elanous 0.2.13 → 0.2.15

package/src/harness/helper-repair.ts

@@ -0,0 +1,87 @@
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { debug } from '../debug/log.js';
+import type { RunGh, ScannedStoppedPr, StoppedPrCategory } from './helper-scan.js';
+
+export interface RepairGoalInput {
+  pr: number;
+  category: StoppedPrCategory;
+  /** The original user's request, not the supervisor's stop report or a paraphrase. */
+  originalRequest: string;
+  /** Remaining reviewer must-fix items, in their original wording and order. */
+  mustFix: readonly string[];
+}
+
+/** Author a single follow-up goal without changing the original ask or reviewer findings. */
+export function authorRepairGoal({ pr, category, originalRequest, mustFix }: RepairGoalInput): string | null {
+  if ((category !== 'review-budget' && category !== 'review-oscillation') || !originalRequest.trim() || !mustFix.length || mustFix.some((item) => !item.trim())) {
+    return null;
+  }
+
+  const guidance = category === 'review-oscillation'
+    ? '기존 시험 설계를 보존하고 리뷰 진동·설계 역행을 확인한 뒤 남은 must-fix를 수리하라.'
+    : '남은 must-fix를 수리하라. 원래 요청의 범위와 기존 시험 설계를 보존하라.';
+  return `${originalRequest}${originalRequest.endsWith('\n') ? '' : '\n'}\n## PR #${pr} 수리\n${guidance}\n\n## 남은 must-fix (원문)\n${mustFix.join('\n')}`;
+}
+
+/** PR 본문에서 원 요청(## 요청 절)과 남은 must-fix(## 마지막 리뷰 must-fix · ## Follow-up must-fix 의 «- » 항목)를 원문 그대로 뽑는다. */
+export function repairInputsFromBody(body: string): { originalRequest: string; mustFix: string[] } {
+  const section = (title: RegExp) => {
+    const lines = body.split('\n');
+    const start = lines.findIndex((line) => title.test(line));
+    if (start < 0) return [] as string[];
+    const end = lines.findIndex((line, index) => index > start && /^## /.test(line));
+    return lines.slice(start + 1, end < 0 ? undefined : end);
+  };
+  const requestLines = section(/^## 요청\s*$/);
+  while (requestLines[0] === '') requestLines.shift();
+  while (requestLines.length > 1 && requestLines.at(-1) === '' && requestLines.at(-2) === '') requestLines.pop();
+  if (requestLines.length === 2 && requestLines[1] === '') requestLines.pop();
+  const originalRequest = requestLines.join('\n');
+  const mustFix: string[] = [];
+  for (const lines of [section(/^## 마지막 리뷰 must-fix/), section(/^## Follow-up must-fix/)]) {
+    let item: string[] = [];
+    const flush = () => {
+      while (item.at(-1) === '') item.pop();
+      if (item.length) mustFix.push(item.join('\n'));
+      item = [];
+    };
+    for (const line of lines) {
+      if (/^- /.test(line)) {
+        flush();
+        item.push(line);
+      } else if (item.length) {
+        item.push(line);
+      }
+    }
+    flush();
+  }
+  return { originalRequest, mustFix };
+}
+
+export type RepairShadowRow = { pr: number; category: StoppedPrCategory; goalHash: string; at: string };
+
+/** 그림자: 수리 골을 저작해 헬퍼 원장에만 남긴다(발사·라벨 0) · 같은 PR 은 한 번만. */
+export async function recordRepairShadows(rows: readonly ScannedStoppedPr[], deps: { runGh: RunGh; root: string; now?: Date }): Promise<RepairShadowRow[]> {
+  const ledger = join(deps.root, 'helper', 'repairs.jsonl');
+  const seen = new Set<number>();
+  if (existsSync(ledger)) for (const line of readFileSync(ledger, 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    try { seen.add((JSON.parse(line) as { pr: number }).pr); } catch { /* malformed line is skipped */ }
+  }
+  const written: RepairShadowRow[] = [];
+  for (const row of rows) {
+    if ((row.category !== 'review-budget' && row.category !== 'review-oscillation') || seen.has(row.pr)) continue;
+    const view = JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'body'])) as { body: string };
+    const goal = authorRepairGoal({ pr: row.pr, category: row.category, ...repairInputsFromBody(view.body) });
+    if (!goal) continue;
+    const entry: RepairShadowRow = { pr: row.pr, category: row.category, goalHash: createHash('sha256').update(goal).digest('hex').slice(0, 16), at: (deps.now ?? new Date()).toISOString() };
+    mkdirSync(dirname(ledger), { recursive: true });
+    appendFileSync(ledger, JSON.stringify({ ...entry, mode: 'shadow', goal }) + '\n');
+    debug.log('harness.helper', 'repair-authored', { pr: row.pr, category: row.category, mode: 'shadow' });
+    seen.add(row.pr);
+    written.push(entry);
+  }
+  return written;
+}

