elanous 0.2.13 → 0.2.14

package/src/self-dev/dev-pipeline.ts

@@ -38,7 +38,7 @@ import { lookupEntrance, type EntranceId } from './entrance-registry.js';
 import type { IngestionEntry } from '../agent-substrate/execution/ingestion-policy.js';
 import type { ReviewerContextItem } from '../agent-substrate/pr-reviewer.js';
 import { resolveRunIdentity, type RunIdSource } from '../harness/harness-space.js';
-import { addSelfDevRunParticipant, saveSelfDevRun } from './run-store.js';
+import { addSelfDevRunParticipant, processBirthId, saveSelfDevRun } from './run-store.js';
 import { getUserConfig, resolveRoleLlm } from '../user-config.js';
 import { reviewReasoningEffort } from '../model-tier/review-effort.js';
 import { getProvider, inferProviderFromModel } from '../llm.js';
@@ -1718,7 +1718,11 @@ export async function runDevPipeline(spec: DevPipelineSpec, deps: DevPipelineDep
   if (spec.runId) {
     const runIdSource = spec.runIdSource ?? resolveRunIdentity({ explicit: spec.runId }).source;
     const now = Date.now();
-    saveSelfDevRun({ runId: spec.runId, createdAt: now, updatedAt: now, results: [], pid: process.pid });
+    const seat = process.env.ELANOUS_HARNESS_SEAT;
+    const pidStart = processBirthId(process.pid);
+    saveSelfDevRun({ runId: spec.runId, createdAt: now, updatedAt: now, results: [], pid: process.pid,
+      ...(pidStart ? { pidStart } : {}),
+      ...(seat === 'OP' || seat === 'TC' || seat === 'MK' || seat === 'UX' ? { seat } : {}) });
     addSelfDevRunParticipant(spec.runId, {
       id: `process:${process.pid}`,
       kind: 'process',

package/src/self-dev/draft-sweep.ts

@@ -31,6 +31,8 @@ export interface DraftSweepAdapters {
   hasFinalRunResult?(draft: SweepDraft, repository: string): Promise<boolean | undefined>;
   /** Per-file last change on the draft branch; undefined means file coverage is unverified. */
   getLatestFileChanges?(draft: SweepDraft, repository: string): Promise<Readonly<Record<string, string>> | undefined>;
+  /** Optional merge-time file inventory for the existing all-files-landed decision. */
+  getPrFiles?(repository: string, number: number): Promise<readonly string[] | undefined>;
 }
 
 export interface DraftSweepOptions {
@@ -84,6 +86,80 @@ const PAGE_SIZE = 100;
 /** At most this many closes per tick, so a wrong rule cannot close everything at once. */
 export const DRAFT_SWEEP_CLOSE_CAP = 10;
 
