elanous 0.2.14 → 0.2.16

package/src/hq/transfer.ts

@@ -0,0 +1,185 @@
+import { appendFileSync, mkdirSync, readSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { getUserConfig } from '../user-config.js';
+import { defaultSshRunner, localShellRunner, parseLease, sshLeaseStore, type LeaseStore, type SshRunner } from './lease.js';
+import { promoteHq, type PromoteResult } from './promote.js';
+
+type Direction = 'promote' | 'handback';
+export interface TransferStep { step: string; status: 'done' | 'failed' | 'ready'; measurement: string }
+export interface TransferResult { ok: boolean; direction: Direction; from: string; to: string; runId: string; journal: string | null; steps: TransferStep[] }
+export interface TransferDeps {
+  store: LeaseStore;
+  run: SshRunner;
+  confirm: (question: string) => boolean;
+  promote: (host: string) => PromoteResult;
+  journalDir: string;
+}
+
+const aliases: Record<string, string[]> = { mbp: ['mbp', 'MacBookProM5'], node-b: ['node-b', 'MacStudioB1'] };
+const valid = (alias: string, holder: string) => aliases[alias]?.includes(holder) ?? false;
+const leaseCommand = (action: 'release' | 'acquire', expected?: { holder: string; generation: number }) =>
+  `elanous hq lease ${action}${expected ? ` --expected-holder '${expected.holder}' --expected-generation ${expected.generation}` : ''} --json`;
+const identityCommand = `python3 - <<'PY'
+import json, pathlib
+home=pathlib.Path.home()
+local=home/'.elanous-hq/host'
+config=home/'.elanous-hqcfg/config.json'
+name=local.read_text().strip() if local.exists() else json.loads(config.read_text())['hq']['hostName']
+print(name)
+PY`;
+const cronCommand = `crontab -l && printf '\\n---HQ-AUDIT---\\n' && elanous hq fence-audit --json`;
+const fenceCommand = `elanous hq fence --role cron -- sh -c 'printf "HQ_FENCE_ALLOWED:%s\\n" "$ELANOUS_HQ_GENERATION"'`;
+
+export function defaultTransferDeps(): TransferDeps {
+  const arbiter = getUserConfig().hq?.arbiter ?? 'cloud-vm';
+  return {
+    store: sshLeaseStore(arbiter, arbiter === 'local' ? localShellRunner : defaultSshRunner),
+    run: defaultSshRunner,
+    confirm: (question) => {
+      if (!process.stdin.isTTY) return false;
+      process.stderr.write(`${question}\nType TRANSFER to continue: `);
+      const buffer = Buffer.alloc(128);
+      const count = requireRead(buffer);
+      return buffer.toString('utf8', 0, count).trim() === 'TRANSFER';
+    },
+    promote: (host) => promoteHq(host, true),
+    journalDir: join(getElanousConfigDir(), 'hq', 'transfers'),
+  };
+}
+
+function requireRead(buffer: Buffer): number {
+  // Read one terminal line without treating EOF or a non-interactive caller as consent.
+  let size = 0;
+  while (size < buffer.length) {
+    const n = requireReadByte(buffer, size);
+    if (n === 0) break;
+    size += n;
+    if (buffer[size - 1] === 10) break;
+  }
+  return size;
+}
+
+function requireReadByte(buffer: Buffer, offset: number): number {
+  return readSync(0, buffer, offset, 1, null);
+}
+
+export function transferHq(direction: Direction, apply = false, deps: TransferDeps = defaultTransferDeps()): TransferResult {
+  const from = direction === 'promote' ? 'mbp' : 'node-b';
+  const to = direction === 'promote' ? 'node-b' : 'mbp';
+  const runId = randomUUID();
+  const journal = apply ? join(deps.journalDir, `${runId}.jsonl`) : null;
+  const steps: TransferStep[] = [];
+  const result = (ok: boolean): TransferResult => ({ ok, direction, from, to, runId, journal, steps });
+  const record = (step: string, status: TransferStep['status'], measurement: string) => {
+    const row = { step, status, measurement };
+    steps.push(row);
+    if (journal) {
+      mkdirSync(deps.journalDir, { recursive: true, mode: 0o700 });
+      appendFileSync(journal, `${JSON.stringify({ at: new Date().toISOString(), runId, direction, from, to, ...row })}\n`, { mode: 0o600 });
+    }
+    return status !== 'failed';
+  };
+  const lease = () => {
+    const { now, raw } = deps.store.read();
+    const current = parseLease(raw);
+    return { current, now };
+  };
+  const remote = (host: string, command: string) => {
+    const r = deps.run(host, command);
+    if (r.status !== 0) throw new Error(`${host}: ${r.stderr.trim() || r.stdout.trim() || `exit=${r.status}`}`);
+    return r.stdout.trim();
+  };
+  try {
+    const before = lease();
+    if (!before.current || !valid(from, before.current.holder) || before.current.renewedAt + before.current.ttlSeconds < before.now) {
+      record('① current lease', 'failed', `holder=${before.current?.holder ?? 'none'} generation=${before.current?.generation ?? 'none'} expired=${before.current ? before.current.renewedAt + before.current.ttlSeconds < before.now : true}`);
+      return result(false);
+    }
+    const source = remote(from, identityCommand);
+    const target = remote(to, identityCommand);
