elanous 0.2.17 → 0.2.19

package/scripts/release-loop/version-node.ts

@@ -5,12 +5,17 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { emitNodeResult } from './node-verdict.js';
 import { debug } from '../../src/debug/log.js';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../../src/instance/resolve.js';
+import { landingFreezeMessage, readLandingFreeze, type LandingFreeze } from '../../src/release-loop/landing-freeze.js';
+import { baseVersion, isReleaseVersion, isStableVersion, prereleaseKind } from './release-version.js';
 
 type Kind = 'release' | 'dev-bump';
-type Output = { outcome: 'ok' | 'error'; kind: Kind | null; version: string | null; commit: string | null; pr: number | null; files?: string[]; worktree?: string; error?: string };
+type Output = { outcome: 'ok' | 'error'; kind: Kind | null; version: string | null; commit: string | null; pr: number | null; files?: string[]; worktree?: string; error?: string;
+  /** RELEASE-BRANCH: the release branch the cut lives on and the main commit it was cut from. */
+  branch?: string; base?: string; existing?: boolean; skipped?: string };
 
 export function nextDevVersion(version: string): string {
-  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(isReleaseVersion(version) ? baseVersion(version) : version);
   if (!match) throw new Error(`invalid release version: ${version}`);
   return `${match[1]}.${match[2]}.${BigInt(match[3]!) + 1n}-dev.0`;
 }
@@ -64,9 +69,136 @@ function shippedNextMdLines(repo: string, cut: string | undefined): { lines: Set
   return { lines: new Set(shown.stdout.split('\n').map((line) => line.trim()).filter((line) => line.startsWith('- '))) };
 }
 