package/src/harness/helper-scan.ts

@@ -0,0 +1,151 @@
+import { execFileSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+
+export type StoppedPrCategory = 'review-budget' | 'no-progress' | 'environment-gap' | 'memo-not-reflected' | 'review-oscillation' | 'goal-revision' | 'report-deficit' | 'unknown';
+export type StoppedPrClassification = {
+  category: StoppedPrCategory;
+  signals: string[];
+  firstAction: string;
+  blockers: string[];
+  blockerCount: number;
+  hasPublicExportLeak: boolean;
+};
+
+function section(body: string, title: string): string {
+  const heading = `## ${title}`;
+  const lines = body.split(/\r?\n/);
+  const start = lines.findIndex((line) => line.trim() === heading);
+  if (start < 0) return '';
+  const end = lines.findIndex((line, i) => i > start && /^##\s+/.test(line));
+  return lines.slice(start + 1, end < 0 ? undefined : end).join('\n');
+}
+
+function field(text: string, key: string): string {
+  const line = text.split(/\r?\n/).find((entry) => new RegExp(`^\\s*(?:[-*]\\s*)?(?:\\*\\*)?${key}(?:\\*\\*)?\\s*[:：]\\s*`, 'i').test(entry));
+  return line?.replace(new RegExp(`^\\s*(?:[-*]\\s*)?(?:\\*\\*)?${key}(?:\\*\\*)?\\s*[:：]\\s*`, 'i'), '').trim().replace(/^`|`$/g, '') ?? '';
+}
+
+export function classifyStoppedPr({ body, comments }: { body: string; comments: readonly (string | { body: string })[] }): StoppedPrClassification {
+  const stop = section(body, '중단 사유');
+  const classification = section(body, '중단 원인 분류');
+  const gate = section(body, 'Gate');
+  const reason = field(stop, 'reason');
+  const verdict = field(stop, 'verdict');
+  const label = field(classification, 'classification');
+  const basis = field(classification, 'classificationBasis');
+  const commentText = comments.map((comment) => typeof comment === 'string' ? comment : comment.body);
+  const signals = [reason, verdict, label, basis].filter(Boolean);
+  const allBlockers = gate.split(/\r?\n/).filter((line) => /^\s*(?:✗\s+|\[test\]\s+FAIL\b)/i.test(line));
+  const blockers = allBlockers.slice(0, 5);
+  const publicExportLeak = allBlockers.find((line) => /^\s*✗\s+public-export-leak\b/i.test(line));
+  if (publicExportLeak && !blockers.includes(publicExportLeak)) signals.push(publicExportLeak);
+  const failedTests = allBlockers.filter((line) => /^\s*\[test\]\s+FAIL\b.*[—–-](?:\s*\d+\s+(?:pass|fail|skip|errors?)\b\s*[,|])*\s*[1-9]\d*\s+errors?\b/i.test(line));
+  const failedPwaTest = failedTests.find((line) => /\bapps\/pwa\/[^\s]*\.test\.tsx?\b/i.test(line));
+  if (failedPwaTest) signals.push(failedPwaTest);
+  const hostRetest = /(?:^|;\s*)host=[^;\n]+;\s*cause=(?:missing (?:node_modules|dependency|environment variable)|호스트 의존성 없음)[^;\n]*;\s*retest=PASS bun test (\S+\.test\.tsx?)(?:\s*(?:;|$))/i.exec(basis);
+  // A code error in the Gate outranks any written basis: a basis string alone never turns a code failure into an environment gap.
+  const codeErrorInGate = /\b(?:TypeError|ReferenceError|SyntaxError|RangeError)\b|expect\(received\)/.test(gate);
+  const hostFailureConfirmed = !codeErrorInGate && Boolean(hostRetest && failedTests.some((line) => {
+    const failedPath = /^\s*\[test\]\s+FAIL\s+bun test (\S+\.test\.tsx?)\s+[—–-]/i.exec(line)?.[1];
+    return failedPath === hostRetest?.[1];
+  }));
+  const reviews = commentText.flatMap((text) => {
