elanous 0.2.20 → 0.2.22

package/src/loops/orchestrator/overlap.ts

@@ -19,6 +19,9 @@ export interface CollectWorkDeps {
   config?: Pick<OrchestratorLoopConfig, 'seatTrees'>;
 }
 
+/** Budget for collectWork's per-process cwd reads. */
+export const COLLECT_WORK_PROCESS_DEADLINE_MS = 10_000;
+
 const repoRoot = resolve(import.meta.dir, '../../..');
 const defaultRunGh = (args: string[]): string => execFileSync('bun', ['bin/elanous.mjs', '--test', 'gh', ...args], {
   cwd: repoRoot, encoding: 'utf8', timeout: 60_000, maxBuffer: 20 * 1024 * 1024,
@@ -63,7 +66,10 @@ function goalFiles(text: string): string[] {
 export function collectWork(deps: CollectWorkDeps = {}): CollectWorkResult {
   const prs = JSON.parse((deps.runGh ?? defaultRunGh)(['pr', 'list', '--state', 'open', '--limit', '1000', '--json', 'number,title,body,headRefName,files,isDraft,labels'])) as OpenPr[];
   if (!Array.isArray(prs)) throw new Error('PR observation is not a list');
-  const observation = (deps.listProcesses ?? defaultListHarnessProcesses)();
+  // Only goal-carrying launches become work, so only they need a cwd; bounded so a host with hundreds of harness processes
+  // cannot hold the queue lock for minutes (10-08). Records past the budget stay cwd-unknown → their goal reads unreadable.
+  const observation = deps.listProcesses ? deps.listProcesses()
+    : defaultListHarnessProcesses({ include: record => goalPath(record.command) !== null, cwdOnly: true, deadlineMs: COLLECT_WORK_PROCESS_DEADLINE_MS });
   if (observation.status !== 'ok') throw new Error(`process observation ${observation.status}`);
   const cfg = deps.config ?? getUserConfig().loops?.orchestrator ?? ORCHESTRATOR_DEFAULTS;
   const excluded = { stalled: 0, superseded: 0, draft: 0 };

package/src/loops/orchestrator/resync-shadow.ts

@@ -171,7 +171,7 @@ export async function runResyncShadow(max = 3, deps: ResyncShadowDeps = {}): Pro
       entry.resolvedFiles = outcome.resolvedFiles ?? [];
       if (outcome.sizeCollapse?.length || outcome.providerFailure?.length || outcome.testDeclarationLoss?.length) {
         entry.verdict = 'guard-tripped';
-      } else if (outcome.status === 'merged' || outcome.status === 'llm-resolved') {
+      } else if (outcome.status === 'merged' || outcome.status === 'llm-resolved' || outcome.status === 'deterministic-resolved') {
         if (entry.testFiles.length === 0) entry.verdict = 'merge-ok-no-tests';
         else {
           const test = (deps.runTests ?? defaultRunTests)(tmp, entry.testFiles);