-function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false): Output {
+/** Rewrite the version in package.json, server.json, the ACP agent card and the bun.lock root; returns the files touched. */
+function writeVersionBump(worktree: string, current: string, target: string): string[] {
+  const path = join(worktree, 'package.json');
+  const text = readFileSync(path, 'utf8');
+  const old = `"version": "${current}"`;
+  if (!text.includes(old)) throw new Error(`package.json version field not found: ${current}`);
+  writeFileSync(path, text.replace(old, `"version": "${target}"`));
+  const files = ['package.json'];
+  const serverPath = join(worktree, 'server.json');
+  if (existsSync(serverPath)) {
+    const server = JSON.parse(readFileSync(serverPath, 'utf8')) as { version: string; packages: Array<{ version: string }> };
+    server.version = target;
+    server.packages[0]!.version = target;
+    writeFileSync(serverPath, `${JSON.stringify(server, null, 2)}\n`);
+    files.push('server.json');
+  }
+  const agentPath = join(worktree, 'integrations', 'acp-registry', 'elanous', 'agent.json');
+  if (existsSync(agentPath)) {
+    const agent = JSON.parse(readFileSync(agentPath, 'utf8')) as { version: string; distribution: { npx: { package: string } } };
+    agent.version = target;
+    agent.distribution.npx.package = `elanous@${target}`;
+    writeFileSync(agentPath, `${JSON.stringify(agent, null, 2)}\n`);
+    files.push('agent.json');
+  }
+  const lockPath = join(worktree, 'bun.lock');
+  const lock = readFileSync(lockPath, 'utf8');
+  const root = /"workspaces"\s*:\s*\{\s*""\s*:\s*\{([\s\S]*?)(?=\s*"(?:dependencies|devDependencies|optionalDependencies)"\s*:)/.exec(lock);
+  if (!root) throw new Error('bun.lock root workspace not found');
+  const lockedVersion = /"version"\s*:\s*"([^"]+)"/.exec(root[1]!);
+  if (lockedVersion) {
+    if (lockedVersion[1] !== current) throw new Error(`bun.lock root version ${lockedVersion[1]} is not ${current}`);
+    writeFileSync(lockPath, lock.replace(root[0], root[0].replace(lockedVersion[0], `"version": "${target}"`)));
+  }
+  return files;
+}
+
+export interface BranchCutDeps {
+  /** Runs `bun install --frozen-lockfile` in the bump worktree (the lock must accept the new version). */
+  install?: (worktree: string) => void;
+  /** The landing freeze in force (production root first, like a merge). */
+  freeze?: () => LandingFreeze | null;
+  /** `--force-freeze`: cut while a freeze is on (recorded). */
+  forceFreeze?: boolean;
+}
+
+function currentFreeze(): LandingFreeze | null {
+  const prod = prodInstanceRoot();
+  const root = effectiveInstanceRoot();
+  return readLandingFreeze(prod) ?? (root === prod ? null : readLandingFreeze(root));
+}
+
+/**
+ * RELEASE-BRANCH (대표 10-06 20:0x «0.2.18부터 브랜치 방식»): the release commit lives on `release/<v>`, never on main.
+ * An existing branch is reused as is (a resumed run, or a branch a repair appended to) — its tip is the release commit.
+ * Otherwise the branch is cut from origin/main and the version bump is committed on it; main keeps its -dev.N version
+ * until the post-publish dev bump.
+ */
+export function cutReleaseBranchForRun(repo: string, version: string, deps: BranchCutDeps = {}): Output {
+  if (!isReleaseVersion(version)) throw new Error(`invalid release version: ${version}`);
+  // The run does not need a freeze, but one that is on is the emergency stop: neither a new nor a reused cut passes it.
+  const frozen = (deps.freeze ?? currentFreeze)();
+  if (frozen) {
+    debug.log('release.run', deps.forceFreeze ? 'freeze-forced' : 'frozen', { version, reason: frozen.reason, until: frozen.until, node: 'version-release' });
+    if (!deps.forceFreeze) throw new Error(landingFreezeMessage(frozen));
+  }
+  fetchMain(repo);
+  const branch = `release/${version}`;
+  const advertised = git(repo, 'ls-remote', '--heads', 'origin', `refs/heads/${branch}`).split(/\s+/)[0] ?? '';
+  if (advertised) {
+    // A prerelease number is used once: an existing rc branch is another run's cut, never this run's.
+    if (prereleaseKind(version) !== null) throw new Error(`${branch} already exists — ${version} was cut by another run; run again for the next free number`);
+    if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} remote tip is not a commit SHA`);
+    git(repo, 'fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`);
+    const tip = git(repo, 'rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`);
+    if (tip !== advertised) throw new Error(`${branch} moved while it was read (${advertised} → ${tip})`);
+    const current = versionAt(repo, tip);
+    if (current !== version) throw new Error(`${branch} tip ${tip} package.json version ${current} is not ${version}`);
+    // The branch must be a cut of this release line: its fork point on main still carries <base>-dev.N (or <v>).
+    const fork = git(repo, 'merge-base', 'origin/main', tip);
+    const forkVersion = versionAt(repo, fork);
+    const stableLine = baseVersion(version);
+    if (forkVersion !== version && !new RegExp(`^${stableLine.replaceAll('.', '\\.')}-dev\\.(0|[1-9][0-9]*)$`).test(forkVersion)) {
+      throw new Error(`${branch} forks from main at ${fork} (version ${forkVersion}) — not a cut of ${stableLine}-dev.N`);
+    }
+    debug.log('release-loop.cut', 'chosen', { version, source: 'release-branch', commit: tip, branch, existing: true });
+    return { outcome: 'ok', kind: 'release', version, commit: tip, pr: null, branch, existing: true };
+  }
+  const base = git(repo, 'rev-parse', 'origin/main');
+  const current = versionAt(repo, base);
+  const stable = baseVersion(version);
+  const devOfStable = new RegExp(`^${stable.replaceAll('.', '\\.')}-dev\\.(0|[1-9][0-9]*)$`);
+  if (current !== version && !devOfStable.test(current)) throw new Error(`origin/main version ${current} is not ${stable}-dev.N (release ${version})`);
+  const temp = mkdtempSync(join(tmpdir(), 'release-branch-cut-'));
+  const worktree = join(temp, 'tree');
+  let added = false;
+  try {
+    git(repo, 'worktree', 'add', '--detach', worktree, base);
+    added = true;
+    const files = current === version ? [] : writeVersionBump(worktree, current, version);
+    if (files.length) {
+      (deps.install ?? ((tree: string) => { run('bun', ['install', '--frozen-lockfile'], tree); }))(worktree);
+      git(worktree, 'add', '-A');
+      git(worktree, 'commit', '-m', `release: ${version}`, '-m', `Cut from main ${base}.`);
+    }
+    const commit = git(worktree, 'rev-parse', 'HEAD');
+    // Create-only: an empty lease refuses to overwrite a branch someone else made meanwhile.
+    const push = git(repo, 'push', '--porcelain', `--force-with-lease=refs/heads/${branch}:`, 'origin', `${commit}:refs/heads/${branch}`);
+    const created = push.split('\n').some((line) => {
+      const [flag, ref, summary] = line.split('\t');
+      return flag === '*' && !!ref?.endsWith(`:refs/heads/${branch}`) && summary === '[new branch]';
+    });
+    if (!created) throw new Error(`${branch} was not created (push: ${push.replace(/\s+/g, ' ').trim() || 'no output'})`);
+    debug.log('release-loop.cut', 'chosen', { version, source: 'release-branch', commit, branch, base, existing: false });
+    return { outcome: 'ok', kind: 'release', version, commit, pr: null, branch, base, files };
+  } finally {
+    try { if (added) git(repo, 'worktree', 'remove', '--force', worktree); }
+    finally { rmSync(temp, { recursive: true, force: true }); }
+  }
+}
+
+function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false): Output {
+  if (kind === 'release' && branchCut && cutCommit === undefined) return cutReleaseBranchForRun(repo, releaseVersion, { forceFreeze });
+  if (kind === 'dev-bump' && prereleaseKind(releaseVersion) !== null) {
+    // A prerelease (rehearsal) never moves main: the next stable release still owns this -dev line.
+    debug.log('release-loop.version-dev-bump', 'skipped', { version: releaseVersion, reason: 'prerelease' });
+    return { outcome: 'ok', kind, version: releaseVersion, commit: null, pr: null, skipped: 'prerelease' };
+  }
   const target = kind === 'release' ? releaseVersion : nextDevVersion(releaseVersion);
-  const source = kind === 'release' ? `${releaseVersion}-dev.N` : releaseVersion;
+  // With the release on its branch, main still carries <v>-dev.N when the dev bump runs.
+  const source = kind === 'release' ? `${releaseVersion}-dev.N` : branchCut ? `${releaseVersion}-dev.N` : releaseVersion;
   fetchMain(repo);
   if (kind === 'release' && cutCommit !== undefined) {
     if (!/^[0-9a-f]{7,40}$/i.test(cutCommit)) throw new Error(`invalid cut commit SHA: ${cutCommit}`);
@@ -107,7 +239,8 @@ function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string,
       return { outcome: 'ok', kind, version: current, commit: before, pr: null };
     }
   }
-  if (kind === 'release' ? !new RegExp(`^${releaseVersion.replaceAll('.', '\\.')}\\-dev\\.(0|[1-9][0-9]*)$`).test(current) : current !== source) {
+  const devOfRelease = new RegExp(`^${releaseVersion.replaceAll('.', '\\.')}\\-dev\\.(0|[1-9][0-9]*)$`);
+  if (kind === 'release' || branchCut ? !devOfRelease.test(current) && !(kind === 'dev-bump' && current === releaseVersion) : current !== source) {
     throw new Error(`origin/main version ${current} is not ${source} (target ${target})`);
   }
 