+    if (source !== before.current.holder || !valid(to, target) || source === target) {
+      record('② host identities', 'failed', `source=${source} holder=${before.current.holder} target=${target}`);
+      return result(false);
+    }
+    record('① current lease', 'done', `holder=${source} generation=${before.current.generation}`);
+    record('② host identities', 'done', `source=${source} target=${target}`);
+    for (const host of [from, to]) {
+      const inventory = remote(host, cronCommand);
+      const marker = '\n---HQ-AUDIT---\n';
+      const index = inventory.lastIndexOf(marker);
+      if (index < 0) throw new Error(`${host}: missing cron audit`);
+      const cron = inventory.slice(0, index);
+      const audit = JSON.parse(inventory.slice(index + marker.length)) as unknown;
+      const live = cron.split('\n').filter(line => line.trim() && !line.trimStart().startsWith('#'));
+      if (!Array.isArray(audit) || audit.length > 0 || !live.some(line => /hq heartbeat\b/.test(line)) || !live.some(line => /hq fence --role cron\b/.test(line))) {
+        record(`③ cron fence ${host}`, 'failed', `unfenced=${Array.isArray(audit) ? audit.length : 'invalid'} heartbeat=${live.some(line => /hq heartbeat\b/.test(line))} fenced=${live.some(line => /hq fence --role cron\b/.test(line))}`);
+        return result(false);
+      }
+      record(`③ cron fence ${host}`, 'done', `unfenced=0 heartbeat=true fenced=true`);
+    }
+    const oldFence = remote(from, fenceCommand);
+    const newFence = remote(to, fenceCommand);
+    if (oldFence !== `HQ_FENCE_ALLOWED:${before.current.generation}` || newFence.includes('HQ_FENCE_ALLOWED:')) {
+      record('④ pre-transfer fence', 'failed', `source=${oldFence} target=${newFence}`);
+      return result(false);
+    }
+    record('④ pre-transfer fence', 'done', `source=allowed generation=${before.current.generation} target=skipped`);
+    if (!apply) {
+      record('⑤ human confirmation', 'ready', 'dry-run: no writes; --apply requires interactive TRANSFER confirmation');
+      return result(true);
+    }
+    if (!deps.confirm(`Release ${source} generation ${before.current.generation}, acquire ${target}, and switch cron fence? This cannot undo work already sent.`)) {
+      record('⑤ human confirmation', 'failed', 'confirmation declined');
+      return result(false);
+    }
+    record('⑤ human confirmation', 'done', 'operator typed TRANSFER');
+    const still = lease().current;
+    if (!still || still.holder !== source || still.generation !== before.current.generation || still.renewedAt + still.ttlSeconds < deps.store.read().now) {
+      record('⑥ release old lease', 'failed', 'lease changed before release');
+      return result(false);
+    }
+    let released: { ok?: boolean; record?: { holder?: string; generation?: number } };
+    try { released = JSON.parse(remote(from, leaseCommand('release', { holder: source, generation: before.current.generation }))); }
+    catch (error) {
+      record('⑥ release old lease', 'failed', error instanceof Error ? error.message : String(error));
+      return result(false);
+    }
+    if (released.ok !== true || released.record?.holder !== source || released.record.generation !== before.current.generation) {
+      record('⑥ release old lease', 'failed', 'release not confirmed');
+      return result(false);
+    }
+    record('⑥ release old lease', 'done', `holder=${source} generation=${released.record.generation} released=true`);
+    const acquired = JSON.parse(remote(to, leaseCommand('acquire'))) as { ok?: boolean; record?: { holder?: string; generation?: number } };
+    const current = lease().current;
+    if (acquired.ok !== true || acquired.record?.holder !== target || acquired.record.generation !== before.current.generation + 1 || current?.holder !== target || current.generation !== acquired.record.generation) {
+      record('⑦ acquire new lease', 'failed', `expected=${target} generation=${before.current.generation + 1} observed=${current?.holder ?? 'none'} generation=${current?.generation ?? 'none'}; keep old host fenced, recover manually`);
+      return result(false);
+    }
+    record('⑦ acquire new lease', 'done', `holder=${target} generation=${current.generation}`);
+    if (direction === 'promote') {
+      const promoted = deps.promote(to);
+      for (const line of promoted.lines) record(`⑧ promotion ${line.step}`, line.status, line.measurement);
+      if (!promoted.ok) return result(false);
+    }
+    const sourceAfter = remote(from, fenceCommand);
+    const targetAfter = remote(to, fenceCommand);
+    const observed = lease().current;
+    if (sourceAfter.includes('HQ_FENCE_ALLOWED:') || targetAfter !== `HQ_FENCE_ALLOWED:${current.generation}` || observed?.holder !== target || observed.generation !== current.generation) {
+      record('⑨ final fence', 'failed', `source=${sourceAfter} target=${targetAfter} lease=${observed?.holder ?? 'none'} generation=${observed?.generation ?? 'none'}`);