+    const round = Number(/<!--\s*elanous-pr-comment v1 role=reviewer round=(\d+)\b/.exec(text)?.[1] ?? /\bRound\s+(\d+):\s*reviewer requested\b/i.exec(text)?.[1] ?? -1);
+    const mustFix = /\bRound\s+\d+:\s*reviewer requested\s+(\d+)\s+must-fix change\(s\)/i.exec(text);
+    return mustFix ? [{ round, count: Number(mustFix[1]), evidence: mustFix[0] }] : [];
+  }).sort((a, b) => b.round - a.round);
+  const latest = reviews[0];
+  if (latest) signals.push(latest.evidence);
+
+  const stopEvidence = `${reason}\n${verdict}\n${label}\n${basis}\n${body.match(/정지\((?:needs-human|no-progress)\)/g)?.join('\n') ?? ''}`;
+  let category: StoppedPrCategory = 'unknown';
+  let action = '하지 않음 — 정지 원인 근거 부족';
+  if (hostFailureConfirmed && failedTests.length > 0 && (/(?:자식\s*무관|environment(?:-gap|al)?|환경\s*결손)/i.test(`${label}\n${basis}`) || failedPwaTest)) {
+    category = 'environment-gap';
+    action = '그래프 인스턴스 성형 — 호스트에서 실패 시험만 재측; 원 Gate 보존';
+  } else if (/(?:메모\s*미반영|memo[- ]not[- ]reflected)/i.test(`${label}\n${basis}\n${reason}`)) {
+    category = 'memo-not-reflected';
+    action = '안내 메모 — 동일 칸의 살아 있는 런과 다음 산출 대조; 대상 불명이면 하지 않음';
+  } else if (/(?:리뷰\s*진동|설계\s*역행|review[- ]oscillation)/i.test(`${label}\n${basis}\n${reason}`)) {
+    category = 'review-oscillation';
+    action = latest?.count ? '헬퍼 자식 spawn — 기존 시험 설계 보존 후 한 라운드' : '하지 않음 — 구체적인 must-fix 없음';
+  } else if (label === 'goal-unconvergeable-candidate' || basis === 'supervisor-unconvergeable-goal-candidate') {
+    category = 'goal-revision';
+    signals.push(label === 'goal-unconvergeable-candidate'
+      ? `classification=${label} → goal-revision`
+      : `classificationBasis=${basis} → goal-revision`);
+    action = '골 개정 — 골 문면(판정 신호·경계)을 고쳐 재발사; 구현 자식 붙이지 않음';
+  } else if (label === 'report-deficit') {
+    category = 'report-deficit';
+    signals.push(`classification=${label} → report-deficit`);
+    action = '증거 재측 — 인용된 판정 명령을 호스트에서 다시 돌려 결과를 PR 에 남김; 코드 수정 아님';
+  } else if (/review-budget/i.test(stopEvidence) || basis === 'must-fix-reported') {
+    // Real supervisor bodies (UNCONVERGEABLE · implementation-deficit) carry `classificationBasis: must-fix-reported` instead of the RFC word.
+    if (basis === 'must-fix-reported') signals.push('classificationBasis=must-fix-reported → review-budget');
+    category = 'review-budget';
+    action = latest?.count ? '헬퍼 자식 spawn — must-fix 원문과 기존 시험 설계로 한 라운드' : '하지 않음 — must-fix 0 또는 미관측; 수리 자식 대상 아님';
+  } else if (/no-progress/i.test(stopEvidence) || basis === 'no-must-fix-without-clean-worktree-or-completed-without-changes') {
+    if (basis === 'no-must-fix-without-clean-worktree-or-completed-without-changes') signals.push(`classificationBasis=${basis} → no-progress`);
+    category = 'no-progress';
+    const green = /\[test\]\s+PASS\b/.test(gate) && !/\[test\]\s+FAIL\b/.test(gate);
+    const documentGoal = /(?:문서\s*(?:골|목표)|docs?\/|RFC)/i.test(`${reason}\n${basis}\n${body.split(/\r?\n/)[0] ?? ''}`);
+    action = green && latest?.count === 0 && documentGoal
+      ? '중간 착지 ⊕ 연결 골 — must-fix 0 · 시험 초록 · 문서 골이면 잔여 확인; 잔여 0이면 연결 골 하지 않음'
+      : '중간 착지 ⊕ 연결 골 — 녹색 조각만 확인; 불가분 골·실패 Gate 착지 하지 않음';
+  }
+  return {
+    category, signals,
+    firstAction: allBlockers.length