@@ -115,37 +248,7 @@ function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string,
   const worktree = join(temp, 'tree');
   try {
     git(repo, 'worktree', 'add', '-b', `release-version-${kind}-${Date.now()}-${process.pid}`, worktree, 'origin/main');
-    const path = join(worktree, 'package.json');
-    const text = readFileSync(path, 'utf8');
-    const old = `"version": "${current}"`;
-    if (!text.includes(old)) throw new Error(`package.json version field not found: ${current}`);
-    writeFileSync(path, text.replace(old, `"version": "${target}"`));
-    const files = ['package.json'];
-    const serverPath = join(worktree, 'server.json');
-    if (existsSync(serverPath)) {
-      const server = JSON.parse(readFileSync(serverPath, 'utf8')) as { version: string; packages: Array<{ version: string }> };
-      server.version = target;
-      server.packages[0]!.version = target;
-      writeFileSync(serverPath, `${JSON.stringify(server, null, 2)}\n`);
-      files.push('server.json');
-    }
-    const agentPath = join(worktree, 'integrations', 'acp-registry', 'elanous', 'agent.json');
-    if (existsSync(agentPath)) {
-      const agent = JSON.parse(readFileSync(agentPath, 'utf8')) as { version: string; distribution: { npx: { package: string } } };
-      agent.version = target;
-      agent.distribution.npx.package = `elanous@${target}`;
-      writeFileSync(agentPath, `${JSON.stringify(agent, null, 2)}\n`);
-      files.push('agent.json');
-    }
-    const lockPath = join(worktree, 'bun.lock');
-    const lock = readFileSync(lockPath, 'utf8');
-    const root = /"workspaces"\s*:\s*\{\s*""\s*:\s*\{([\s\S]*?)(?=\s*"(?:dependencies|devDependencies|optionalDependencies)"\s*:)/.exec(lock);
-    if (!root) throw new Error('bun.lock root workspace not found');
-    const lockedVersion = /"version"\s*:\s*"([^"]+)"/.exec(root[1]!);
-    if (lockedVersion) {
-      if (lockedVersion[1] !== current) throw new Error(`bun.lock root version ${lockedVersion[1]} is not ${current}`);
-      writeFileSync(lockPath, lock.replace(root[0], root[0].replace(lockedVersion[0], `"version": "${target}"`)));
-    }
+    const files = writeVersionBump(worktree, current, target);
     run('bun', ['install', '--frozen-lockfile'], worktree);
     if (kind === 'dev-bump') {
       const nextPath = join(worktree, 'release', 'next.md');
@@ -207,12 +310,13 @@ function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string,
   }
 }
 