+      return result(false);
+    }
+    record('⑨ final fence', 'done', `source=skipped target=allowed generation=${current.generation}`);
+    return result(true);
+  } catch (error) {
+    record('halt', 'failed', error instanceof Error ? error.message : String(error));
+    return result(false);
+  }
+}
+
+export function formatTransfer(result: TransferResult): string {
+  return [`hq ${result.direction}: ${result.ok ? 'ok' : 'failed'} · ${result.from} → ${result.to} · run=${result.runId}`,
+    ...result.steps.map(s => `${s.step}: ${s.status} · ${s.measurement}`),
+    ...(result.journal ? [`journal=${result.journal}`] : [])].join('\n');
+}

package/src/index.ts

@@ -27,10 +27,13 @@ import { installDevCompletionGuard } from './self-dev/dev-completion-guard.js';
 import { buildOrchestrateDecomposePrepareArgs, normalizeOrchestrateRequest, splitOrchestrateGoalTexts } from './self-dev/self-orchestrate-runtime.js';
 import { CLI_ENTRANCE_BASELINE, evaluateCommandEntranceBaseline } from './self-dev/entrance-baseline.js';
 import { CLI_HARNESS_DOGFOOD_ENTRANCE, CLI_HARNESS_ORCHESTRATE_ENTRANCE, describeEntranceCommand, listEntrancesWithModelExposure, renderLaunchEntrances, summarizeEntrances, type EntranceId } from './self-dev/entrance-registry.js';
+import { isOldDoorInternalCall, refuseOldDoor } from './self-dev/old-door.js';
 import { collectCommandEntrances, renderCommandEntrances } from './self-dev/entrance-inventory.js';
 import { isGoalAuthorFileName } from './self-implement/goal-document.js';
 import { DEV_PIPELINE_SINK_SURFACE } from './self-implement/self-cli-sink-surface.js';
 import { registerPrivateLedgerCommands } from './cli/private-ledger-commands.js';
+import { registerKnowCommand } from './cli/know-cli.js';
+import { registerSeatRequestsCommands } from './cli/seat-requests-cli.js';
 import { applyTestStateDirFlagFromArgv } from './cli/test-state-dir-flag.js';
 import { applyTestFlagFromArgv, observeTestFlagOwnership, uncoveredTestFlagPaths, staleTestFlagPaths } from './cli/test-flag.js';
 import { registerPtyTakeoverCommands } from './cli/pty-takeover-cli.js';
@@ -46,11 +49,13 @@ import { registerPublishCommands } from './cli/publish-cli.js';
 import { registerAutopilotCommands } from './cli/autopilot-cli.js';
 import { registerRoleCommands } from './cli/role-cli.js';
 import { registerMachineCommands } from './cli/machine-cli.js';
+import { registerAgentEnvCommands } from './cli/agent-env-cli.js';
 import { registerScheduleCommands } from './cli/schedule-cli.js';
 export { runSchedule, scheduleCreatePlan } from './cli/schedule-cli.js';
 export type { ScheduleDispatch } from './cli/schedule-cli.js';
 import { registerReviewLoopOptions, buildReviewLoopOpts } from './agent-mission/review-loop-cli.js';
 import { registerCapabilitiesCommand } from './agent-mission/capabilities-cli.js';
+import { registerSupervisorMetricsCommand } from './agent-mission/supervisor-metrics-cli.js';
 import { agentBackendNames } from './agent-mission/driver.js';
 import { registerWhereCommand } from './cli/where-cli.js';
 import { registerShadowCommand } from './cli/shadow-cli.js';
@@ -68,6 +73,7 @@ import { registerFlowCommands } from './cli/flow-cli.js';
 import { registerModelWatchCommand } from './cli/model-watch-cli.js';
 import { registerIntakeCommands } from './cli/intake-cli.js';
 import { registerTasksCommands } from './cli/tasks-cli.js';
+import { registerBriefCommands } from './cli/brief-cli.js';
 import { registerLabelsCommands } from './cli/labels-cli.js';
 import { registerMsgCommands } from './cli/msg-cli.js';
 import { registerDoctorCommand } from './cli/doctor-cli.js';
@@ -80,6 +86,7 @@ import { registerStartCommand } from './cli/start-cli.js';
 import { registerGroundingSourcesCli } from './grounding/sources-cli.js';
 import { registerGraphCommands } from './graph-runner/graph-cli.js';
 import { registerLoopCommands } from './loops/loop-cli.js';
+import { registerHqMovePlanCommand } from './hq/hq.js';
 import { registerCardCommand } from './task-cards/card-cli.js';
 import { registerLaunchHeadCommands } from './launch-head/launch-head-cli.js';
 import { acpServerHelpText } from './boot/acp-server-help.js';
@@ -856,6 +863,7 @@ registerPrCommands(program);
 registerRepoCommands(program);
 registerRoleCommands(program);
 registerMachineCommands(program);
+registerAgentEnvCommands(program);
 // CLI entry: where action → resolveCurrentInstance → resolveInstance (instance universe).
 registerWhereCommand(program);
 registerShadowCommand(program);
@@ -871,6 +879,7 @@ registerUsageCommand(program);
 registerLiveCommands(program);
 registerResearchCommand(program);
 registerReleaseCommands(program);
+registerKnowCommand(program);
 registerFreezeCommands(program);
 registerFlowCommands(program);
 // HQ-HB · HQ-FENCE (10-04): one writer across mbp · node-b · cloud-vm — lease on the arbiter, 2-of-3 quorum, generation fencing.