+      ? `Gate 차단 먼저${publicExportLeak ? ' (✗ public-export-leak 확인)' : category === 'environment-gap' ? ' (그래프 인스턴스 성형으로 호스트 실패 시험 재측)' : ''}`
+      : action,
+    blockers, blockerCount: allBlockers.length, hasPublicExportLeak: Boolean(publicExportLeak),
+  };
+}
+
+/** Stopped means the supervisor wrote a stop verdict or reason into the `## 중단 사유` section — a quoted heading or stop wording elsewhere in the body (goal text, templates) does not count. */
+export function isStoppedPrBody(body: string): boolean {
+  const stop = section(body, '중단 사유');
+  return Boolean(field(stop, 'verdict') || field(stop, 'reason'));
+}
+
+export type ScannedStoppedPr = StoppedPrClassification & { pr: number; headRefName: string; isDraft: boolean };
+export type RunGh = (args: readonly string[]) => string | Promise<string>;
+
+export async function scanStoppedPrs({ runGh }: { runGh: RunGh }): Promise<ScannedStoppedPr[]> {
+  const prs = JSON.parse(await runGh(['pr', 'list', '--state', 'open', '--limit', '100000', '--json', 'number,headRefName,isDraft,body'])) as Array<{ number: number; headRefName: string; isDraft: boolean; body: string }>;
+  const results: ScannedStoppedPr[] = [];
+  for (const pr of prs) {
+    if (!pr.headRefName.startsWith('self-impl/') || !isStoppedPrBody(pr.body)) continue;
+    const data = JSON.parse(await runGh(['pr', 'view', String(pr.number), '--json', 'comments'])) as { comments: Array<{ body: string }> };
+    const result = classifyStoppedPr({ body: pr.body, comments: data.comments });
+    debug.log('harness.helper', 'classified', { pr: pr.number, category: result.category, firstAction: result.firstAction, blockers: result.blockers, blockerCount: result.blockerCount, hasPublicExportLeak: result.hasPublicExportLeak });
+    results.push({ pr: pr.number, headRefName: pr.headRefName, isDraft: pr.isDraft, ...result });
+  }
+  return results;
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const json = args.includes('--json');
+  const recordShadows = args.includes('--record-shadows');
+  if (args.some((arg) => arg !== '--json' && arg !== '--record-shadows') || (json && recordShadows) || args.length > 1) {
+    console.error('사용법: bun src/harness/helper-scan.ts [--json | --record-shadows]');
+    process.exitCode = 1;
+  } else {
+    // 열린 PR 본문 전체는 기본 버퍼(1MB)를 넘는다(10-05 운영 ENOBUFS) — 넉넉히 준다.
+    const runGh = (args: readonly string[]) => execFileSync('gh', [...args], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+    const rows = await scanStoppedPrs({ runGh });
+    if (recordShadows) {
+      // 명시적 그림자 기록에서만 추가 PR 조회와 헬퍼 원장 쓰기를 수행한다(발사 0).
+      const { recordRepairShadows } = await import('./helper-repair.js');
+      const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+      const shadows = await recordRepairShadows(rows, { runGh, root: effectiveInstanceRoot() });
+      if (shadows.length) console.log(`수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
+    }
+    if (json) console.log(JSON.stringify(rows, null, 2));
+    else for (const row of rows) {
+      const gate = row.blockerCount ? ` · Gate 차단 ${row.blockerCount}(${row.hasPublicExportLeak ? row.blockers.find((line) => /public-export-leak/i.test(line))?.trim() ?? '✗ public-export-leak (6번째 이후)' : row.blockers[0]!.trim()})` : '';
+      console.log(`#${row.pr} ${row.category}${gate} → ${row.firstAction}`);
+    }
+  }
+}