+/** Post-merge shortcut: only the existing superseded-by decision can authorize a close. */
+export async function supersedeDraftsOnMerge(input: {
+  repository: string;
+  merged: SweepMergedPr & { createdAt: string; mergedAt: string };
+  adapters: Pick<DraftSweepAdapters, 'listDrafts' | 'listLiveBranches' | 'getRunStatus' | 'setLabels' | 'closeDraft'>
+    & Pick<Partial<DraftSweepAdapters>, 'getLatestFileChanges' | 'getPrFiles'>;
+}): Promise<{ closed: number[]; kept: number[] }> {
+  const { repository, merged, adapters } = input;
+  const closed: number[] = [];
+  const kept: number[] = [];
+  let drafts: SweepDraft[] = [];
+  let error: string | undefined;
+  const failed: number[] = [];
+  let closeAttempts = 0;
+  try {
+    const [listedDrafts, liveBranches] = await Promise.all([
+      collectPages((page, size) => adapters.listDrafts(page, size, repository)),
+      adapters.listLiveBranches(repository),
+    ]);
+    drafts = listedDrafts;
+    if (!liveBranches || !Number.isInteger(merged.number) || !merged.branch || !merged.title
+      || !Number.isFinite(Date.parse(merged.createdAt)) || !Number.isFinite(Date.parse(merged.mergedAt))
+      || drafts.some((pr) => !Number.isInteger(pr.number) || !pr.branch || !Array.isArray(pr.labels)
+        || !Number.isFinite(Date.parse(pr.createdAt)))) throw new Error('Incomplete merge draft inventory');
+    const statuses = new Map<number, string | undefined>();
+    const latestChanges = new Map<number, Readonly<Record<string, string>> | undefined>();
+    const mergedFiles = await adapters.getPrFiles?.(repository, merged.number);
+    const landed = { ...merged, changedFiles: mergedFiles };
+    for (const draft of drafts) {
+      if (draft.number !== merged.number && !liveBranches.has(draft.branch)
+        && Date.parse(draft.createdAt) < Date.parse(merged.mergedAt)) {
+        statuses.set(draft.number, await adapters.getRunStatus(draft, repository));
+        if (draft.changedFiles?.length && adapters.getLatestFileChanges) {
+          latestChanges.set(draft.number, await adapters.getLatestFileChanges(draft, repository));
+        }
+      }
+    }
+    for (const listedDraft of drafts) {
+      const draft = { ...listedDraft, latestFileChanges: latestChanges.get(listedDraft.number) };
+      if (draft.number === merged.number || liveBranches.has(draft.branch)
+        || Date.parse(draft.createdAt) >= Date.parse(merged.mergedAt)) {
+        kept.push(draft.number);
+        continue;
+      }
+      const decision = decideDraft({ draft, runStatus: statuses.get(draft.number),
+        mergedTwins: [landed], liveBranches, ageHours: NaN });
+      if (decision.action !== 'close' || !decision.reason.startsWith(`superseded-by #${merged.number}`)
+        || PR_LABELS.filter((entry) => entry.axis === 'state' && draft.labels.includes(entry.name)).length > 1
+        || (draft.labels.length === 0 && !draft.branch.startsWith('self-impl/'))
+        || closeAttempts >= DRAFT_SWEEP_CLOSE_CAP) {
+        kept.push(draft.number);
+        continue;
+      }
+      closeAttempts += 1;
+      const remove = stateLabels.filter((entry) => draft.labels.includes(entry.name) && entry.name !== supersededLabel).map((entry) => entry.name);
+      try {
+        // Label first: a failed label write must never strand a closed, unlabelled PR outside open-draft sweeps.
+        if (!draft.labels.includes(supersededLabel)) await adapters.setLabels(repository, draft.number, { add: supersededLabel, remove });
+        await adapters.closeDraft(repository, draft.number, `Draft sweep: superseded-by #${merged.number}. Branch preserved.`);
+        closed.push(draft.number);
+      } catch (failure) {
+        kept.push(draft.number);
+        failed.push(draft.number);
+        error = String(failure);
+      }
+    }
+  } catch (failure) {
+    error = String(failure);
+    kept.push(...drafts.map((draft) => draft.number).filter((number) => !closed.includes(number) && !kept.includes(number)));
+  }
+  debug.log('drafts.cleanup', 'superseded-on-merge', { merged: merged.number, closed, kept, ...(failed.length ? { failed } : {}), ...(error ? { error } : {}) });
+  return { closed, kept };
+}
+
 async function collectPages<T>(fetch: (page: number, perPage: number) => Promise<readonly T[]>): Promise<T[]> {
   const rows: T[] = [];
   for (let page = 1; page <= 100; page++) {

package/src/self-dev/run-store.ts

@@ -16,8 +16,9 @@
  * Cf. PLAN-parallel-self-dev-orchestrator-2026-07-21 §5 (S3).
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dlopen, FFIType } from 'bun:ffi';
 import { randomUUID } from 'node:crypto';
-import { debug } from '../debug/log.js';
+import { debug, redactSecretText } from '../debug/log.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { loadRunLedger, queryInterruptedRunLedgers, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 import { join, resolve, sep } from 'node:path';
@@ -68,6 +69,8 @@ export interface SelfDevRunState {
   createdAt: number;
   updatedAt: number;
   results: SelfDevJobResult[];
+  /** Redacted, bounded one-line projection for loop readers; legacy checkpoints omit it. */
+  summaryLine?: string;
   /** Undefined means a legacy checkpoint has no dependency information; each key is a shard ID and its array lists predecessor shard IDs. */
   dependencies?: Record<string, string[]>;
   /**
@@ -93,6 +96,10 @@ export interface SelfDevRunState {
    *  non-terminal goal 은 **실행중(running)** 이지 막힌(interrupted) 게 아니다. 죽었으면(오케스트레이터
    *  killed) 진짜 interrupted. isPidAlive 로 구분해 라이브 잡을 parked/repair-signals 에서 제외. */
   pid?: number;
+  /** OS process birth identity, paired with pid to reject a recycled pid. */
+  pidStart?: string;
+  /** Seat fixed at launch; survives removal of the launch worktree. */
+  seat?: 'OP' | 'TC' | 'MK' | 'UX';
 }
 