@@ -889,24 +898,42 @@ hqCmd.command('host').description('이 머신의 HQ 호스트 이름 설정')
   });
 hqCmd.command('lease').argument('<action>', 'acquire|renew|status|release')
   .option('--host <name>', '이 호스트 이름(기본 ~/.elanous-hq/host · hq.hostName · os.hostname)')
+  .option('--expected-holder <name>', 'release CAS: 해제할 임대의 예상 소유자')
+  .option('--expected-generation <number>', 'release CAS: 해제할 임대의 예상 세대')
   .option('--json', 'JSON 출력')
-  .action(async (action: string, opts: { host?: string; json?: boolean }) => {
+  .action(async (action: string, opts: { host?: string; expectedHolder?: string; expectedGeneration?: string; json?: boolean }) => {
     try {
       if (!['acquire', 'renew', 'status', 'release'].includes(action)) throw new CliUserError(`hq lease: unknown action ${action}`, 'acquire|renew|status|release');
+      if ((opts.expectedHolder !== undefined || opts.expectedGeneration !== undefined) && action !== 'release')
+        throw new CliUserError('hq lease: expected holder/generation are only valid for release');
+      if ((opts.expectedHolder === undefined) !== (opts.expectedGeneration === undefined)
+        || (opts.expectedGeneration !== undefined && (!/^[1-9]\d*$/.test(opts.expectedGeneration) || !Number.isSafeInteger(Number(opts.expectedGeneration)))))
+        throw new CliUserError('hq lease release: supply both --expected-holder and --expected-generation (positive integer)');
       await hqSink();
       const { hqLease } = await import('./hq/hq.js');
-      const result = hqLease(action as 'acquire', {}, opts.host ? { host: opts.host } : {});
+      const result = hqLease(action as 'acquire', {}, {
+        ...(opts.host ? { host: opts.host } : {}),
+        ...(opts.expectedHolder !== undefined ? { expectedHolder: opts.expectedHolder, expectedGeneration: Number(opts.expectedGeneration) } : {}),
+      });
       if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
       else console.log(result.ok ? `hq lease ${action}: ok${'record' in result && result.record ? ` · holder ${result.record.holder} · generation ${result.record.generation}` : ''}` : `hq lease ${action}: refused — ${'reason' in result ? result.reason : ''}`);
       if (!result.ok) process.exitCode = 2;
     } catch (error) { if (error instanceof CliUserError) throw error; console.error(`hq lease: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
 hqCmd.command('promote').description('HQ 승격 런북 (기본 dry-run · --apply 일 때만 변경)')
-  .requiredOption('--to <host>', '승격 대상 호스트')
-  .option('--apply', '대기 사본을 승격 우주에 반영하고 넥서스·rescue 실행')
+  .option('--to <host>', '기존 임대 취득 후 승격 대상 호스트 (생략하면 mbp → node-b 전환 포함)')
+  .option('--apply', '임대 이전 및 승격 실행 · 터미널 확인 필수 (기존 --to 경로는 임대 보유 필요)')
   .option('--json', 'JSON 출력')
   .action(async (opts: { to: string; apply?: boolean; json?: boolean }) => {
     try {
+      if (!opts.to) {
+        const { transferHq, formatTransfer } = await import('./hq/transfer.js');
+        const result = transferHq('promote', opts.apply === true);
+        if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+        else console.log(formatTransfer(result));
+        if (!result.ok) process.exitCode = 1;
+        return;
+      }
       const { promoteHq, formatPromote } = await import('./hq/promote.js');
       const result = promoteHq(opts.to, opts.apply === true);
       if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
@@ -914,6 +941,18 @@ hqCmd.command('promote').description('HQ 승격 런북 (기본 dry-run · --appl
       if (!result.ok) process.exitCode = 1;
     } catch (error) { console.error(`hq promote: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
+hqCmd.command('handback').description('node-b → mbp 임대·크론 울타리 복귀 (기본 읽기 전용)')
+  .option('--apply', '각 검사를 통과한 뒤 터미널 확인을 받고 이전 실행')
+  .option('--json', '단계별 결과·저널 경로 JSON 출력')
+  .action(async (opts: { apply?: boolean; json?: boolean }) => {
+    try {
+      const { transferHq, formatTransfer } = await import('./hq/transfer.js');
+      const result = transferHq('handback', opts.apply === true);
+      if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+      else console.log(formatTransfer(result));
+      if (!result.ok) process.exitCode = 1;
+    } catch (error) { console.error(`hq handback: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+  });
 hqCmd.command('heartbeat').description('보유자는 갱신 · 아니면 대기(보유자에 닿는지 중재자에 보고)').option('--json', 'JSON 출력')
   .action(async (opts: { json?: boolean }) => {
     try {
@@ -937,6 +976,18 @@ hqCmd.command('seen').description('이 호스트가 본 가장 높은 임대 세
     else console.log(result.seen ? `hq seen: generation ${result.generation}` : 'hq seen: never');
     process.exitCode = result.seen ? 0 : 3;
   });
+registerHqMovePlanCommand(hqCmd);
+hqCmd.command('fence-audit').description('운영 crontab 의 HQ 울타리 밖 쓰기 잡 목록과 감싼 줄 제안(읽기 전용)')