package/src/loops/orchestrator/tick.ts

@@ -8,6 +8,7 @@ import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { getUserConfig, type OrchestratorLoopConfig } from '../../user-config.js';
 import { rubricPriority } from '../../release-loop/rubric.js';
 import { debug } from '../../debug/log.js';
+import { emitLoopHeartbeat } from '../neighbor-runtime.js';
 import { listSelfDevRuns, runSummaryLine, selfDevRunsDir } from '../../self-dev/run-store.js';
 import { planAction, runSeatLoopOnce, type SeatDeps, type SeatItem } from '../../seat-loop/seat-loop.js';
 import { addHarnessQueue, harnessQueueOutcome, setQueuedPoolHint } from '../../harness/harness-queue.js';
@@ -48,7 +49,8 @@ export type PlacementInput = { id: string; title: string; owner: string; priorit
 export type PlaceAdapter = (cell: PlacementInput, deps?: { dryRun?: boolean; now?: Date }) => Promise<{ version?: string } | null> | { version?: string } | null;
 export type RebalanceAdapter = (version: string) => Promise<{ decisions: unknown[]; blocked: Array<{ id: string; reason: string }> }> | { decisions: unknown[]; blocked: Array<{ id: string; reason: string }> };
 export interface TickDeps {
-  root?: string; now?: Date; mode?: Mode; runId?: string; window?: Window;
+  root?: string; now?: Date | (() => Date); mode?: Mode; runId?: string; window?: Window;
+  heartbeatIntervalMs?: number;
   cards?: () => TaskCard[]; split?: SplitAdapter; placeCell?: PlaceAdapter;
   degradation?: () => { llm: boolean; board: boolean };
   gridHosts?: readonly GridHost[];
@@ -101,6 +103,19 @@ export function kstWindow(now: Date): Window {
   const hour = Number(new Intl.DateTimeFormat('en-US', { timeZone: 'Asia/Seoul', hour: '2-digit', hourCycle: 'h23' }).format(now));
   return hour < 12 ? '08' : hour < 18 ? '12' : '18';
 }
+/** KST schedule of graphs/orchestrator/orchestrator.yaml (`0 8,12,18 * * *`). */
+const ORCHESTRATOR_HOURS_KST = [8, 12, 18] as const;
+/** Grace past the next scheduled window before neighbors may call the orchestrator absent. */
+export const ORCHESTRATOR_LEASE_GRACE_MS = 60 * 60_000;
+/** The next scheduled window strictly after `now` — the orchestrator is idle, not absent, until then. */
+export function nextOrchestratorWindowAt(now: Date): Date {
+  const kst = new Date(now.getTime() + 9 * 3_600_000);
+  for (let day = 0; day < 2; day++) for (const hour of ORCHESTRATOR_HOURS_KST) {
+    const at = Date.UTC(kst.getUTCFullYear(), kst.getUTCMonth(), kst.getUTCDate() + day, hour) - 9 * 3_600_000;
+    if (at > now.getTime()) return new Date(at);
+  }
+  throw new Error('unreachable: no orchestrator window within two days');
+}
 function kstDay(now: Date): string {
   return new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit' }).format(now);
 }
@@ -371,7 +386,8 @@ async function optionalAdapter<T>(path: string, name: string): Promise<T | undef
 
 /** A graph command invokes one node; only the per-run file carries data across processes. */
 export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Promise<TickState> {
-  const now = deps.now ?? new Date();
+  const currentTime = () => typeof deps.now === 'function' ? deps.now() : deps.now ?? new Date();
+  const now = currentTime();
   const window = deps.window ?? kstWindow(now);
   const root = deps.root ?? effectiveInstanceRoot();
   const runId = deps.runId ?? graphRunId() ?? `${kstDay(now)}-${window}`;
@@ -379,6 +395,16 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
   const orchestratorConfig = getUserConfig().loops?.orchestrator;
   const configured = deps.mode ?? orchestratorConfig?.mode;
   const mode: Mode = configured === 'off' || configured === 'live' ? configured : 'shadow';
+  const pulse = (health: 'healthy' | 'degraded', at: Date): void => {
+    try { emitLoopHeartbeat(root, 'orchestrator', health, at,
+      new Date(nextOrchestratorWindowAt(at).getTime() + ORCHESTRATOR_LEASE_GRACE_MS).toISOString()); }
+    catch (error) { debug.log('loop.orchestrator', 'heartbeat-failed', { error: String(error).slice(0, 200) }, { level: 'warn' }); }
+  };
+  if (mode !== 'off') pulse('healthy', now);
+  const heartbeatTimer = mode === 'off' ? undefined : setInterval(() => pulse('healthy', currentTime()), deps.heartbeatIntervalMs ?? 60 * 60_000);
+  heartbeatTimer?.unref();
+  let nodeError: unknown;
+  try {
   const state: TickState = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) as TickState : initial(runId, window, mode, kstDay(now));
   state.steps ??= [];
   if (state.window !== window || state.mode !== mode) throw new Error('orchestrator run window/mode changed');
@@ -739,6 +765,13 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, JSON.stringify(state));
   return state;
+  } catch (error) {
+    nodeError = error;
+    throw error;
+  } finally {
+    if (heartbeatTimer) clearInterval(heartbeatTimer);
+    if (mode !== 'off') pulse(nodeError === undefined ? 'healthy' : 'degraded', currentTime());
+  }
 }
 