 /** `<ELANOUS_STATE_DIR or ~/.elanous>/self-dev-runs`. */
@@ -103,6 +110,34 @@ export function selfDevRunsDir(stateDir?: string): string {
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 
+/** Kernel process birth identity: Linux boot ID + start ticks or Darwin microseconds since epoch. */
+export function processBirthId(pid: number, platform: NodeJS.Platform = process.platform): string | undefined {
+  if (!Number.isSafeInteger(pid) || pid < 1) return undefined;
+  try {
+    if (platform === 'linux') {
+      const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+      const tail = stat.slice(stat.lastIndexOf(')') + 2).trim().split(/\s+/);
+      const ticks = tail[19]; // field 22 (starttime), after pid and parenthesized comm
+      const bootId = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+      return ticks && /^\d+$/.test(ticks) && /^[0-9a-f-]{36}$/i.test(bootId)
+        ? `linux:${bootId}:${ticks}` : undefined;
+    }
+    if (platform === 'darwin') {
+      const libproc = dlopen('/usr/lib/libproc.dylib', {
+        proc_pidinfo: { args: [FFIType.i32, FFIType.i32, FFIType.u64, FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
+      });
+      try {
+        const buf = new Uint8Array(136);
+        if (libproc.symbols.proc_pidinfo(pid, 3, 0n, buf, buf.length) !== buf.length) return undefined;
+        const view = new DataView(buf.buffer);
+        if (view.getUint32(12, true) !== pid) return undefined;
+        return `darwin:${view.getBigUint64(120, true) * 1_000_000n + view.getBigUint64(128, true)}`;
+      } finally { libproc.close(); }
+    }
+  } catch { /* Unreadable birth identity is not evidence of a match. */ }
+  return undefined;
+}
+
 function runPath(runId: string, dir: string): string {
   if (!RUN_ID.test(runId)) throw new Error(`invalid self-dev run ID: ${runId}`);
   const root = resolve(dir);
@@ -154,6 +189,40 @@ function mergeParticipants(
   return [...byId.values()];
 }
 
+const SUMMARY_LINE_LIMIT = 120;
+const FINISHED_RESULT_STATUSES = new Set(['done', 'failed', 'cancelled', 'superseded']);
+
+function boundedSummaryLine(text: string): string {
+  const redacted = redactSecretText(text.replace(/\s+/g, ' ').trim());
+  if (redacted.length <= SUMMARY_LINE_LIMIT) return redacted;
+  const head = redacted.slice(0, SUMMARY_LINE_LIMIT - 1).replace(/[\uD800-\uDBFF]$/, '');
+  return `${head}…`;
+}
+
+/** Read-only projection for loop readers; missing legacy fields are derived in memory. */
+export function runSummaryLine(state: SelfDevRunState): string {
+  if (state.summaryLine !== undefined) return boundedSummaryLine(state.summaryLine);
+  const feature = state.goals?.[0]?.feature ?? state.results[0]?.feature ?? '';
+  const head = feature.split(/\r?\n/, 1)[0]?.trim() ?? '';
+  const header = /^「하니스로 구현」\s+(\S+?)\s+—\s*(.*)$/.exec(head);
+  const id = state.goals?.[0]?.goalId ?? header?.[1] ?? state.goals?.[0]?.id ?? state.runId;
+  const phrase = (header?.[2] ?? head).split(/[.!?。；;]/, 1)[0]?.trim() ?? '';
+  const finished = state.results.length > 0
+    && state.results.every((result) => FINISHED_RESULT_STATUSES.has(result.status));
+  if (finished) {
+    // A completed shard cannot hide a failed one merely by settling later.
+    const result = state.results.find(({ status }) => status === 'failed')
+      ?? state.results.find(({ status }) => status === 'cancelled')
+      ?? state.results.find(({ status }) => status === 'superseded')
+      ?? state.results.at(-1)!;
+    const stage = result.stage ?? result.status;
+    const prNumber = result.prNumber ?? Number(/\/pull\/(\d+)(?:[/?#]|$)/.exec(result.prUrl ?? '')?.[1]);
+    const pr = Number.isSafeInteger(prNumber) && prNumber > 0 ? ` · PR #${prNumber}` : '';
+    return boundedSummaryLine(`${id} · ${stage}${pr}`);
+  }
+  return boundedSummaryLine(`「하니스로 구현」 ${id}${phrase ? ` — ${phrase}` : ''}`);
+}
+
 /** Persist a run checkpoint (fail-soft — never throws into the caller). */
 export function saveSelfDevRun(state: SelfDevRunState, dir = selfDevRunsDir()): void {
   try {
@@ -163,7 +232,10 @@ export function saveSelfDevRun(state: SelfDevRunState, dir = selfDevRunsDir()):
       const participants = mergeParticipants(current?.participants, state.participants);
       const saved = {
         ...state,
+        summaryLine: runSummaryLine({ ...state, goals: state.goals ?? current?.goals, summaryLine: undefined }),
         ...(participants === undefined ? {} : { participants }),
+        ...(current?.seat && !state.seat ? { seat: current.seat } : {}),
+        ...(current?.pidStart && current.pid === state.pid && !state.pidStart ? { pidStart: current.pidStart } : {}),
         ...(current?.parkedResolution && !state.parkedResolution ? { parkedResolution: current.parkedResolution } : {}),
       };
       writeSelfDevRun(saved, dir);