+  .option('--json', 'JSON 출력')
+  .action(async (opts: { json?: boolean }) => {
+    try {
+      await hqSink();
+      const rows = (await import('./hq/fence-audit.js')).hqFenceAudit();
+      if (opts.json) await writeStdoutJson(`${JSON.stringify(rows)}\n`);
+      else if (!rows.length) console.log('hq fence-audit: unfenced 0');
+      else for (const row of rows) console.log(`${row.raw}\n  role: ${row.recommendedRole}\n  suggested: ${row.suggestedLine}`);
+    } catch (error) { console.error(`hq fence-audit: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+  });
 hqCmd.command('fence').description('이 호스트가 임대를 쥐었을 때만 명령 실행(아니면 건너뜀 · exit 0)')
   .requiredOption('--role <role>', 'telegram-poller|cron|seat-loop|release-run|conatus|git-push')
   .argument('<command...>', '-- 뒤의 명령')
@@ -947,12 +998,63 @@ hqCmd.command('fence').description('이 호스트가 임대를 쥐었을 때만
     process.exitCode = hqFenceRun(opts.role as 'cron', command);
   });
 const seatCmd = program.command('seat').description('분배된 자리의 하루 루프와 보고');
+registerSeatRequestsCommands(seatCmd);
 seatCmd.command('answer <askId> <answer>').description('자리 질문에 답을 남기고 원래 표면으로 회신 예약')
   .action(async (askId: string, answer: string) => {
     try {
-      const { answerSeatAsk } = await import('./seat-dispatch/seat-ask.js');
+      try { await (await import('./domains/standalone-log-sink.js')).registerStandaloneLogSink('seat-answer'); } catch { /* file trail remains available */ }
+      const { debug } = await import('./debug/log.js');
+      const { answerSeatAsk, deliverSeatAnswers, seatAskDeliveryInProgress, seatAskReplyInfo } = await import('./seat-dispatch/seat-ask.js');
       answerSeatAsk(askId, answer);
+      const { origin, askedAt, answeredAt } = seatAskReplyInfo(askId);
       console.log(`자리 답변 기록: ${askId}`);
+      if (origin.channel !== 'telegram') {
+        debug.log('seat.ask', 'reply-no-target', { id: askId, via: origin.channel });
+        console.log(`전달 대상 없음: ${askId} (${origin.channel})`);
+        return;
+      }
+      const token = process.env.TELEGRAM_BOT_TOKEN?.trim();
+      const elapsedMs = askedAt === null ? null : Math.max(0, answeredAt - askedAt);
+      if (!token) {
+        debug.log('seat.ask', 'reply-failed', { id: askId, via: 'telegram', reason: 'token-missing', elapsedMs });
+        console.log(`텔레그램 토큰 없음 (TELEGRAM_BOT_TOKEN): ${askId} · 회신 대기`);
+        return;
+      }
+      const botId = token.split(':')[0];
+      if (origin.botId && origin.botId !== botId) {
+        debug.log('seat.ask', 'reply-no-target', { id: askId, via: 'telegram', reason: 'bot-mismatch' });
+        console.log(`전달 대상 없음: ${askId} (수신 봇 불일치) · 회신 대기`);
+        return;
+      }
+      try {
+        let sent = false;
+        await deliverSeatAnswers({ askId, channel: 'telegram', botId, send: async (target, text) => {
+          if (target.channel !== 'telegram') throw new Error('seat ask belongs to another surface');
+          const response = await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ chat_id: target.chatId, text, reply_to_message_id: target.messageId,
+              ...(target.threadId === undefined ? {} : { message_thread_id: target.threadId }) }),
+          });
+          const result = await response.json() as { ok?: boolean; description?: string };
+          if (!response.ok || result.ok !== true) throw new Error(result.description ?? `Telegram HTTP ${response.status}`);
+          sent = true;
+        } });
+        if (!sent) {
+          if (seatAskDeliveryInProgress(askId)) {
+            debug.log('seat.ask', 'reply-in-progress', { id: askId, via: 'telegram', reason: 'claimed-by-other-worker' });
+            console.log(`다른 작업자가 전달 중: ${askId}`);
+          } else {
+            debug.log('seat.ask', 'reply-no-target', { id: askId, via: 'telegram', reason: 'not-claimed' });
+            console.log(`전달 대상 없음: ${askId} (회신 대기)`);
+          }
+          return;
+        }
+        debug.log('seat.ask', 'reply-sent', { id: askId, via: 'telegram', elapsedMs });
+        console.log(`텔레그램 회신 전달: ${askId} · 지연 ${elapsedMs === null ? '미상' : `${elapsedMs}ms`}`);
+      } catch (error) {
+        debug.log('seat.ask', 'reply-failed', { id: askId, via: 'telegram', reason: error instanceof Error ? error.message : String(error), elapsedMs });
+        console.log(`텔레그램 회신 실패: ${askId} · 회신 대기`);
+      }
     } catch (error) { console.error(`seat answer: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
 seatCmd.command('loop').requiredOption('--seat <SEAT>', 'MK|OP|TC|UX')
@@ -962,10 +1064,10 @@ seatCmd.command('loop').requiredOption('--seat <SEAT>', 'MK|OP|TC|UX')
     try {
       // V3 F5: without the sink, the seat loop's judgment lines (seat.loop) never reach the log store when cron runs it.