 /** COORD-HA — the production supply of `TickDeps.degradation` (config `loops.orchestrator.degradationSignal`). Shadow (the

package/src/loops/orchestrator/traffic.ts

@@ -50,6 +50,8 @@ function realOrResolved(path: string): string {
 }
 
 const IS_LAUNCH = /(?:^|\s)(?:\S*\/)?elanous\.mjs\s+(?:(?:--test|--config-dir\s+\S+)\s+)?harness\s+(?:ask|say)(?=\s|$)/;
+/** A `harness ask|say` launch command line — the only processes `trafficTick` counts. */
+export const isTrafficLaunch = (command: string): boolean => IS_LAUNCH.test(command);
 
 /** Process-to-seat resolution occurs at the boundary; this decision does no IO. */
 export function trafficTick({ processes, now, caps, lastLaunchAt, idleSince, openCells, nextRound, totalSlots, idleMinutes = 30 }: {

package/src/loops/registry.ts

@@ -685,6 +685,11 @@ export function unregisteredCronLoops(entries: AllLoopEntry[], opts: LoopRegistr
   return warnings;
 }
 
+/** Newest-first run history of one loop without re-listing the registry (health reads a longer window than `loop status`). */
+export function loopRecentRuns(id: string, opts: LoopRegistryOptions = {}, count = 5): LoopRun[] {
+  return recentRuns(id, opts.stateRoot ?? effectiveInstanceRoot(), count);
+}
+
 export function loopStatus(id: string, opts: LoopRegistryOptions = {}): LoopEntry & { recentRuns: LoopRun[] } {
   const loop = listLoops(opts).find(entry => entry.id === id);
   if (!loop) throw new Error(`loop not found: ${id}`);

package/src/market/publish.ts

@@ -91,6 +91,8 @@ export interface PublishResult {
   ok: boolean;
   sequence: number;
   published: Array<{ name: string; version: string; sha256: string; bundled: string[] }>;
+  /** With keepExisting: previous index entries whose name has no folder under pluginsDir, carried over unchanged. */
+  kept: Array<{ name: string; version: string; sha256: string }>;
   skipped: Array<{ dir: string; reason: string; hits?: InternalRefHit[] }>;
   /** Published anyway, but a reviewer should look (e.g. a third-party graph relying on core recipes). */
   warnings: Array<{ dir: string; graph: string; reason: 'third-party-core-recipe'; recipes: string[] }>;
@@ -103,6 +105,8 @@ export function publishMarket(input: {
   market: { name: string; displayName: string };
   key: { keyId: string; privateKeyPem: string };
   source?: { repoUrl: string; sha: string; basePath: string };
+  /** Carry over previous entries whose name is not a plugin folder under pluginsDir (entry, archive and unpacked files untouched). */
+  keepExisting?: boolean;
   now?: Date;
 }): PublishResult {
   let sequence = 1;
@@ -307,6 +311,18 @@ export function publishMarket(input: {
       published.push({ name: manifest.name, version: manifest.version, sha256, bundled });
       debug.log('market.publish', 'bundled', { name: manifest.name, version: manifest.version, skills: bundled });
     }
+    const kept: PublishResult['kept'] = [];
+    if (input.keepExisting && previous) {
+      // Folders under pluginsDir own their names (even when skipped); every other previous entry stays as it was.
+      const present = new Set(readdirSync(input.pluginsDir).filter(dir => lstatSync(join(input.pluginsDir, dir)).isDirectory()));
+      for (const item of previous.plugins) {
+        if (present.has(item.name)) continue;
+        plugins.push(item);
+        kept.push({ name: item.name, version: item.version, sha256: item.artifact.sha256 });
+        debug.log('market.publish', 'kept', { name: item.name, version: item.version });
+      }
+      plugins.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    }
     const index: MarketplaceIndex = { name: input.market.name, interface: { displayName: input.market.displayName },
       sequence, generatedAt: (input.now ?? new Date()).toISOString(), plugins };
     const bytes = Buffer.from(JSON.stringify(index, null, 2) + '\n');
@@ -345,7 +361,7 @@ export function publishMarket(input: {
       signatureText: readFileSync(join(input.outDir, 'index.sig'), 'utf8'), trustedKeys });
     if (!verified.ok) throw new Error(`index verification failed: ${verified.reason}: ${verified.detail}`);
     for (const item of published) debug.log('market.publish', 'published', { name: item.name, version: item.version, sequence });
-    return { ok: !skipped.some(item => item.reason === 'internal-reference'), sequence, published, skipped, warnings };
+    return { ok: !skipped.some(item => item.reason === 'internal-reference'), sequence, published, kept, skipped, warnings };
   } catch (error) {
     const rawReason = error instanceof Error ? error.message : 'unknown-error';
     const reason = input.key.privateKeyPem && rawReason.includes(input.key.privateKeyPem) ? 'invalid signing key' : rawReason;