package/src/harness/launch-stamp.ts

@@ -0,0 +1,236 @@
+/**
+ * ONEDOOR-1 — every harness run stamps which door it came through,
+ * who launched it, and whether it went through the queue.
+ *
+ * The stamp lives on the run ledger's first row (`run-origin`). A ledger
+ * written before this stamp, or a launch that named no door, reads as
+ * `unknown` — that is distinct from a count of zero.
+ */
+import { readdirSync } from 'node:fs';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
+
+export const LAUNCH_DOORS = [
+  'harness-say',
+  'harness-ask',
+  'dev-ask',
+  'self-implement',
+  'self-orchestrate',
+  'queue-tick',
+  'agent-mission',
+  'daemon-tool',
+  'telegram',
+  'pwa',
+  'unknown',
+] as const;
+
+export type LaunchDoor = (typeof LAUNCH_DOORS)[number];
+
+export const LAUNCH_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+export type LaunchSeat = (typeof LAUNCH_SEATS)[number];
+
+export interface LaunchStamp {
+  readonly entrance: LaunchDoor;
+  /** Seat, human session, or loop name — whichever the launch actually named. */
+  readonly actor: string;
+  readonly viaQueue: boolean;
+  readonly queueId?: string;
+}
+
+const ENTRANCE_TO_DOOR: Readonly<Record<string, LaunchDoor>> = {
+  'cli-harness-say': 'harness-say',
+  'cli-harness-ask': 'harness-ask',
+  'cli-dev-ask': 'dev-ask',
+  'cli-drive': 'dev-ask',
+  'tui-slash-ask': 'dev-ask',
+  'tui-slash-dev': 'dev-ask',
+  'cli-self-implement': 'self-implement',
+  'nl-self-implement': 'self-implement',
+  'daemon-self-implement': 'daemon-tool',
+  'cli-self-orchestrate': 'self-orchestrate',
+  'nl-self-orchestrate': 'self-orchestrate',
+  'cli-harness-orchestrate': 'self-orchestrate',
+  'cli-harness-mission': 'agent-mission',
+  'agent-mission': 'agent-mission',
+  'daemon-harness-ask': 'daemon-tool',
+  'daemon-tool': 'daemon-tool',
+  telegram: 'telegram',
+  pwa: 'pwa',
+};
+
+const DOOR_SET = new Set<string>(LAUNCH_DOORS);
+
+export function isLaunchDoor(value: string): value is LaunchDoor {
+  return DOOR_SET.has(value);
+}
+
+/** Reuse an existing entrance tag. Anything unnamed or unrecognized is `unknown`, never a zero. */
+export function doorFromEntrance(entrance: string | undefined | null): LaunchDoor {
+  if (!entrance) return 'unknown';
+  const trimmed = entrance.trim();
+  if (!trimmed) return 'unknown';
+  if (ENTRANCE_TO_DOOR[trimmed]) return ENTRANCE_TO_DOOR[trimmed];
+  if (isLaunchDoor(trimmed)) return trimmed;
+  return 'unknown';
+}
+
+export interface LaunchStampInput {
+  readonly entrance?: string | null;
+  readonly seat?: string | null;
+  readonly session?: string | null;
+  readonly loopName?: string | null;
+  readonly viaQueue?: boolean;
+  readonly queueId?: string | null;
+  readonly env?: NodeJS.ProcessEnv;
+}
+
+function named(value: string | null | undefined): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+/** Seat wins, then the human session, then the loop name. A blank actor stays blank. */
+export function resolveLaunchActor(input: LaunchStampInput, env: NodeJS.ProcessEnv = process.env): string {
+  const seat = named(input.seat) ?? named(env.ELANOUS_HARNESS_SEAT);
+  if (seat && (LAUNCH_SEATS as readonly string[]).includes(seat)) return seat;
+  return named(input.session)
+    ?? named(env.ELANOUS_ORIGIN_SESSION)
+    ?? named(input.loopName)
+    ?? named(env.ELANOUS_LOOP_NAME)
+    ?? '';
+}
+
+export function resolveLaunchStamp(input: LaunchStampInput = {}, env: NodeJS.ProcessEnv = input.env ?? process.env): LaunchStamp {
+  const queueId = named(input.queueId) ?? named(env.ELANOUS_HARNESS_QUEUE_LAUNCH);
+  const viaQueue = input.viaQueue === true || queueId !== undefined;
+  const door = viaQueue ? 'queue-tick' : doorFromEntrance(input.entrance ?? env.ELANOUS_HARNESS_ENTRANCE);
+  return {
+    entrance: door,
+    actor: resolveLaunchActor(input, env),
+    viaQueue,
+    ...(queueId ? { queueId } : {}),
+  };
+}
+
+/** Read the stamp off a ledger's first row. Missing or unreadable stamps are `unknown`. */
+export function launchStampFromLedger(entries: readonly RunLedgerEntry[] | null | undefined): LaunchStamp {
+  const first = entries?.[0];
+  const raw = first?.data?.launch;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { entrance: 'unknown', actor: '', viaQueue: false };
+  }
+  const launch = raw as Record<string, unknown>;
+  const entrance = typeof launch.entrance === 'string' && isLaunchDoor(launch.entrance) ? launch.entrance : 'unknown';