-function main(args: string[] = process.argv.slice(2), repo = process.cwd()): Output {
+export function main(args: string[] = process.argv.slice(2), repo = process.cwd()): Output {
   let kind: Kind | null = null;
   let version: string | null = null;
   let cut: string | undefined;
   let cutCommit: string | undefined;
   let forceFreeze = false;
+  let branchCut = false;
   try {
     if (args[0] !== 'release' && args[0] !== 'dev-bump') throw new Error('usage: version-node.ts <release|dev-bump> [--version <v>] [--cut <sha>] [--cut-commit <sha>] --json');
     kind = args[0];
@@ -226,9 +330,10 @@ function main(args: string[] = process.argv.slice(2), repo = process.cwd()): Out
     if (process.env.ELANOUS_GRAPH_CONTEXT) {
       const location = process.env.ELANOUS_GRAPH_CONTEXT;
       const context = JSON.parse(location.trimStart().startsWith('{') ? location : readFileSync(location, 'utf8')) as {
-        input?: { version?: unknown; cutCommit?: unknown; forceFreeze?: unknown }; outputs?: Record<string, { commit?: unknown } | undefined> };
+        input?: { version?: unknown; cutCommit?: unknown; forceFreeze?: unknown; branchCut?: unknown }; outputs?: Record<string, { commit?: unknown } | undefined> };
       if (!version && typeof context.input?.version === 'string') version = context.input.version;
       forceFreeze = context.input?.forceFreeze === true;
+      branchCut = context.input?.branchCut === true;
       if (kind === 'release' && cutCommit === undefined && context.input?.cutCommit !== undefined) {
         if (typeof context.input.cutCommit !== 'string') throw new Error('cutCommit must be a commit SHA');
         cutCommit = context.input.cutCommit;
@@ -240,11 +345,11 @@ function main(args: string[] = process.argv.slice(2), repo = process.cwd()): Out
     if (!version) throw new Error('version required (--version or ELANOUS_GRAPH_CONTEXT.input.version)');
     nextDevVersion(version);
     if (kind === 'dev-bump' && cutCommit !== undefined) throw new Error('--cut-commit is only valid for release');
-    return landing(resolve(repo), kind, version, cut, cutCommit, forceFreeze);
+    return landing(resolve(repo), kind, version, cut, cutCommit, forceFreeze, branchCut);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const worktree = /\[worktree: ([^\]]+)\]$/.exec(message)?.[1];
-    const outputVersion = kind === 'dev-bump' && version && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version)
+    const outputVersion = kind === 'dev-bump' && version && isStableVersion(version)
       ? nextDevVersion(version) : version;
     return { outcome: 'error', kind, version: outputVersion,
       commit: null, pr: null, ...(worktree ? { worktree } : {}), error: message };

package/scripts/rhythm/daily.ts

@@ -301,8 +301,9 @@ function recipient(deps: DailyDeps): { chatId: number; botToken: string } | null
 function sendReview(file: string, text: string, target: { chatId: number; botToken: string },
   send: (request: DailySendRequest) => DailySendConfirmation | null,
   receipt: (key: string) => DeliveryReceipt,
-  recordDelivery?: (text: string, kind: 'ops-report') => void): DeliveryResult {
-  const key = file.slice(file.lastIndexOf('/') + 1).replace(/\.md$/, '');
+  recordDelivery?: (text: string, kind: 'ops-report') => void,
+  keySuffix = ''): DeliveryResult {
+  const key = file.slice(file.lastIndexOf('/') + 1).replace(/\.md$/, '') + keySuffix;
   const label = `telegram:${target.chatId}`;
   const db = new Database(join(dirname(file), 'delivery.sqlite'));
   try {
@@ -346,6 +347,21 @@ function sendReview(file: string, text: string, target: { chatId: number; botTok
   finally { db.close(); }
 }
 
