stdout ?? ''}\n${result.stderr ?? ''}`,
+      failure: error?.code === 'ETIMEDOUT' ? 'timeout'
+        : error ? error.message
+        : result.status !== 0 ? `exit ${result.status ?? 'unknown'}` : undefined,
+    };
+  });
+  const helpCache = new Map<string, { ok: true; out: string } | { ok: false; reason: string }>();
+  let helpFailures = 0;
+  const checkedHelp: HelpRunner = (args) => {
+    const key = args.join(' ');
+    let cached = helpCache.get(key);
+    if (!cached) {
+      const runOnce = (): { ok: true; out: string } | { ok: false; reason: string } => {
+        try {
+          const result = rootHelp(args);
+          if (result.ok && result.out.trim()) return { ok: true, out: result.out };
+          helpFailures++;
+          return { ok: false, reason: result.failure ?? (result.out.trim() ? '실행 실패' : '빈 출력') };
+        } catch (error) {
+          helpFailures++;
+          return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+        }
+      };
+      cached = runOnce();
+      if (!cached.ok) cached = runOnce();
+      helpCache.set(key, cached);
+    }
+    if (!cached.ok) throw new Error(`elanous ${key ? `${key} ` : ''}--help 실패(${cached.reason.split(/\r?\n/)[0] || '알 수 없는 오류'})`);
+    return cached;
+  };
+  const results = paths.sort().map((path): Suggestion => {
+    const absolute = join(root, path);
+    let text: string;
+    try { text = readFileSync(absolute, 'utf8'); }
+    catch (error) {
+      const failed = unmeasured(error);
+      return { path, criteria: { reproducible: failed, confidential: failed, brand: failed } };
+    }
+    const reproducible = measure(() => {
+      const refs = extractElanousCommands(path, text);
+      if (!refs.length) return { status: 'n/a', reason: '문서에 elanous 명령 없음' };
+      const findings = checkCommands(refs, checkedHelp);
+      const unable = findings.find((finding) => finding.kind === 'unmeasured');
+      if (unable) return unmeasured(unable.detail);
+      const missing = [...new Set(findings.map((finding) => finding.detail))].slice(0, 3);
+      return missing.length
+        ? { status: 'fail', reason: `없는 명령: ${missing.join(', ')}` }
+        : { status: 'pass', reason: `명령 ${refs.length}개 모두 --help 에 있음` };
+    });
+    const confidential = measure(() => {
+      const hits = scanLeaks(root, [path], undefined, new Map([[path, text]]));
+      const markers = [...new Set(hits.map((hit) => hit.marker))].slice(0, 3);
+      return markers.length
+        ? { status: 'fail', reason: `누출 표식: ${markers.join(', ')}` }
+        : { status: 'pass', reason: '누출 표식 없음' };
+    });
+    const brand = measure(() => {
+      const result = checkBrand('public-docs', [absolute]);
+      if (result.missing || result.files !== 1 || result.rules === 0) return unmeasured('브랜드 규칙 없음 또는 파일 검사 실패');
+      const ids = [...new Set(result.findings.map((finding) => finding.id))].slice(0, 3);
+      return ids.length
+        ? { status: 'fail', reason: `브랜드 규칙: ${ids.join(', ')}` }
+        : { status: 'pass', reason: '브랜드 규칙 위반 없음' };
+    });
+    return { path, criteria: { reproducible, confidential, brand } };
+  });
+  const statuses = results.flatMap((item) => KEYS.map((key) => item.criteria[key].status));
+  debug.log('expose.rubric', 'suggested', {
+    docs: results.length, pass: statuses.filter((status) => status === 'pass').length,
+    fail: statuses.filter((status) => status === 'fail').length,
+    unmeasured: statuses.filter((status) => status === 'n/a').length,
+    helpRuns, helpFailures,
+  });
+  return results;
+}
+
+export function run(argv: readonly string[], root = process.cwd(), help?: HelpRunner): number {
+  const json = argv.includes('--json');
+  let files: string[] | undefined;
+  let out: string | undefined;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]!;
+    if (arg === '--json') continue;
+    if (arg === '--yaml-patch') {
+      out = argv[++i];
+      if (!out || out.startsWith('--')) throw new Error('--yaml-patch 에 출력 경로가 필요합니다');
+    } else if (arg === '--files') {
+      files = [];
+      while (argv[i + 1] && !argv[i + 1]!.startsWith('--')) files.push(argv[++i]!);
+      if (!files.length) throw new Error('--files 에 문서 경로가 필요합니다');
+    } else throw new Error(`알 수 없는 옵션: ${arg}`);
+  }
+  const results = suggestExposeRubric(root, files, help);
+  if (out) {
+    const target = resolve(root, out);
+    const ledger = resolve(root, LEDGER);
+    if (target === ledger || realpathOrSelf(target) === realpathOrSelf(ledger) || sameFile(target, ledger)) throw new Error('원장 파일은 덮어쓸 수 없습니다');