       await (await import('./domains/standalone-log-sink.js')).registerStandaloneLogSink('seat-loop');
-      const { runSeatLoopTurn } = await import('./seat-loop/seat-loop.js');
+      const { runSeatLoopTurn, seatLoopTickLine } = await import('./seat-loop/seat-loop.js');
       const result = await runSeatLoopTurn(opts.seat);
       if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
-      else console.log(`seat loop ${opts.seat}: ${result.status}${'runId' in result && result.runId ? ` ${result.runId}` : ''}`);
+      else console.log(seatLoopTickLine(result));
     } catch (error) { console.error(`seat loop: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
 seatCmd.command('report').requiredOption('--seat <SEAT>', 'MK|OP|TC|UX')
@@ -1161,8 +1263,10 @@ program.command('self-update')
   .option('--keep <n>', '설치 뒤 남길 최근 판 수(설치본은 current·직전 판, 체크아웃은 current·데몬 판 보호 · 0 이면 정리 안 함)', '3')
   .option('--alert', '실패(exit≠0)를 알림으로도 보냄 — 크론(무인) 실행용')
   .option('--skip-pwa-build', '체크아웃 설치 전 PWA 빌드를 명시적으로 건너뜀')
+  .option('--dev', '판 사이 dev 빌드 설치 — versions/<판>-dev.<sha12> · install.json channel=dev · 이전 versionDir 보존 (사람 승인 · 자동 아님)')
+  .option('--rollback', 'install.json 의 이전 versionDir 로 current 를 되돌린다 (이전이 없으면 거부)')
   .option('--auto <on|off|status>', '자동 갱신 — macOS launchd · Linux systemd 타이머가 매일 04:17 에 `self-update --restart --alert` (크론이 이미 부르면 켜지 않는다)')
-  .action(async (opts: { from?: string; version?: string; restart?: boolean; json?: boolean; keep?: string; alert?: boolean; skipPwaBuild?: boolean; auto?: string }) => {
+  .action(async (opts: { from?: string; version?: string; restart?: boolean; json?: boolean; keep?: string; alert?: boolean; skipPwaBuild?: boolean; dev?: boolean; rollback?: boolean; auto?: string }) => {
     if (opts.auto !== undefined) {
       if (!['on', 'off', 'status'].includes(opts.auto)) { console.error(`--auto 는 on · off · status 중 하나: ${opts.auto}`); process.exitCode = 2; return; }
       const { runAutoUpdate } = await import('./cli/update-auto.js');
@@ -3457,6 +3561,22 @@ selfCmd
     }
   });
 
+selfCmd
+  .command('speed-claims')
+  .description('런 원장 발사→종결 시간의 자리별·결과별 분포를 읽기 전용으로 출력한다')
+  .option('--json', '구조화된 JSON으로 출력한다')
+  .action(async (opts: { json?: boolean }) => {
+    try {
+      const { measureSpeedClaims, renderSpeedClaims } = await import('./self-implement/speed-claims.js');
+      const result = measureSpeedClaims();
+      if (opts.json) await writeStdoutJson(JSON.stringify(result) + '\n');
+      else console.log(renderSpeedClaims(result));
+    } catch (error) {
+      console.error(`speed-claims measurement failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = 1;
+    }
+  });
+
 selfCmd
   .command('goal-source-distribution')
   .description('self-implement 런 원장의 start goalSource 분포를 읽기 전용으로 출력한다')
@@ -4226,6 +4346,12 @@ selfCmd
   .option('--supervise-rounds <n>', '슈퍼바이저 재개 라운드 상한 (기본 3 · 끄려면 --no-supervise)')
   .option('--json', '구조화 출력 {stage, ok, branch, worktree, prUrl?, merged?}')
   .action(async (parts: string[], opts: { featureFile?: string; base?: string; draft?: boolean; openPr?: boolean; autoMerge?: boolean; autoReview?: boolean; maxWait?: string; json?: boolean; plan?: boolean; enhance?: boolean; ground?: boolean; observeOnly?: boolean }) => {
+    if (!isOldDoorInternalCall('self-implement')) {
+      const refused = refuseOldDoor('self-implement');
+      debug.log('harness.entrance', 'old-door-refused', { door: refused.door, caller: refused.caller });
+      ui.error(refused.message);
+      process.exit(refused.exitCode);
+    }
     if (opts.featureFile && parts.length > 0) { ui.error('--feature-file 과 위치 인자 feature 는 함께 줄 수 없다'); process.exit(2); }
     let feature: string;
     try { feature = (opts.featureFile ? readFileSync(opts.featureFile, 'utf8') : parts.join(' ')).trim(); }
@@ -4379,9 +4505,18 @@ const selfOrchestrateCmd = selfCmd
   .option('--no-pod-rebuild', 'pod: 이미지 판(elanous.commit)이 HEAD 와 달라도 다시 굽지 않는다 — 측정은 «이미지 판»을 잰다')
   .option('--pod-pass-env <keys>', 'pod: 호스트 env 에서 Pod 로 넘길 키(쉼표) — 예 OPENROUTER_API_KEY,ANTHROPIC_API_KEY(벤치마크 과금 경로)')
   .option('--bench-arms <spec>', 'pod 벤치마크: 골 1개를 팔마다 «라벨 한 줄만 다르게» 복제해 동시에 — "id=provider[:model][@KEY+KEY];…" (예 codex=openai-codex;or-kimi=openrouter:openrouter/moonshotai/kimi-k3@OPENROUTER_API_KEY) · --auto-merge 거부 · RFC fleet 슈퍼바이저 §A3')
+  .addOption(new Option('--child-llm-provider <id>', 'pod: 구현 자식 LLM provider(openai-codex|grok) — 하니스 --child-llm-provider 가 이 자리로 온다(10-05)').hideHelp())
+  .addOption(new Option('--child-llm-model <id>', 'pod: 구현 자식 LLM model(--child-llm-provider 와 함께)').hideHelp())
+  .addOption(new Option('--child-llm-effort <level>', 'pod: 구현 자식 추론 노력(--child-llm-provider 와 함께)').hideHelp())
   .option('--help-all', '모든 orchestrate 옵션 표시')
   .action(function (this: Command, parts: string[], opts: { goalFile?: string[]; concurrency?: string; autoMerge?: boolean; autoReview?: boolean; openPr?: boolean; base?: string; teardown?: boolean; resume?: string; board?: boolean; decompose?: boolean; fabricDecompose?: boolean; maxTasks?: string; supervise?: boolean; superviseRounds?: string; json?: boolean }) {
     return (async () => {
+    if (!isOldDoorInternalCall('self-orchestrate')) {
+      const refused = refuseOldDoor('self-orchestrate');
+      debug.log('harness.entrance', 'old-door-refused', { door: refused.door, caller: refused.caller });
+      ui.error(refused.message);
+      process.exit(refused.exitCode);
+    }
     // 위치 인자는 종전처럼 분리하고 파일 입력은 파일당 한 골이다.