+  const queueId = typeof launch.queueId === 'string' && launch.queueId.trim() ? launch.queueId.trim() : undefined;
+  return {
+    entrance,
+    actor: typeof launch.actor === 'string' ? launch.actor : '',
+    viaQueue: launch.viaQueue === true || queueId !== undefined,
+    ...(queueId ? { queueId } : {}),
+  };
+}
+
+export interface DoorRow {
+  readonly entrance: LaunchDoor;
+  readonly runs: number;
+  readonly viaQueue: number;
+  readonly outsideQueue: number;
+}
+
+export interface DoorTable {
+  readonly sinceMs: number;
+  readonly runs: number;
+  readonly unknown: number;
+  readonly outsideQueue: number;
+  readonly viaQueue: number;
+  readonly rows: readonly DoorRow[];
+}
+
+export interface DoorTableOptions {
+  readonly dir?: string;
+  readonly sinceMs?: number;
+  readonly now?: number;
+  readonly list?: (dir: string) => string[];
+  readonly load?: (runId: string, dir: string) => RunLedgerEntry[] | null;
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function entryTime(entry: RunLedgerEntry | undefined): number | undefined {
+  if (!entry?.timestamp) return undefined;
+  const parsed = Date.parse(entry.timestamp);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+/** One row per door that actually fired, plus the period totals. Untagged ledgers count as `unknown`. */
+export function queryLaunchDoors(options: DoorTableOptions = {}): DoorTable {
+  const dir = options.dir ?? runLedgerDir();
+  const now = options.now ?? Date.now();
+  const sinceMs = options.sinceMs ?? DAY_MS;
+  const cutoff = now - sinceMs;
+  const list = options.list ?? ((path: string) => {
+    try { return readdirSync(path); } catch { return []; }
+  });
+  const load = options.load ?? ((runId: string, ledgerDir: string) => {
+    try { return loadRunLedger(runId, ledgerDir); } catch { return null; }
+  });
+  const counts = new Map<LaunchDoor, { runs: number; viaQueue: number }>();
+  let runs = 0;
+  let unknown = 0;
+  let outsideQueue = 0;
+  let viaQueue = 0;
+  for (const file of list(dir)) {
+    if (!file.endsWith('.jsonl')) continue;
+    const runId = file.slice(0, -'.jsonl'.length);
+    const entries = load(runId, dir);
+    if (!entries || entries.length === 0) continue;
+    const started = entryTime(entries[0]);
+    if (started !== undefined && started < cutoff) continue;
+    const stamp = launchStampFromLedger(entries);
+    runs += 1;
+    if (stamp.entrance === 'unknown') unknown += 1;
+    if (stamp.viaQueue) viaQueue += 1;
+    else outsideQueue += 1;
+    const row = counts.get(stamp.entrance) ?? { runs: 0, viaQueue: 0 };
+    row.runs += 1;
+    if (stamp.viaQueue) row.viaQueue += 1;
+    counts.set(stamp.entrance, row);
+  }
+  const rows = [...counts.entries()]
+    .map(([entrance, row]) => ({
+      entrance,
+      runs: row.runs,
+      viaQueue: row.viaQueue,
+      outsideQueue: row.runs - row.viaQueue,
+    }))
+    .sort((left, right) => right.runs - left.runs || left.entrance.localeCompare(right.entrance));
+  return { sinceMs, runs, unknown, outsideQueue, viaQueue, rows };
+}
+
+export function renderLaunchDoors(table: DoorTable): string {
+  const lines = [
+    `doors  runs=${table.runs}  outside-queue=${table.outsideQueue}  via-queue=${table.viaQueue}  unknown=${table.unknown}`,
+    'entrance          runs  via-queue  outside-queue',
+  ];
+  for (const row of table.rows) {
+    lines.push(`${row.entrance.padEnd(16)} ${String(row.runs).padStart(4)}  ${String(row.viaQueue).padStart(9)}  ${String(row.outsideQueue).padStart(13)}`);
+  }
+  if (table.rows.length === 0) lines.push('(no runs)');
+  const summed = table.rows.reduce((sum, row) => sum + row.runs, 0);
+  lines.push(`total            ${String(summed).padStart(4)}`);
+  return lines.join('\n');
+}
+
+const SINCE_PATTERN = /^(\d+)(m|h|d)$/;
+
+/** `--since 1d` (also `30m`, `12h`). Anything else is refused rather than guessed. */
+export function parseDoorSince(value: string | undefined, now = Date.now()): { sinceMs: number } | { error: string } {
+  if (value === undefined || value === '') return { sinceMs: DAY_MS };
+  const match = SINCE_PATTERN.exec(value.trim());
+  if (!match) return { error: `--since 는 30m · 12h · 1d 형태여야 합니다: ${value}` };
+  const amount = Number(match[1]);
+  const unit = match[2] === 'm' ? 60_000 : match[2] === 'h' ? 3_600_000 : DAY_MS;
+  if (!Number.isSafeInteger(amount) || amount < 1) return { error: `--since 는 1 이상이어야 합니다: ${value}` };
+  const sinceMs = amount * unit;
+  if (sinceMs > now) return { sinceMs };
+  return { sinceMs };
+}