+function newsMessage(markdown: string): string | null {
+  const section = markdown.split('## ⑦ 외부 동향\n')[1]?.split('\n\n## ')[0];
+  if (!section || section.startsWith('못 읽음 ·')) return null;
+  const articles = [...section.matchAll(/^- (.+) — (https?:\/\/\S+)\n  시사점: (.*)$/gm)].slice(0, 3);
+  return articles.length ? `## 외부 동향\n${articles.map(article => article[0]).join('\n')}` : null;
+}
+
+function sendNewsAfterReview(delivery: DeliveryResult, file: string, markdown: string,
+  target: { chatId: number; botToken: string }, deps: DailyDeps): string | null {
+  if (!['sent', 'already-sent', 'receipt-sent'].includes(delivery.deliveryState)) return null;
+  const text = newsMessage(markdown);
+  if (!text) return null;
+  return sendReview(file, text, target, deps.send ?? sendTelegram, deps.receipt ?? (() => 'unknown'), deps.recordDelivery, '-news').deliveryState;
+}
+
 export type DailyDeps = { now?: () => Date; root?: string; vaultRoot?: string | null; sendEnabled?: boolean; repoRoot?: string; repoName?: string;
   landings?: (now: Date) => Promise<Landing[]>; release?: () => Promise<Release>; loops?: () => Promise<Loop[]>;
   grid?: () => Promise<Seat[]>; decisions?: () => Promise<Pending[]>; news?: () => Promise<News[]>;
@@ -402,6 +418,7 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
     let target = 'unknown';
     let sendError: string | null = null;
     let recordError: string | null = null;
+    let newsState: string | null = null;
     let enabled = deps.sendEnabled === true;
     if (deps.sendEnabled === undefined && options.stage === 'deliver' && !options.dryRun) {
       try { enabled = record(record(record(getUserConfig().raw.loops).rhythm).daily).send === true; }
@@ -420,12 +437,13 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
       sendError = sendError ?? delivery.sendError;
       recordError = delivery.recordError ?? null;
       deliveryState = delivery.deliveryState;
+      if (resolved) newsState = sendNewsAfterReview(delivery, file, markdown, resolved, deps);
     }
     tick.sent = sent;
     const status = vault.vaultFatal || Object.values(sections).includes('unreadable') ? 'degraded'
       : deliveryState === 'pending' ? 'pending'
       : ['sent', 'already-sent', 'receipt-sent'].includes(deliveryState) ? 'ok' : 'degraded';
-    const deliveryLine = `${options.stage} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}`;
+    const deliveryLine = `${options.stage} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}${newsState ? ` · news=${newsState}` : ''}`;
     if (options.stage === 'deliver') {
       Object.assign(tick, { status, deliveryState, target, chars, receiptKey, deliveryLine, recordError });
       if (!options.dryRun) {
@@ -526,6 +544,7 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
   }
   let sent = false;
   let recordError: string | null = null;
+  let newsState: string | null = null;
   let chars = 0;
   let target = 'unknown';
   if (!options.dryRun && options.stage !== 'collect' && enabled) {
@@ -541,11 +560,13 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
     sendError = sendError ?? delivery.sendError;
     recordError = delivery.recordError ?? null;
     deliveryState = delivery.deliveryState;
+    if (resolved && parts.news.status === 'ok' && parts.news.value.length > 0)
+      newsState = sendNewsAfterReview(delivery, file, review.markdown, resolved, deps);
   }
   const status = vaultFatal || Object.values(review.sections).includes('unreadable') ? 'degraded'
     : deliveryState === 'pending' ? 'pending'
     : ['sent', 'already-sent', 'receipt-sent'].includes(deliveryState) ? 'ok' : 'degraded';
-  const deliveryLine = `${options.stage === 'collect' ? 'collect' : 'deliver'} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}`;
+  const deliveryLine = `${options.stage === 'collect' ? 'collect' : 'deliver'} ${status} · target=${target} · ${deliveryState} · sent=${sent} · chars=${chars} · receipt=${receiptKey}${recordError ? ` · ${recordError}` : ''}${newsState ? ` · news=${newsState}` : ''}`;
   if (options.stage !== 'collect') {
     const tick = { sections: review.sections, risks: review.risks.length, sent, status, deliveryState, target, chars, receiptKey, deliveryLine, recordError };
     if (!options.dryRun) {

package/scripts/skills/public-check.ts

@@ -1,13 +1,14 @@
 #!/usr/bin/env bun
-/** Static readiness inventory for the public (core) skills; never executes a skill. */
-import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
-import { join, relative } from 'node:path';
+/** Public (core) skill readiness inventory; optional builds never execute a skill. */
+import { cpSync, existsSync, lstatSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, isAbsolute, join, relative, sep, win32 } from 'node:path';
 import { computeSkillBoundaries, type SkillBoundaryReport } from '../skill-boundary.js';
 
 export type PublicCheckKey = 'header' | 'entry' | 'free' | 'portable' | 'install';
 export interface PublicSkillRow {
   readonly skill: string;
-  readonly checks: Readonly<Record<PublicCheckKey, boolean | 'N/A'>>;
+  readonly checks: Readonly<Record<PublicCheckKey, boolean | 'N/A'> & { build?: SkillBuildResult }>;
   readonly violations: readonly string[];
 }
 export interface PublicCheckReport {
@@ -68,6 +69,44 @@ function executableEntries(files: readonly string[], dir: string, docs: string):
     && (commanded.has(file) || file.startsWith('bin/') || ENTRY_NAME.test(file)));
 }
 