     let inputGoals: ReturnType<typeof readSelfOrchestrateGoals>;
     try { inputGoals = readSelfOrchestrateGoals(parts, opts.goalFile); }
@@ -4613,6 +4748,19 @@ const selfOrchestrateCmd = selfCmd
         let rotationAccounts: readonly string[] | undefined;
         let podProvider: 'openai-codex' | 'grok' = 'openai-codex';
         let grokApiKeyOptIn = false;
+        {
+          // 10-05 PODPROVIDER: refuse child choices this Pod launch cannot honour instead of dropping them.
+          const child = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
+          const named = child.childLlmProvider?.trim();
+          const refuse = !named && (child.childLlmModel?.trim() || child.childLlmEffort?.trim())
+            ? 'pod: --child-llm-model/--child-llm-effort 는 --child-llm-provider 와 함께'
+            : named && benchArms
+              ? 'pod: --child-llm-provider 는 --bench-arms 와 함께 못 쓴다(팔마다 모델이 하나다)'
+              : named === 'grok' && explicitPodAccount
+                ? 'pod: --child-llm-provider grok 은 --pod-account 와 함께 못 쓴다(그것은 codex 계정을 고정한다)'
+                : undefined;
+          if (refuse) { ui.error(refuse); debug.log('self-implement.pod', 'child-provider-refused', { provider: named ?? null, reason: refuse }); process.exit(2); }
+        }
         if (!explicitPodAccount && !benchArms) {
           const { inspectCodexRotation } = await import('./oauth/codex-account-store.js');
           const { planPodProvider, makePodAccountBroker } = await import('./task-orchestrator/surfaces/pod-account-broker.js');
@@ -4651,17 +4799,31 @@ const selfOrchestrateCmd = selfCmd
               if (!opts.json) ui.warn(podGrokSkippedLine(grokCheck));
             }
           }
-          const plan = planPodProvider({
+          // 10-05 PODPROVIDER: a launch that named the child provider gets it, or is refused — never a silent codex.
+          const namedChild = (opts as { childLlmProvider?: string }).childLlmProvider?.trim();
+          const { podNamedChildProvider, podFallbackCredentials, podGrokSubscriptionUsable: namedGrokUsable } = await import('./task-orchestrator/surfaces/self-implement-pod.js');
+          const namedChildDecision = podNamedChildProvider(namedChild, {
+            grokSubscription: namedChild === 'grok' && credential?.kind === 'subscription' && (grokSubscriptionUsable || namedGrokUsable().usable),
+            grokApiKey: credential?.kind === 'api_key' && grokApiKeyOptIn,
+          });
+          if (namedChildDecision.refuse) { ui.error(namedChildDecision.refuse); debug.log('self-implement.pod', 'child-provider-refused', { provider: namedChild, reason: namedChildDecision.refuse }); process.exit(2); }
+          // A named codex child must stay codex — the plan may not fall back to grok (post-review must-fix).
+          const namedCodex = namedChildDecision.provider === 'openai-codex';
+          const plan: import('./task-orchestrator/surfaces/pod-account-broker.js').PodProviderPlan = namedChildDecision.provider === 'grok'
+            ? { provider: 'grok', excluded: [], grokSubscriptionEligible: credential?.kind === 'subscription' }
+            : planPodProvider({
             codexCandidates: inspectCodexRotation().candidates,
             // Per-account caps (대표 default:97) override the Pod default cap — without them default was dropped at 60%.
             thresholdPercentByAccount: getUserConfig().llm?.codexAccountRotationThresholdPercentByAccount,
             // 대표 한도 정책 한 값(`llm.codexQuotaPolicy`) — 크레딧·폴백을 같이 정한다.