+    writeFileSync(target, stringify({ entries: results }));
+  }
+  if (json) console.log(JSON.stringify(results));
+  else {
+    for (const { path, criteria } of results) console.log(`${path} · ${KEYS.map((key) => `${key} ${criteria[key].status}${criteria[key].status === 'fail' ? `(${criteria[key].reason.split(': ').slice(1).join(': ') || criteria[key].reason})` : ''}`).join(' · ')}`);
+    const statuses = results.flatMap((item) => KEYS.map((key) => item.criteria[key].status));
+    console.log(`합계 문서 ${results.length} · pass ${statuses.filter((status) => status === 'pass').length} · fail ${statuses.filter((status) => status === 'fail').length} · n/a ${statuses.filter((status) => status === 'n/a').length} · maturity/value/evidence/support 사람 판정 (MK)`);
+  }
+  return 0;
+}
+
+function realpathOrSelf(path: string): string {
+  try { return realpathSync(path); } catch { return path; }
+}
+
+function sameFile(target: string, ledger: string): boolean {
+  const a = statSync(target, { throwIfNoEntry: false });
+  const b = statSync(ledger, { throwIfNoEntry: false });
+  return !!a && !!b && a.dev === b.dev && a.ino === b.ino;
+}
+
+if (import.meta.main) {
+  try { process.exitCode = run(process.argv.slice(2)); }
+  catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 2; }
+}

package/scripts/heal/run-role.ts

@@ -5,6 +5,7 @@ import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
+import { readFailureInbox } from '../../src/self-implement/heal-intake.js';
 import {
   fillMissingGateFacts,
   markDeletedUnverified,
@@ -101,6 +102,7 @@ export interface HealRoleDeps {
   loadLedger?: (runId: string) => RunLedgerEntry[] | null;
   ledgerDir?: string;
   search?: (query: string) => unknown;
+  stateRoot?: string;
 }
 
 function gitHeadExists(worktree: string, path: string): PathExists {
@@ -243,6 +245,18 @@ export function roleResult(role: string, ctx: GraphContext, deps: HealRoleDeps =
   const signature = failureOf(ctx);
   switch (role) {
     case 'observe-ledger': {
+      const selector = asRecord(input.failureEvent);
+      if (selector) {
+        if (typeof selector.source !== 'string' || typeof selector.ref !== 'string' || !selector.source || !selector.ref) {
+          return withAddedFacts({ outcome: 'fail', reason: 'invalid-failure-event-selector' }, []);
+        }
+        const since = typeof input.since === 'string' ? input.since : undefined;
+        const event = readFailureInbox({ since }, deps.stateRoot)
+          .filter(row => row.source === selector.source && row.ref === selector.ref)
+          .sort((a, b) => Date.parse(b.at) - Date.parse(a.at)).at(0);
+        if (!event) return withAddedFacts({ outcome: 'empty', reason: 'inbox-event-not-found' }, []);
+        return withAddedFacts({ outcome: 'ok', entries: [{ errorText: event.summary }], event }, ['errorText']);
+      }
       if (!asRecord(input.failure) && Object.keys(failure).length === 0) return withAddedFacts({ outcome: 'empty' }, []);
       const worktree = typeof input.worktree === 'string' ? input.worktree : '';
       const paths = signature.unverified ?? [];

package/scripts/hq/hq-standby.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+# HQ-REP replication body — the same file runs on both HQ hosts (OP 10-04 10:09 · «되돌리기 방향»).
+# The lease holder is the source, the other host is the standby: mbp → node-b today, node-b → mbp once node-b holds the lease.
+# Called by each host's short cron shim (~/.elanous/bin/hq-standby.sh: lock ⊕ fetch ⊕ detach origin/main) with:
+#   HQ_REP_PEER=<the other host's ssh name>  HQ_REP_DEFAULT_SOURCE=<lease names of the pre-lease source, comma list>
+#   [HQ_REP_SURVIVAL=<host>,s3://bucket/prefix]  [HQ_REP_STATE_DIR=<canonical ledgers · default ~/.elanous>]
+#   sh scripts/hq/hq-standby.sh core|big|obs|vault
+# HQ_REP_STATE_DIR (OP 10-04 11:27): on node-b the promoted HQ state lives in ~/.elanous-hqstate — its live ~/.elanous is the
+# Pod host's own state and must never be copied as HQ ledgers. The copy refuses a state dir without release/features.sqlite
+# (an empty or wrong root would otherwise become the standby's newest generation).
+# Direction comes from scripts/hq/standby-role.ts: `fenced` → the copy runs under `elanous hq fence --role cron`
+# (TC HQ-FENCE decides · skip exits 0), `direct` → no lease yet and this is the default source, `skip` → no lease, not it.
+MODE="$1"
+ts() { date '+%Y-%m-%dT%H:%M:%S%z'; }
+# Production ledgers on every host — a source-tree command resolves the test universe otherwise.