+export type SkillBuildResult = 'OK' | 'FAIL' | 'N/A';
+
+/** Build only selected TS/JS entries from an isolated skill copy, never from the repository. */
+export function buildSkillEntries(
+  dir: string,
+  entries: readonly string[],
+  run: (args: string[], cwd: string) => boolean = (args, cwd) => Bun.spawnSync(args, {
+    cwd, stdout: 'ignore', stderr: 'ignore',
+  }).exitCode === 0,
+): SkillBuildResult {
+  const buildable = entries.filter((entry) => /\.(?:ts|tsx|js|mjs|cjs)$/iu.test(entry));
+  if (buildable.length === 0) return 'N/A';
+  if (buildable.some((entry) => isAbsolute(entry) || win32.isAbsolute(entry) || entry.split(/[\\/]/u).includes('..'))) return 'FAIL';
+  const temp = mkdtempSync(join(tmpdir(), 'skill-public-build-'));
+  try {
+    const skill = join(temp, 'skill');
+    cpSync(dir, skill, {
+      recursive: true,
+      filter: (source) => source === dir || !['.git', 'node_modules', '__pycache__'].includes(basename(source)) && !lstatSync(source).isSymbolicLink(),
+    });
+    const copiedRoot = realpathSync(skill);
+    for (const entry of buildable) {
+      const target = realpathSync(join(skill, entry));
+      const inside = relative(copiedRoot, target);
+      if (inside === '..' || inside.startsWith(`..${sep}`) || isAbsolute(inside) || !lstatSync(target).isFile()) return 'FAIL';
+    }
+    if (existsSync(join(skill, 'package.json')) && !run(['bun', 'install', '--ignore-scripts'], skill)) return 'FAIL';
+    for (const [index, entry] of buildable.entries()) {
+      if (!run(['bun', 'build', entry, '--target=bun', '--outfile', join(temp, `entry-${index}.js`)], skill)) return 'FAIL';
+    }
+    return 'OK';
+  } catch {
+    return 'FAIL';
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 function freeValid(doc: string, entries: ReadonlySet<string>): boolean {
   const section = /(?:^|\n)#{1,4}\s*[^\n]*(?:무료|free)[^\n]*\n([\s\S]*?)(?=\n#{1,4}\s|$)/giu;
   for (const match of doc.matchAll(section)) {
@@ -97,7 +136,7 @@ function installValid(doc: string, dir: string): boolean {
 }
 
 /** `boundary` is injectable for pure fixture tests; production always derives it from the repository. */
-export function checkPublicSkills(root: string, boundary: SkillBoundaryReport = computeSkillBoundaries(root)): PublicCheckReport {
+export function checkPublicSkills(root: string, boundary: SkillBoundaryReport = computeSkillBoundaries(root), build = false): PublicCheckReport {
   const errors = [...boundary.errors];
   const skills: PublicSkillRow[] = [];
   const skillsDir = join(root, 'skills');
@@ -133,6 +172,7 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
       free: freeValid(docs, entries),
       portable: matches.length === 0,
       install: installValid(docs, dir),
+      ...(build ? { build: buildSkillEntries(dir, [...entries]) } : {}),
     };
     const violations = [
       ...(!checks.header ? ['SKILL.md 머리(name·description) 없음/불일치'] : []),
@@ -140,6 +180,7 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
       ...(!checks.free ? ['키/.env 없이 쓰는 무료 경로가 문서에 없음'] : []),
       ...matches.map((file) => `${file}: 개인 경로/내부 표지 문자열`),
       ...(!checks.install ? ['의존 manifest와 문서의 한 줄 설치 명령이 없음'] : []),
+      ...(checks.build === 'FAIL' ? ['스킬 실행 파일 빌드 실패'] : []),
     ];
     skills.push({ skill, checks, violations });
   }
@@ -147,23 +188,32 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
 }
 