             creditsAllowed: codexPolicyAllowsCredits(quotaPolicy),
-            grokSubscription: codexPolicyAllowsFallback(quotaPolicy) && grokSubscriptionUsable,
-            grokApiKey: codexPolicyAllowsFallback(quotaPolicy) && credential?.kind === 'api_key',
+            ...podFallbackCredentials(namedChildDecision.provider, {
+              grokSubscription: codexPolicyAllowsFallback(quotaPolicy) && grokSubscriptionUsable,
+              grokApiKey: codexPolicyAllowsFallback(quotaPolicy) && credential?.kind === 'api_key',
+            }),
             grokApiKeyOptIn,
           });
-          if (plan.provider === null) { ui.error(`pod: 쓸 codex 계정이 없다 — ${plan.reasons.join(' · ')} · 계정을 명시하려면 --pod-account <이름>`); process.exit(2); }
+          if (plan.provider === null) { ui.error(`pod: 쓸 codex 계정이 없다 — ${plan.reasons.join(' · ')}${namedCodex ? ' · child provider 를 openai-codex 로 지정해 grok 으로 넘기지 않는다' : ''} · 계정을 명시하려면 --pod-account <이름>`); process.exit(2); }
           podProvider = plan.provider;
           if (plan.provider === 'openai-codex') {
             accountBroker = makePodAccountBroker({ usable: plan.accounts, excluded: plan.excluded });
@@ -4670,6 +4832,10 @@ const selfOrchestrateCmd = selfCmd
             { const { emitDecision } = await import('./live/detail-switch.js');
               emitDecision({ kind: 'ROUTE', what: `Pod 계정 배분 ${plan.accounts.join(' → ')}`, reason: plan.excluded.length ? `뺌 ${plan.excluded.map((x) => `${x.name}(${x.why})`).join(', ')}` : '모든 계정 여유', purpose: plan.creditAccounts ? '구독 잔량 0 — 정책상 크레딧으로 병렬 조각을 돌린다' : '병렬 조각이 한 계정에 몰리지 않게 잔량 순으로 돌려 준다', phase: 'dispatch', target: `Pod ${plan.accounts.length}계정`, paths: plan.accounts.length + plan.excluded.length }); }
             if (!opts.json) ui.info(`[pod] 계정 배분(잔량 순 · 돌려 가며): ${plan.accounts.join(' → ')}${plan.creditAccounts ? ' · 💳 크레딧(구독 잔량 0 · 허가됨)' : ''}${plan.excluded.length ? ` · 뺌 ${plan.excluded.map((x) => `${x.name}(${x.why})`).join(', ')}` : ''}`);
+          } else if (namedChildDecision.provider === 'grok') {
+            const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || defaultGrokModel().id;
+            debug.log('self-implement.pod', 'provider-named', { provider: 'grok', model, credential: credential?.kind ?? null });
+            if (!opts.json) ui.info(`[pod] child provider = grok(모델 ${model}) — 발사 인자로 지정됨`);
           } else {
             const model = defaultGrokModel().id;
             debug.log('self-implement.pod', 'provider-fallback', { from: 'openai-codex', to: 'grok', excluded: plan.excluded, model });
@@ -4697,7 +4863,10 @@ const selfOrchestrateCmd = selfCmd
             ...(podSource.kind === 'bundle' ? { headCommit: podSource.headCommit, sizeBytes: podSource.sizeBytes } : {}),
           });
         }
-        const podBase = { hostSupervised: opts.supervise === true, ...(remoteOnlyPool ? { imageCommit: image.imageCommit } : {}), account: podProvider === 'grok' ? 'grok' : explicitPodAccount ?? 'team', ...(accountBroker ? { accountBroker, rotationAccounts } : {}), ...(podProvider === 'grok' ? { provider: 'grok' as const, grokApiKeyOptIn } : {}), passEnv, ...(pool ? { pool } : {}), ...((opts as { podSkillEnv?: boolean }).podSkillEnv ? { skillEnv: true } : {}), ...(podSource ? { source: podSource } : {}) };
+        const childFlags = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
+        const podChildLlm = childFlags.childLlmProvider?.trim() ? { childProviderExplicit: true, ...(childFlags.childLlmModel?.trim() ? { childModel: childFlags.childLlmModel.trim() } : {}), ...(childFlags.childLlmEffort?.trim() ? { childEffort: childFlags.childLlmEffort.trim() } : {}) } : {};
+        if (childFlags.childLlmProvider?.trim()) debug.log('self-implement.pod', 'child-provider-named', { provider: childFlags.childLlmProvider.trim(), model: childFlags.childLlmModel ?? null, podProvider });
+        const podBase = { hostSupervised: opts.supervise === true, ...podChildLlm, ...(remoteOnlyPool ? { imageCommit: image.imageCommit } : {}), account: podProvider === 'grok' ? 'grok' : explicitPodAccount ?? 'team', ...(accountBroker ? { accountBroker, rotationAccounts } : {}), ...(podProvider === 'grok' ? { provider: 'grok' as const, grokApiKeyOptIn } : {}), passEnv, ...(pool ? { pool } : {}), ...((opts as { podSkillEnv?: boolean }).podSkillEnv ? { skillEnv: true } : {}), ...(podSource ? { source: podSource } : {}) };
         if (benchArms) {
           const { benchPodSpawn } = await import('./task-orchestrator/surfaces/self-implement-pod.js');
           podSpawn = benchPodSpawn(benchArms, podBase);
@@ -5873,6 +6042,7 @@ agentCmd.hook('preAction', async (_thisCommand, actionCommand) => {
 });
 
 registerCapabilitiesCommand(agentCmd);
+registerSupervisorMetricsCommand(agentCmd);
 
 agentCmd.command('install-from-docs <tool>')
   .description('공식 설치 문서를 읽고 안전한 설치 줄을 선택한다 — sudo는 사람에게 넘긴다')
@@ -6744,6 +6914,11 @@ const selfDevCmd = program
       // ⭐ `--ask`/`--say` — 발사 절차 넷을 «한 로직»으로. 저작 → 전제 검사 → 발사.
       //   ⛔ 여기서 저작한 골 파일을 아래 `--file` 자리에 그대로 넘긴다(새 실행 경로를 만들지 않는다).
       let askAuthoredFile: string | undefined;
+      if (opts.ask !== undefined && !isOldDoorInternalCall('dev-ask')) {
+        const refused = refuseOldDoor('dev-ask');
+        debug.log('harness.entrance', 'old-door-refused', { door: refused.door, caller: refused.caller });
+        throw new DevPipelineError(refused.message);
+      }
       const retirementInput = opts.ask !== undefined
         ? { kind: 'ask' as const, value: opts.ask }
         : opts.say !== undefined
@@ -7468,6 +7643,7 @@ missionCmd
   });
 
 registerTasksCommands(program);
+registerBriefCommands(program);
 registerLabelsCommands(program);
 registerMsgCommands(program);