package/src/self-dev/run-supervisor.ts

@@ -5,6 +5,7 @@ import type { DeployVerifyFinding } from '../harness/browser-verify.js';
 import type { SelfDevJobResult } from './orchestrate.js';
 import { recordSelfDevRunSupervisorStop, selfDevRunsDir } from './run-store.js';
 import { debug } from '../debug/log.js';
+import { sweepFrozenMerges } from '../self-implement/frozen-merges.js';
 
 export interface SupervisorRound {
   round: number;
@@ -410,6 +411,7 @@ export interface SuperviseRunOptions {
   onRound?: (results: readonly SupervisorJobResult[]) => void;
   runStore?: { runId?: string; operatorDir?: string; dir?: string; isolatedDir?: string };
   observe?: (event: string, data: Record<string, unknown>) => void;
+  sweepPendingMerges?: typeof sweepFrozenMerges;
   observeDeliverables?: () => Promise<{
     readonly deployFindings: ReadonlyMap<string, { target: string; findings?: readonly DeployVerifyFinding[] | readonly unknown[] }>;
     readonly unmeasured: readonly unknown[];
@@ -432,6 +434,12 @@ export async function superviseRun(opts: SuperviseRunOptions): Promise<Superviso
   let history: SupervisorRound[] = [];
 
   for (;;) {
+    try {
+      const resumed = await (opts.sweepPendingMerges ?? sweepFrozenMerges)();
+      if (resumed.pending || resumed.merged) opts.observe?.('frozen-merges', resumed);
+    } catch (error) {
+      try { debug.log('harness.merge', 'resume-failed', { error: String(error) }); } catch { /* observation must not interrupt supervision */ }
+    }
     if (opts.enrich) results = [...opts.enrich(results)];
 
     let observed: {

package/src/self-dev/self-orchestrate-runtime.ts

@@ -13,7 +13,7 @@ import { posix as posixPath } from 'node:path';
 import type { LLMToolSpec } from '../llm.js';
 import type { ToolRuntime, ToolRuntimeContext } from '../tool-runtime/types.js';
 import { orchestrateSelfDev, type SelfDevJobResult, type OrchestrateSelfDevOptions, type SelfDevGoal } from './orchestrate.js';
-import type { SelfDevRunParticipant, SelfDevRunState } from './run-store.js';
+import { processBirthId, type SelfDevRunParticipant, type SelfDevRunState } from './run-store.js';
 import { HARNESS_RUN_ID_ENV, resolveRunIdentity as defaultResolveRunIdentity } from '../harness/harness-space.js';
 import { decomposeSelfDevGoal, type SelfDevDecomposition, type SelfDevDecomposeOptions } from './decompose.js';
 import { decomposeFabricRequest, type FabricDecomposeRequestOptions, type FabricDecomposeRequestResult } from './fabric-decompose-adapter.js';
@@ -302,6 +302,7 @@ interface OrchestrateRunLedgerInput {
   readonly prior: Pick<SelfDevRunState, 'dependencies' | 'results'> | null;
   readonly goals: readonly SelfDevGoal[];
   readonly pid: number;
+  readonly seat?: SelfDevRunState['seat'];
   readonly runIdSource: SelfDevRunParticipant['runIdSource'];
   readonly now: () => number;
   readonly onPersistenceFailure?: (stage: 'checkpoint' | 'participant', error: unknown) => void;
@@ -421,6 +422,7 @@ export function bindOrchestrateRunLedger(
   input: OrchestrateRunLedgerInput,
 ): OrchestrateRunLedgerBinding {
   const dependencies = deps.checkpointDependencies(input.prior, input.goals);
+  const pidStart = processBirthId(input.pid);
   const checkpoint = (results: SelfDevRunState['results']): void => {
     try {
       deps.saveRun({
@@ -431,6 +433,8 @@ export function bindOrchestrateRunLedger(
         dependencies,
         goals: [...input.goals],
         pid: input.pid,
+        ...(pidStart ? { pidStart } : {}),
+        ...(input.seat ? { seat: input.seat } : {}),
       });
     } catch (error) {
       if (input.onPersistenceFailure) input.onPersistenceFailure('checkpoint', error);