package/src/maturity/feature-maturity.ts

@@ -16,10 +16,11 @@ export const FEATURE_MATURITY = {
     '/today': { pwa: 'stable' },
     '/term': { pwa: 'stable' },
     '/live': { pwa: 'stable' },
+    '/live-run': { pwa: 'beta' },        // HARNESS-RUN-LIVE-GRAPH (0.2.21) — 하니스 런 하나가 도는 장면
     '/market': { pwa: 'stable' },
     '/sessions': { pwa: 'stable' },
     '/settings': { pwa: 'beta' },
-    '/editor': { pwa: 'beta' },
+    '/editor': { pwa: 'stable' },        // EDITOR-NAV-PUBLIC (0.2.21) — 데모·0순위 피처: 역할을 안 고른 기기에도 «만들기 › 편집기»
     '/intake': { pwa: 'beta' },
     '/trace': { pwa: 'beta' },
     '/inside': { pwa: 'beta' },
@@ -116,6 +117,7 @@ export const FEATURE_MATURITY = {
     widget: 'tool',
     log: 'tool',
     loops: 'beta',
+    board: 'beta',
     persona: 'beta', // G3 b — 대화별 페르소나(GOAL-BENCH B7 #23836)
     memory: 'beta',
     export: 'stable',
@@ -160,7 +162,7 @@ export const FEATURE_MATURITY = {
     ping: 'stable', provider: 'stable', sessions: 'stable', fork: 'stable', resume: 'stable',
     decisions: 'stable', work: 'stable', cancel: 'stable',
     skills: 'beta', skill: 'beta', digest: 'beta', intake: 'beta', ad: 'beta',
-    taste: 'beta', missions: 'beta', attach: 'beta', detach: 'beta', now: 'beta', loops: 'beta', runs: 'beta', release: 'beta', away: 'beta', project: 'beta', wish: 'beta',
+    taste: 'beta', missions: 'beta', attach: 'beta', detach: 'beta', now: 'beta', loops: 'beta', runs: 'beta', board: 'beta', release: 'beta', away: 'beta', project: 'beta', wish: 'beta',
     brain: 'tool', cc: 'tool', cdx: 'tool', gem: 'tool', local: 'tool',
     harness: 'ops',
     // Existing commands outside the CXO four-grade menu list are owner-only.