 export function formatPublicCheck(report: PublicCheckReport): string {
-  const columns: PublicCheckKey[] = ['header', 'entry', 'free', 'portable', 'install'];
+  const columns: (PublicCheckKey | 'build')[] = ['header', 'entry', 'free', 'portable', 'install'];
+  if (report.skills.some((row) => row.checks.build !== undefined)) columns.push('build');
   return [
     `skill                              ${columns.map((key) => key.padEnd(9)).join(' ')} result`,
-    ...report.skills.map((row) => `${row.skill.padEnd(34)} ${columns.map((key) => (row.checks[key] === 'N/A' ? 'N/A' : row.checks[key] ? 'OK' : 'FAIL').padEnd(9)).join(' ')} ${row.violations.length ? row.violations.join('; ') : 'OK'}`),
+    ...report.skills.map((row) => `${row.skill.padEnd(34)} ${columns.map((key) => { const value = row.checks[key]; return (typeof value === 'string' ? value : value ? 'OK' : 'FAIL').padEnd(9); }).join(' ')} ${row.violations.length ? row.violations.join('; ') : 'OK'}`),
     ...report.errors.map((error) => `ERROR ${error}`),
     `PUBLIC-CHECK ${report.ok ? 'PASS' : 'FAIL'} (${report.skills.length} public skills)`,
   ].join('\n');
 }
 
+export function runPublicCheck(root: string, args: readonly string[], boundary?: SkillBoundaryReport): { output: string; exitCode: number } {
+  const report = checkPublicSkills(root, boundary, args.includes('--build'));
+  return {
+    output: args.includes('--json') ? JSON.stringify(report, null, 2) : formatPublicCheck(report),
+    exitCode: report.ok ? 0 : 1,
+  };
+}
+
 if (import.meta.main) {
   const args = process.argv.slice(2);
-  if (args.some((arg) => arg !== '--json')) {
-    console.error('Usage: bun scripts/skills/public-check.ts [--json]');
+  if (args.some((arg) => arg !== '--json' && arg !== '--build')) {
+    console.error('Usage: bun scripts/skills/public-check.ts [--json] [--build]');
     process.exitCode = 2;
   } else {
-    const report = checkPublicSkills(join(import.meta.dir, '..', '..'));
-    console.log(args.includes('--json') ? JSON.stringify(report, null, 2) : formatPublicCheck(report));
-    if (!report.ok) process.exitCode = 1;
+    const result = runPublicCheck(join(import.meta.dir, '..', '..'), args);
+    console.log(result.output);
+    process.exitCode = result.exitCode;
   }
 }

package/scripts/test-deterministic.ts

@@ -57,7 +57,10 @@ const HARNESS_TEST_ENV_KEYS = [
 // Discovery: rg -n "process\.env\.ELANOUS_(HOST|RUN|ORIGIN|SUPERVISOR|PARENT)" src
 // These are ambient execution identities, not inputs to a deterministic test.
 // debug.log also attributes SUBSTRATE and ARM_ID to every plain-object record.
-const GIT_LOCATION_ENV_KEYS = ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR'] as const;
+export const GIT_LOCATION_ENV_KEYS = [
+  'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE',
+  'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+] as const;
 
 const EXECUTION_ORIGIN_ENV_KEYS = [
   'ELANOUS_HOST_ID',
@@ -123,7 +126,7 @@ export type DeterministicRunnerDeps = {
   childGraceMs?: number;
   killProcessGroup?: KillProcessGroup;
   getProcessGroupId?: GetProcessGroupId;
-  gitConfig?: (cwd: string, args: string[]) => string;
+  gitConfig?: (cwd: string, args: string[]) => string | undefined;
 };
 
 export function isLivePid(pid: number): boolean {
@@ -273,14 +276,17 @@ export async function terminateDirectChild(
   reportVisible(`failed to terminate child pid=${pid}`, report);
 }
 
-function gitConfig(cwd: string, args: string[]): string {
+function gitConfig(cwd: string, args: string[]): string | undefined {
   const env = { ...process.env };
   for (const key of GIT_LOCATION_ENV_KEYS) delete env[key];
   const result = spawnSync('git', args, { cwd, env, encoding: 'utf8' });
   if (result.error || (result.status !== 0 && !(result.status === 1 && args.includes('--get-all') && !result.stderr))) {
     throw new Error(`git ${args.join(' ')} failed: ${result.error?.message ?? result.stderr}`);
   }
-  return result.stdout.trim();
+  if (result.status === 1) return undefined;
+  // --null --get-all terminates each complete value with NUL, even when
+  // a value itself contains newlines or is empty.
+  return args.includes('--get-all') ? result.stdout : result.stdout.trim();
 }
 