+# HQ_REP_CONFIG_DIR (TC drill step 0 · 10-04 11:5x): node-b keeps its hq settings (hq.hostName=node-b) in ~/.elanous-hqcfg
+# because its live ~/.elanous is the Pod host's; the role check and `hq fence` must read the same lease name as HQ-HB.
+# ⚠️ The config dir moves only by the `--config-dir` flag (src/elanous-config-dir.ts) — an ELANOUS_CONFIG_DIR env is ignored.
+export ELANOUS_STATE_DIR="$HOME/.elanous"
+CFG="${HQ_REP_CONFIG_DIR:-$HOME/.elanous}"
+STATE="${HQ_REP_STATE_DIR:-$HOME/.elanous}"
+case "$MODE" in core|big|obs|vault) ;; *) echo "$(ts) hq-standby skip: unknown mode $MODE"; exit 2 ;; esac
+[ -n "$HQ_REP_PEER" ] || { echo "$(ts) hq-standby skip($MODE): HQ_REP_PEER not set"; exit 2; }
+[ -n "$HQ_REP_DEFAULT_SOURCE" ] || { echo "$(ts) hq-standby skip($MODE): HQ_REP_DEFAULT_SOURCE not set"; exit 2; }
+verify_received() {
+  # Verification is observational: a broken or not-yet-received copy must not fail replication's cron exit status.
+  bun scripts/hq/standby-verify.ts --root "$HOME/.elanous-standby" --tier core,big --max-age-min core=30,big=400 || :
+}
+ROLE=$(bun scripts/hq/standby-role.ts --config-dir "$CFG" --default-source "$HQ_REP_DEFAULT_SOURCE" 2>/dev/null) || ROLE=fenced
+case "$ROLE" in
+  skip) if [ "$MODE" = core ]; then verify_received; else echo "$(ts) hq-standby skip($MODE): standby — no lease yet and this host is not the default source"; fi; exit 0 ;;
+  direct) set -- ;;
+  *) ROLE=fenced; set -- bun bin/elanous.mjs --config-dir "$CFG" hq fence --role cron -- ;;
+esac
+echo "$(ts) hq-standby run($MODE) role=$ROLE state=$STATE → $HQ_REP_PEER at $(git rev-parse --short HEAD 2>/dev/null)"
+if [ "$MODE" = vault ]; then
+  # Obsidian vault: one-way copy to the standby (no --delete; workspace state and trash stay local; --update keeps newer files there).
+  V="$HOME/Obsidian/ElanvitalAI/"
+  "$@" rsync -a --update --exclude '.obsidian/workspace*' --exclude '.trash/' "$V" "$HQ_REP_PEER:$V" 2>&1 \
+    && echo "$(ts) hq-standby vault done rc=0 (a fence skip line above means nothing was copied)" || { echo "$(ts) hq-standby vault FAILED"; exit 1; }
+  exit 0
+fi
+# In core fenced mode the guard runs inside the fence: a non-holder need not have HQ source ledgers.
+if [ "$MODE" != core ] || [ "$ROLE" = direct ]; then
+  [ -f "$STATE/release/features.sqlite" ] || { echo "$(ts) hq-standby skip($MODE): $STATE has no release/features.sqlite — not an HQ state dir, nothing copied"; exit 1; }
+fi
+SURV=""
+[ "$MODE" = core ] && [ -n "$HQ_REP_SURVIVAL" ] && SURV="--survival $HQ_REP_SURVIVAL"
+# The fence exits 0 both after copying and after skipping. Mark execution inside the fence,
+# not by parsing its diagnostic text: only the skipped host owns a received copy to verify.
+if [ "$MODE" = core ] && [ "$ROLE" = fenced ]; then
+  FENCE_RAN=$(mktemp) || { echo "$(ts) hq-standby FAILED: cannot track fence execution"; exit 1; }
+  # shellcheck disable=SC2086 — SURV is either empty or two words.
+  COPY_OUT=$("$@" sh -c '
+    [ -f "$1/release/features.sqlite" ] || { echo "hq-standby skip(core): $1 has no release/features.sqlite — not an HQ state dir, nothing copied"; exit 1; }
+    printf "ran\n" > "$2"; shift 2; exec "$@"
+  ' sh "$STATE" "$FENCE_RAN" env ELANOUS_STATE_DIR="$STATE" bun scripts/hq/standby-snapshot.ts --tier "$MODE" --push "$HQ_REP_PEER" $SURV 2>&1)
+  COPY_RC=$?
+  [ -z "$COPY_OUT" ] || printf '%s\n' "$COPY_OUT"
+  if [ "$COPY_RC" -eq 0 ] && [ ! -s "$FENCE_RAN" ]; then verify_received; fi
+  rm -f "$FENCE_RAN"
+  exit "$COPY_RC"
+fi
+# shellcheck disable=SC2086 — SURV is either empty or two words.
+"$@" env ELANOUS_STATE_DIR="$STATE" bun scripts/hq/standby-snapshot.ts --tier "$MODE" --push "$HQ_REP_PEER" $SURV 2>&1