package/src/mss/logging/redaction.ts

@@ -93,3 +93,20 @@ export function redactLogRecord(rec: LogRecord, opts: RedactOpts = {}): LogRecor
   const mask = opts.mask ?? defaultMask;
   return { ...rec, data: redactValue(rec.data, keyBlock, mask, new WeakSet()) };
 }
+
+/** Pre-bundle knowledge-pack DLP. Reasons are fixed labels, never source text or secret values.
+ * This is separate from the opt-in log masking path above. */
+const KNOWLEDGE_PACK_DLP_RULES: ReadonlyArray<{ reason: string; pattern: RegExp }> = [
+  { reason: 'secret-value', pattern: /-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY(?: BLOCK)?-----|\bBearer\s+[A-Za-z0-9._~+/-]{12,}={0,2}\b|\b(?:sk-[A-Za-z0-9_-]{16,}|xai-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}|AIza[A-Za-z0-9_-]{35})\b|\b(?:api[_-]?key|secret[_-]?key|access[_-]?token|private[_-]?key|token)['"]?\s*[=:]\s*['"]?[A-Za-z0-9_./+~-]{16,}/iu },
+  // A key that names a password/secret makes ANY assigned value secret: short or punctuated values count too.
+  // Schema flags (`"secret": true`) are not values.
+  { reason: 'secret-value', pattern: /\b(?:password|passwd|pwd|passphrase|client[_-]?secret|secret)['"]?\s*[=:]\s*(?!(?:true|false|null)\b)(?:"[^"\n]+"|'[^'\n]+'|[^\s'",;{}\[\]]{4,})/iu },
+  { reason: 'personal-information', pattern: /\b01[016789]-?\d{3,4}-?\d{4}\b|\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b|\b\d{6}-[1-8]\d{6}\b/iu },
+  { reason: 'internal-identifier', pattern: /(?:사번|사내\s*식별자|내부\s*식별자|employee[_ -]?id|internal[_ -]?id)\s*(?:[:=]|\s)\s*[A-Za-z0-9][A-Za-z0-9_-]{3,}/iu },
+  { reason: 'sales-confidential', pattern: /영업\s*기밀|(?:sales\s+confidential|confidential\s+sales|영업\s*비밀)/iu },
+];
+
+export function scanKnowledgePackDlp(text: string): string[] {
+  const reasons = KNOWLEDGE_PACK_DLP_RULES.filter(({ pattern }) => pattern.test(text)).map(({ reason }) => reason);
+  return [...new Set(reasons)];
+}