 export function prepareIsolatedTestEnv(sourceEnv: NodeJS.ProcessEnv, testRoot: string): NodeJS.ProcessEnv {
@@ -406,33 +412,45 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
   const cwd = deps.cwd ?? process.cwd();
   const config = deps.gitConfig ?? gitConfig;
   const commonDir = config(cwd, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+  if (commonDir === undefined) throw new Error('git common directory is unset');
   const configFile = join(resolve(cwd, commonDir), 'config');
-  const bareArgs = ['config', '--file', configFile];
-  const readBare = () => config(cwd, [...bareArgs, '--get-all', 'core.bare']);
-  const bareBefore = readBare();
-  let bareChanged = false;
-  let bareChecked = false;
-  const checkBare = (): void => {
-    bareChecked = true;
-    let bareAfter = '<unreadable>';
-    const visible = (values: string) => values ? values.replaceAll('\n', ',') : '<unset>';
-    try {
-      bareAfter = readBare();
-      if (bareAfter === bareBefore) return;
-      bareChanged = true;
-      const originalValues = bareBefore ? bareBefore.split('\n') : [];
-      if (originalValues.length > 0) {
-        config(cwd, [...bareArgs, '--replace-all', 'core.bare', originalValues[0]!]);
-        for (const value of originalValues.slice(1)) config(cwd, [...bareArgs, '--add', 'core.bare', value]);
-      } else if (bareAfter) {
-        config(cwd, [...bareArgs, '--unset-all', 'core.bare']);
+  const configArgs = ['config', '--file', configFile];
+  const watchedKeys = ['core.bare', 'user.name', 'user.email'] as const;
+  // Legacy injected gitConfig fixtures supply newline-delimited results and
+  // return '' for an absent key. Real Git uses NUL-delimited complete values.
+  const readConfig = (key: string): string[] => {
+    const value = config(cwd, [...configArgs, '--null', '--get-all', key]);
+    if (value === undefined || (deps.gitConfig && value === '')) return [];
+    if (deps.gitConfig && !value.includes('\0')) return value.split('\n');
+    if (!value.endsWith('\0')) throw new Error(`unterminated git config value for ${key}`);
+    return value.slice(0, -1).split('\0');
+  };
+  const before = new Map(watchedKeys.map((key) => [key, readConfig(key)]));
+  let configChanged = false;
+  let configChecked = false;
+  const checkConfig = (): void => {
+    configChecked = true;
+    const visible = (values: string[]) => values.length === 0 ? '<unset>' : values.map((value) => value === '' ? '<empty>' : value.replaceAll('\n', ',')).join(',');
+    for (const key of watchedKeys) {
+      const original = before.get(key)!;
+      let after: string[] = ['<unreadable>'];
+      try {
+        after = readConfig(key);
+        if (JSON.stringify(after) === JSON.stringify(original)) continue;
+        configChanged = true;
+        if (original.length > 0) {
+          config(cwd, [...configArgs, '--replace-all', key, original[0]!]);
+          for (const value of original.slice(1)) config(cwd, [...configArgs, '--add', key, value]);
+        } else {
+          config(cwd, [...configArgs, '--unset-all', key]);
+        }
+        const restored = readConfig(key);
+        if (JSON.stringify(restored) !== JSON.stringify(original)) throw new Error(`expected ${visible(original)}, got ${visible(restored)}`);
+        report(`[test-deterministic] ${key} changed ${visible(original)} -> ${visible(after)}; restored ${visible(original)}; failing run`);
+      } catch (error) {
+        configChanged = true;
+        report(`[test-deterministic] ${key} changed ${visible(original)} -> ${visible(after)}; restore failed: ${formatError(error)}`);
       }
-      const restored = readBare();
-      if (restored !== bareBefore) throw new Error(`expected ${visible(bareBefore)}, got ${visible(restored)}`);
-      report(`[test-deterministic] core.bare changed ${visible(bareBefore)} -> ${visible(bareAfter)}; restored ${visible(bareBefore)}; failing run`);
-    } catch (error) {
-      bareChanged = true;
-      report(`[test-deterministic] core.bare changed ${visible(bareBefore)} -> ${visible(bareAfter)}; restore failed: ${formatError(error)}`);
     }
   };
   // ⛔ 사람이 «경로»를 직접 준 창에서는 아무것도 빼지 않는다 — 그 창은 「이것만 돌려라」다.
@@ -494,7 +512,7 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
       });
       cleanupTemporaryRoot(testRoot, { rmSync: deps.rmSync, report });
       rootCleanupAttempted = true;
-      checkBare();
+      checkConfig();
       gate?.dispose();
       gate = undefined;
       if (deps.killSelf) {
@@ -509,8 +527,8 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
     }
 
     cleanupRoot();
-    checkBare();
-    return bareChanged ? 1 : (outcome.code ?? 1);
+    checkConfig();
+    return configChanged ? 1 : (outcome.code ?? 1);
   } catch (error) {
     if (child) {
       try {
@@ -529,7 +547,7 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
   } finally {
     gate?.dispose();
     cleanupRoot();
-    if (!bareChecked) checkBare();
+    if (!configChecked) checkConfig();
   }
 }