package/src/harness/ledger-write-guard-child.fixture.ts

@@ -0,0 +1,12 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+import { recordRunExit } from './harness-incidents.js';
+import { appendRunLedgerEntry } from '../self-implement/run-ledger.js';
+
+const root = prodInstanceRoot();
+if (effectiveInstanceRoot() !== root) throw new Error('not the effective production root');
+const before = existsSync(root) ? readdirSync(root) : null;
+recordRunExit({ runId: 'run-test', reason: 'signal', status: 1, signal: null, at: new Date().toISOString() }, process.argv[2] ?? root);
+appendRunLedgerEntry({ runId: 'run-test', event: 'start', data: {} }, process.argv[3] ?? `${root}/run-ledger`);
+const after = existsSync(root) ? readdirSync(root) : null;
+console.log(JSON.stringify({ env: { NODE_ENV: process.env.NODE_ENV, ELANOUS_TEST_HOME: process.env.ELANOUS_TEST_HOME, HOME: process.env.HOME, ELANOUS_STATE_DIR: process.env.ELANOUS_STATE_DIR }, root, effectiveInstanceRoot: effectiveInstanceRoot(), before, after }));

package/src/harness/ledger-write-guard.ts

@@ -0,0 +1,35 @@
+import { realpathSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+
+function physicalPath(path: string): string {
+  const absolute = resolve(path);
+  try {
+    return realpathSync(absolute);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    const parent = dirname(absolute);
+    if (parent === absolute) throw error;
+    return resolve(physicalPath(parent), relative(parent, absolute));
+  }
+}
+
+/** Refuse a test's write to the production instance, including an explicitly supplied ledger directory. */
+export function refuseProductionLedgerWriteInTest(
+  root: string,
+  store: string,
+  env: NodeJS.ProcessEnv = process.env,
+  productionRoot = prodInstanceRoot(),
+  instanceRoot = effectiveInstanceRoot(),
+): boolean {
+  if (env.NODE_ENV !== 'test' && !env.ELANOUS_TEST_HOME) return false;
+  const target = physicalPath(root);
+  const production = physicalPath(productionRoot);
+  const withinProduction = relative(production, target);
+  if (withinProduction === '..' || withinProduction.startsWith(`..${sep}`) || isAbsolute(withinProduction)) return false;
+  try {
+    debug.log('harness.incidents', 'write-refused', { store, root: target, effectiveInstanceRoot: instanceRoot });
+  } catch { /* Observation cannot reopen a closed write boundary. */ }
+  return true;
+}