package/src/self-implement/budget-gate.ts

@@ -3,8 +3,10 @@
 
 import type { RotationCandidate } from '../oauth/codex-account-rotation.js';
 import { inspectCodexRotation } from '../oauth/codex-account-store.js';
+import { codexPolicyAllowsCredits } from '../oauth/codex-quota-policy.js';
 import { getUsageStore } from '../budget/usage-store.js';
 import type { UsageSnapshot } from '../budget/types.js';
+import { debug } from '../debug/log.js';
 import {
   DEFAULT_BUDGET_GATE_MAX_USED_PERCENT,
   type BudgetGateMaxUsedPercent,
@@ -25,6 +27,9 @@ export interface BudgetCodexCandidate {
   readonly name: string;
   readonly reached?: boolean;
   readonly usedPercent?: number;
+  /** 선불 크레딧 잔액(계정에 귀속된 신호만). 모르면 비운다. */
+  readonly creditBalance?: number;
+  readonly hasCredits?: boolean;
 }
 
 export interface DecideBudgetInput {
@@ -36,6 +41,8 @@ export interface DecideBudgetInput {
   /** 주간 사용률. `undefined` 는 «모름» — 쓸 수 있다고 보지 않는다. */
   readonly grokUsedPercent: number | undefined;
   readonly maxUsedPercent: BudgetGateMaxUsedPercent;
+  /** codex 한도 정책이 credits 인가(`codexPolicyAllowsCredits` · 회전·Pod 배분과 같은 해석). 없으면 false. */
+  readonly codexCreditsAllowed?: boolean;
 }
 
 export interface BudgetDecision {
@@ -50,6 +57,7 @@ export interface BudgetInputs {
   readonly codexCandidates: readonly BudgetCodexCandidate[];
   readonly grokUsedPercent: number | undefined;
   readonly maxUsedPercent: BudgetGateMaxUsedPercent;
+  readonly codexCreditsAllowed?: boolean;
 }
 
 const WEEKLY_WINDOW_MINUTES = 7 * 24 * 60;
@@ -98,6 +106,16 @@ function codexCandidateUsable(candidate: BudgetCodexCandidate, cap: number | und
   return candidate.usedPercent < cap;
 }
 
+/** BUDGET-GATE(10-05) — 정책이 credits 면 구독 % 가 차도 크레딧 잔액이 «확인된» 계정으로 계속 간다(Pod 배분과 같은 결론).
+ *  잔액을 모르면 쓰지 않는다 — 크레딧은 돈이라 fail-closed. 잔액이 가장 큰 계정 하나를 돌려준다. */
+function codexCreditCandidate(input: DecideBudgetInput): BudgetCodexCandidate | undefined {
+  if (input.codexCreditsAllowed !== true) return undefined;
+  return input.codexCandidates
+    .filter((candidate) => candidate.hasCredits !== false
+      && typeof candidate.creditBalance === 'number' && Number.isFinite(candidate.creditBalance) && candidate.creditBalance > 0)
+    .sort((a, b) => (b.creditBalance! - a.creditBalance!) || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))[0];
+}
+
 function slotUsable(
   provider: string,
   input: DecideBudgetInput,
@@ -106,6 +124,13 @@ function slotUsable(
   if (provider === CODEX_PROVIDER) {
     const cap = capFor(input.maxUsedPercent, CODEX_PROVIDER);
     const measuredUsable = input.codexCandidates.some((candidate) => codexCandidateUsable(candidate, cap));
+    const credit = measuredUsable ? undefined : codexCreditCandidate(input);
+    if (credit) {
+      try {
+        debug.log('budget.gate', 'credits-allowed', { used: credit.usedPercent ?? null, balance: credit.creditBalance, policy: 'credits' });
+      } catch { /* observation is fail-soft */ }
+      return { usable: true, reason: `${formatCodexReason(input.codexCandidates, cap)} · credits allowed (balance ${credit.creditBalance})` };
+    }
     const unmeasured = allowUnmeasured && !measuredUsable && (input.codexCandidates.length === 0
       || input.codexCandidates.some((candidate) => candidate.reached !== true
         && (typeof candidate.usedPercent !== 'number' || !Number.isFinite(candidate.usedPercent))));
@@ -188,6 +213,8 @@ export function codexCandidatesFromRotation(
     name: candidate.name,
     ...(candidate.reached !== undefined ? { reached: candidate.reached } : {}),
     ...(candidate.usedPercent !== undefined ? { usedPercent: candidate.usedPercent } : {}),
+    ...(candidate.creditBalance !== undefined ? { creditBalance: candidate.creditBalance } : {}),
+    ...(candidate.hasCredits !== undefined ? { hasCredits: candidate.hasCredits } : {}),
   }));
 }
 