package/src/nexus/api/draft-metrics.ts

@@ -0,0 +1,128 @@
+import { join } from 'node:path';
+import { debug } from '../../debug/log.js';
+import type { DraftMetrics, OverlapMetrics } from '../../self-dev/draft-sweep.js';
+
+export type CeoDraftMetrics = DraftMetrics & { readonly overlap: OverlapMetrics | null };
+
+/**
+ * DRAFT-METRIC — CEO view source. Opening the page must never trigger a GitHub read:
+ * `read()` answers from memory and at most one background collection runs at a time,
+ * no more often than the TTL (or the failure back-off). The collection itself is
+ * `elanous harness drafts metrics --json` in a child process, which reads PR evidence
+ * through the batched GraphQL path (#24918) — one call per 40 drafts, no per-draft comments call.
+ */
+export type DraftMetricsState = 'measuring' | 'ready' | 'unavailable';
+
+export interface DraftMetricsSnapshot {
+  /** measuring = no value yet and a collection is running · unavailable = no value and the last collection failed. */
+  readonly state: DraftMetricsState;
+  readonly metrics: CeoDraftMetrics | null;
+  /** When the served value was collected (ISO). null without a value. */
+  readonly measuredAt: string | null;
+  /** A background collection is in flight. */
+  readonly refreshing: boolean;
+  /** Last collection failure; with a value it means the value is older than intended. */
+  readonly reason: string | null;
+}
+
+export interface DraftMetricsSourceOptions {
+  readonly collect?: () => Promise<CeoDraftMetrics>;
+  readonly ttlMs?: number;
+  readonly failureRetryMs?: number;
+  readonly now?: () => number;
+}
+
+export const DRAFT_METRICS_TTL_MS = 10 * 60_000;
+export const DRAFT_METRICS_FAILURE_RETRY_MS = 2 * 60_000;
+const COLLECT_TIMEOUT_MS = 5 * 60_000;
+
+function isMetrics(value: unknown): value is DraftMetrics {
+  if (!value || typeof value !== 'object') return false;
+  const row = value as Record<string, unknown>;
+  const count = (key: string) => Number.isInteger(row[key]) && (row[key] as number) >= 0;
+  const nullableNumber = (key: string) => row[key] === null || (typeof row[key] === 'number' && Number.isFinite(row[key]));
+  return count('inventory') && count('needsOwner') && count('converted48h') && count('cohort48h')
+    && nullableNumber('oldestAgeHours') && nullableNumber('conversion48h');
+}
+
+function isOverlapMetrics(value: unknown): value is OverlapMetrics {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const row = value as Record<string, unknown>;
+  const count = (key: string) => row[key] === null || (Number.isInteger(row[key]) && (row[key] as number) >= 0);
+  const nullableNumber = (key: string) => row[key] === null || (typeof row[key] === 'number' && Number.isFinite(row[key]) && (row[key] as number) >= 0);
+  return ['launches24h', 'launched', 'unmeasured', 'linked', 'autoLanded', 'salvaged', 'salvageUnmeasured'].every(count)
+    && typeof row.sourceIncomplete === 'boolean' && nullableNumber('secondSiblingMedianHours')
+    && (row.autoRate === null || (typeof row.autoRate === 'number' && Number.isFinite(row.autoRate) && row.autoRate >= 0 && row.autoRate <= 1));
+}
+
+/** Parses the CLI's single JSON line; malformed draft values fail, malformed overlap is unmeasured. */
+export function parseDraftMetricsOutput(stdout: string): CeoDraftMetrics {
+  const line = stdout.trim().split('\n').reverse().find((text) => text.trim().startsWith('{'));
+  if (!line) throw new Error('draft metrics: no JSON output');
+  const parsed: unknown = JSON.parse(line);
+  if (!isMetrics(parsed)) throw new Error('draft metrics: malformed output');
+  const { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h } = parsed;
+  const candidate = (parsed as DraftMetrics & { overlap?: unknown }).overlap;
+  return { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h,
+    overlap: isOverlapMetrics(candidate) ? candidate : null };
+}
+
+async function collectViaCli(): Promise<CeoDraftMetrics> {
+  const root = join(import.meta.dir, '../../..');
+  const proc = Bun.spawn(['bun', join(root, 'bin/elanous.mjs'), 'harness', 'drafts', 'metrics', '--json'], {
+    cwd: root, stdout: 'pipe', stderr: 'pipe',
+  });
+  const timer = setTimeout(() => proc.kill(), COLLECT_TIMEOUT_MS);
+  try {
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
+    if (exitCode !== 0) throw new Error(stderr.trim().split('\n').at(-1) || `draft metrics exited ${exitCode}`);
+    return parseDraftMetricsOutput(stdout);
+  } finally { clearTimeout(timer); }
+}
+
+export interface DraftMetricsSource {
+  read(): DraftMetricsSnapshot;
+}
+
+export function createDraftMetricsSource(options: DraftMetricsSourceOptions = {}): DraftMetricsSource {
+  const collect = options.collect ?? collectViaCli;
+  const ttl = options.ttlMs ?? DRAFT_METRICS_TTL_MS;
+  const retry = options.failureRetryMs ?? DRAFT_METRICS_FAILURE_RETRY_MS;
+  const now = options.now ?? Date.now;
+  let value: { metrics: CeoDraftMetrics; at: number } | null = null;
+  let failure: { reason: string; at: number } | null = null;
+  let inFlight: Promise<void> | null = null;
+
+  const refresh = (): void => {
+    if (inFlight) return;
+    const started = now();
+    inFlight = (async () => {
+      try {
+        const metrics = await collect();
+        value = { metrics, at: now() };
+        failure = null;
+        try { debug.log('nexus.draft-metrics', 'collected', { ms: now() - started, inventory: metrics.inventory }); } catch { /* fail-soft */ }
+      } catch (error) {
+        failure = { reason: error instanceof Error ? error.message : String(error), at: now() };
+        try { debug.log('nexus.draft-metrics', 'failed', { ms: now() - started, reason: failure.reason }); } catch { /* fail-soft */ }
+      } finally { inFlight = null; }
+    })();
+  };
+
+  return {
+    read() {
+      const clock = now();
+      const due = failure && (!value || failure.at >= value.at)
+        ? clock - failure.at >= retry
+        : !value || clock - value.at >= ttl;
+      if (due) refresh();
+      return {
+        state: value ? 'ready' : failure && !inFlight ? 'unavailable' : 'measuring',
+        metrics: value?.metrics ?? null,
+        measuredAt: value ? new Date(value.at).toISOString() : null,
+        refreshing: inFlight !== null,
+        reason: failure?.reason ?? null,
+      };
+    },
+  };
+}