package/src/harness/model-input-observation.ts

@@ -0,0 +1,37 @@
+import { debug } from '../debug/log.js';
+
+/** One observation per harness node execution or loop tick, not per LLM request. */
+export type ModelInputObservationTarget = {
+  scope: 'harness-node' | 'loop-tick';
+  nodeKind: string;
+  graphId?: string;
+  runId?: string;
+  nodeId?: string;
+  tickId?: string;
+};
+
+export type ModelInputObservation = ModelInputObservationTarget & (
+  | { status: 'measured'; inputTokens: number }
+  | { status: 'unmeasured'; inputTokens: null; reason: 'usage-unavailable' | 'invalid-usage' }
+);
+
+/**
+ * Publish a single structured record at the execution boundary. Only provider-reported,
+ * nonnegative integer counts are measurements; missing/invalid usage is never a zero.
+ * The caller supplies the total across model calls for this execution, if available.
+ */
+export function observeModelInputTokens(
+  target: ModelInputObservationTarget,
+  inputTokens?: number | null,
+): ModelInputObservation {
+  const observation: ModelInputObservation = inputTokens === null || inputTokens === undefined
+    ? { ...target, status: 'unmeasured', inputTokens: null, reason: 'usage-unavailable' }
+    : Number.isSafeInteger(inputTokens) && inputTokens >= 0
+      ? { ...target, status: 'measured', inputTokens }
+      : { ...target, status: 'unmeasured', inputTokens: null, reason: 'invalid-usage' };
+
+  try {
+    debug.log('harness.model-input', 'recorded', observation);
+  } catch { /* Logging must not interrupt the node or tick. */ }
+  return observation;
+}

package/src/harness/pod-memory-policy.ts

@@ -0,0 +1,15 @@
+import type { GoalType } from '../self-implement/goal-author.js';
+import type { PodMemoryTier } from '../task-orchestrator/surfaces/self-implement-pod.js';
+
+export type PodMemorySelectionReason = 'explicit-option' | 'goal-type-default' | 'existing-tier';
+
+/** Select the harness Pod tier without discarding the existing implementation/operate decision. */
+export function selectPodMemoryTier(
+  goalType: GoalType,
+  explicitPodMemory: PodMemoryTier | undefined,
+  existingTier: PodMemoryTier = 'standard',
+): { tier: PodMemoryTier; reason: PodMemorySelectionReason } {
+  if (explicitPodMemory !== undefined) return { tier: explicitPodMemory, reason: 'explicit-option' };
+  if (goalType === 'research' || goalType === 'document') return { tier: 'lite', reason: 'goal-type-default' };
+  return { tier: existingTier, reason: 'existing-tier' };
+}

package/src/harness/repository-name.ts

@@ -0,0 +1,55 @@
+import { execFileSync } from 'node:child_process';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+
+const REPOSITORY_NAME = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export interface RepositoryNameOptions {
+  /** Explicit --repo value. */
+  repo?: string;
+  config?: Pick<UserConfig, 'harness'>;
+  env?: NodeJS.ProcessEnv;
+  cwd?: string;
+  executeGh?: (args: string[]) => string;
+  /** Test seam. Default asks git whether cwd is a work tree. */
+  insideGitWorkTree?: (cwd: string) => boolean;
+}
+
+/** Resolve the GitHub owner/name without asking gh outside a git checkout. */
+export function resolveRepositoryName(options: RepositoryNameOptions = {}): string {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const valid = (source: string, candidate: string | undefined): string | undefined => {
+    if (!candidate?.trim()) return undefined;
+    const name = candidate.trim();
+    if (!REPOSITORY_NAME.test(name) || name.includes('..')) {
+      throw new Error(`invalid ${source} (expected owner/name): ${candidate}`);
+    }
+    return name;
+  };
+  const flag = valid('--repo', options.repo);
+  if (flag) return flag;
+  const configured = valid('harness.repo', (options.config ?? getUserConfig()).harness?.repo);
+  if (configured) return configured;
+  const inherited = valid('GH_REPO', env.GH_REPO);
+  if (inherited) return inherited;
+  const insideGit = options.insideGitWorkTree ?? ((dir) => {
+    try {
+      return execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+        cwd: dir, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'pipe'],
+      }).trim() === 'true';
+    } catch { return false; }
+  });
+  if (insideGit(cwd)) {
+    try {
+      const name = (options.executeGh ?? ((args) => execFileSync('gh', args, {
+        cwd, encoding: 'utf8', timeout: 30_000, stdio: ['ignore', 'pipe', 'pipe'], env,
+      })))(['repo', 'view', '--json', 'nameWithOwner', '--jq', '.nameWithOwner']).trim();
+      if (REPOSITORY_NAME.test(name) && !name.includes('..')) return name;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const line = message.split(/\r?\n/).map((row) => row.trim()).find((row) => row && !/^at\s/.test(row));
+      throw new Error(line || '저장소 이름 없음 — --repo 또는 harness.repo 설정');
+    }
+  }
+  throw new Error('저장소 이름 없음 — --repo 또는 harness.repo 설정');
+}