@@ -212,6 +239,8 @@ export function readBudgetInputs(deps: ReadBudgetInputsDeps = {}): BudgetInputs
     codexCandidates: codexCandidatesFromRotation(rotation.candidates),
     grokUsedPercent: grokWeeklyUsedPercent(snapshot),
     maxUsedPercent,
+    // 회전·Pod 배분과 같은 해석(`resolveCodexQuotaPolicy` → `codexPolicyAllowsCredits`)을 읽는다 — 다시 짓지 않는다.
+    ...(rotation.policy && codexPolicyAllowsCredits(rotation.policy.policy) ? { codexCreditsAllowed: true } : {}),
   };
 }
 

package/src/self-implement/expose-gate.ts

@@ -0,0 +1,47 @@
+import { spawnSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+
+type ExposeMode = 'warn' | 'strict';
+type ProcessResult = { status: number | null; stdout?: string; stderr?: string; error?: Error };
+type ExposeResult = { passed: boolean; log: string };
+
+/** The rubric only accepts root-level public Markdown documents. */
+export function publicExposureFiles(changed: readonly string[]): string[] {
+  return [...new Set(changed.filter((file) => /^release\/public\/docs\/[^/]+\.md$/.test(file)))];
+}
+
+export function runExposeGate(
+  cwd: string,
+  changed: readonly string[],
+  mode: ExposeMode,
+  run: (command: string, args: string[], cwd: string) => ProcessResult = (command, args, dir) => {
+    const result = spawnSync(command, args, { cwd: dir, encoding: 'utf8', timeout: 300_000 });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '', error: result.error };
+  },
+): ExposeResult {
+  const files = publicExposureFiles(changed);
+  if (files.length === 0) return { passed: true, log: '' };
+  let unreviewed: number | null = null;
+  let failed: number | null = null;
+  let docs: number | null = null;
+  let error = '';
+  try {
+    const result = run('bun', ['scripts/expose-rubric-check.ts', '--json', '--files', ...files], cwd);
+    if (result.status !== 0 || result.error) throw new Error(result.stderr?.trim() || result.error?.message || `exit ${result.status}`);
+    const parsed = JSON.parse(result.stdout ?? '') as Record<string, unknown>;
+    const lists = ['missing', 'orphan', 'failing', 'internal', 'unreviewed', 'unjudged'] as const;
+    if (!Number.isSafeInteger(parsed.docs) || (parsed.docs as number) < 0 || !lists.every((key) => Array.isArray(parsed[key]))) {
+      throw new Error('invalid exposure rubric JSON');
+    }
+    docs = parsed.docs as number;
+    unreviewed = new Set([...(parsed.missing as string[]), ...(parsed.unjudged as string[])]).size;
+    failed = new Set([...(parsed.orphan as string[]), ...(parsed.failing as Array<{ path: string }>).map((item) => item.path), ...(parsed.internal as string[])]).size;
+  } catch (cause) {
+    error = cause instanceof Error ? cause.message : String(cause);
+  }
+  try { debug.log('self-implement.gate', 'expose', { files, unreviewed, failed, mode }); } catch { /* observation must not change judgment */ }
+  const log = docs === null
+    ? `[expose] 못 쟀다 — ${error}`
+    : `[expose] ${files.length}개 · 미판정 ${unreviewed} · fail ${failed}`;
+  return { passed: mode === 'warn' || (docs !== null && unreviewed === 0 && failed === 0), log };
+}