package/src/nexus/api/graph-peer-edit.ts

@@ -0,0 +1,77 @@
+// W9c run guard (TC security review of #25123) — a peer «edit» grant lets another token rewrite a «mine» graph.
+// Running that graph would run the peer's change with this machine's privileges, so a peer save leaves a
+// marker next to the graph's access grants (`<mine>/.access/<id>.peer-edit.json`) and every run entry for a
+// «mine» graph refuses it until the owner approves that exact version (or re-saves it themselves).
+// Fail closed: a marker that exists but cannot be read or parsed refuses the run.
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const PEER_EDIT_REFUSAL = '상대가 바꾼 그래프 — 변경을 확인하고 승인해야 실행할 수 있다';
+
+export interface PeerEditRecord {
+  /** `peer:<first 8 hex of the peer token's sha256>` — never the token itself. */
+  editedBy: string;
+  /** The version id the peer save produced (`pending` while the save is in flight). */
+  version: string;
+  at: string;
+  approved?: { version: string; at: string };
+}
+
+export type PeerEditGate =
+  | { ok: true }
+  | { ok: false; error: 'peer-edit-unapproved'; record: PeerEditRecord }
+  | { ok: false; error: 'peer-edit-unreadable'; reason: string };
+
+export function peerEditFile(mineDir: string, id: string): string {
+  return join(mineDir, '.access', `${id}.peer-edit.json`);
+}
+
+/** null = no peer ever saved this graph. Throws when the marker exists but is unreadable or malformed. */
+export function readPeerEdit(mineDir: string, id: string): PeerEditRecord | null {
+  let text: string;
+  try { text = readFileSync(peerEditFile(mineDir, id), 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
+  const parsed: unknown = JSON.parse(text);
+  const record = parsed as PeerEditRecord;
+  if (!parsed || typeof parsed !== 'object' || typeof record.editedBy !== 'string' || typeof record.version !== 'string'
+    || typeof record.at !== 'string'
+    || (record.approved !== undefined && (typeof record.approved !== 'object' || record.approved === null
+      || typeof record.approved.version !== 'string' || typeof record.approved.at !== 'string'))) {
+    throw new Error('invalid peer-edit marker');
+  }
+  return record;
+}
+
+export function writePeerEdit(mineDir: string, id: string, record: PeerEditRecord): void {
+  mkdirSync(join(mineDir, '.access'), { recursive: true, mode: 0o700 });
+  const target = peerEditFile(mineDir, id);
+  const temp = `${target}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(record), { mode: 0o600 });
+    renameSync(temp, target);
+  } finally { rmSync(temp, { force: true }); }
+}
+
+/** An owner-authorized save replaces the peer's bytes with bytes the owner chose. */
+export function clearPeerEdit(mineDir: string, id: string): void {
+  rmSync(peerEditFile(mineDir, id), { force: true });
+}
+
+export function peerEditRunGate(mineDir: string, id: string): PeerEditGate {
+  let record: PeerEditRecord | null;
+  try { record = readPeerEdit(mineDir, id); }
+  catch (error) { return { ok: false, error: 'peer-edit-unreadable', reason: String(error).slice(0, 200) }; }
+  if (!record || record.approved?.version === record.version) return { ok: true };
+  return { ok: false, error: 'peer-edit-unapproved', record };
+}
+
+/** The 409 body every refusing run entry returns — `reason` is what the editor shows. */
+export function peerEditRefusalBody(id: string, gate: Exclude<PeerEditGate, { ok: true }>): Record<string, unknown> {
+  return gate.error === 'peer-edit-unapproved'
+    ? { error: gate.error, id, reason: PEER_EDIT_REFUSAL, editedBy: gate.record.editedBy, version: gate.record.version, editedAt: gate.record.at }
+    : { error: gate.error, id, reason: PEER_EDIT_REFUSAL, detail: gate.reason };
+}

package/src/nexus/api/graph-wizard-api.ts

@@ -0,0 +1,61 @@
+import { debug } from '../../debug/log.js';
+import { GraphWizardInputError, generateGraphFromPrompt, wizardInstalledPacks, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
+import { jsonResponse } from './json-response.js';
+
+export function handleGraphWizardPacksGet(deps: GraphWizardDeps = {}): Response {
+  return jsonResponse({ packs: wizardInstalledPacks(deps) });
+}
+
+const MAX_PROMPT = 4000;
+const MAX_YAML = 200_000;
+
+/**
+ * POST /v1/graphs/wizard {prompt, kind?, currentYaml?, history?}
+ * → 200 {ok:true, id, yaml, base, baseReason, issues:[], attempts, summary, labels, steps, recipes, dryRun} · 422 {ok:false, …} · 400 빈 prompt.
+ * (labels·steps·recipes·dryRun·baseReason 는 v2 추가 필드 — 기존 필드는 그대로.)
+ * currentYaml 이 빈 문자열이면 «빈 캔버스»로 보고 새 그래프를 짓는다(의도) · 내용이 있는데 id 가 없거나 형식 밖이면 400.
+ * 저장하지 않는다 — 저장은 POST /v1/graphs(새 그래프) 또는 PUT /v1/graphs/<id>/yaml(내 그래프).
+ */
+export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps = {}): Promise<Response> {
+  let body: Record<string, unknown>;
+  try {
+    const parsed: unknown = await req.json();
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('object');
+    body = parsed as Record<string, unknown>;
+  } catch { return jsonResponse({ error: 'bad_request', reason: 'json body required' }, 400); }
+  const prompt = typeof body.prompt === 'string' ? body.prompt.trim() : '';
+  if (!prompt) return jsonResponse({ error: 'bad_request', reason: 'prompt required' }, 400);
+  if (prompt.length > MAX_PROMPT) return jsonResponse({ error: 'bad_request', reason: `prompt longer than ${MAX_PROMPT}` }, 400);
+  if (body.kind !== undefined && body.kind !== 'harness' && body.kind !== 'workflow') {
+    return jsonResponse({ error: 'bad_request', reason: 'kind must be harness or workflow' }, 400);
+  }
+  if (body.currentYaml !== undefined && (typeof body.currentYaml !== 'string' || body.currentYaml.length > MAX_YAML)) {
+    return jsonResponse({ error: 'bad_request', reason: 'currentYaml must be a string' }, 400);
+  }
+  if (body.packId !== undefined && typeof body.packId !== 'string') {
+    return jsonResponse({ error: 'bad_request', reason: 'packId must be a string' }, 400);
+  }
+  let history: GraphWizardTurn[] | undefined;
+  if (body.history !== undefined) {
+    if (!Array.isArray(body.history) || !body.history.every((t) => t && typeof t === 'object' &&
+      ((t as GraphWizardTurn).role === 'user' || (t as GraphWizardTurn).role === 'assistant') && typeof (t as GraphWizardTurn).text === 'string')) {
+      return jsonResponse({ error: 'bad_request', reason: 'history must be [{role, text}]' }, 400);
+    }
+    history = body.history as GraphWizardTurn[];
+  }
+  try {
+    const result = await generateGraphFromPrompt({
+      prompt,
+      ...(body.kind ? { kind: body.kind as 'harness' | 'workflow' } : {}),
+      ...(typeof body.currentYaml === 'string' && body.currentYaml.trim() ? { currentYaml: body.currentYaml } : {}),
+      ...(history ? { history } : {}),
+      ...(typeof body.packId === 'string' ? { packId: body.packId } : {}),
+    }, deps);
+    return jsonResponse({ ...result, base: result.base ?? null }, result.ok ? 200 : 422);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (error instanceof GraphWizardInputError) return jsonResponse({ error: 'bad_request', reason: message }, 400);
+    debug.log('graph.wizard', 'error', { message });
+    return jsonResponse({ error: 'wizard-failed', reason: message }, 502);
+  }
+}