elanous 0.2.21 → 0.2.22

package/src/domains/coo-admin-tool.ts

@@ -4,10 +4,23 @@ import { getUserConfig } from '../user-config.js';
 import { getSecretAsync } from '../nexus/config/secrets/index.js';
 import { fetchLinearProjectIssues, type LinearProjectIssue } from '../connectors/linear.js';
 import { formatElanousCard } from './elanous-card.js';
+import recordedDateEvidence from './coo-admin-dates.evidence.json';
+
+type CooDateEvidence = {
+  project: string;
+  verifiedIssues: Array<{
+    identifier: string;
+    title: string;
+    url: string;
+    officialDeadline: string | null;
+    preparationPeriod: string | { start: string } | null;
+    representativeActionDate: string | null;
+  }>;
+};
 
 export const COO_ADMIN_SPEC: LLMToolSpec = {
   name: 'coo_admin',
-  description: '읽기 전용 Linear COO 행정 조회 — «행정 뭐 남았어 · COO 할 일 · 마감 다가오는 행정» 질문에 사용. 외부 행정 프로젝트의 열린 일을 마감 순으로 읽는다.',
+  description: '읽기 전용 Linear COO 행정 조회 — «행정 뭐 남았어 · COO 할 일 · 마감 다가오는 행정» 질문에 사용. 외부 행정 프로젝트의 열린 일을 우선순위와 확인된 날짜 근거로 브리핑한다.',
   parameters: { type: 'object', properties: {}, required: [] },
 };
 
@@ -16,6 +29,7 @@ export interface CooAdminDeps {
   fetch?: typeof fetch;
   project?: string;
   now?: Date;
+  dateEvidence?: CooDateEvidence;
 }
 
 /** Reads the configured Linear project without changing any Linear issue. */
@@ -32,27 +46,47 @@ export async function dispatchCooAdmin(_args: Record<string, unknown>, deps: Coo
     const issues = await fetchLinearProjectIssues({ apiKey, project, fetch: deps.fetch ?? fetch });
     const today = deps.now ?? new Date();
     const todayUtc = Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), today.getUTCDate());
-    const daysUntil = (date: string) => Math.round((Date.parse(`${date.slice(0, 10)}T00:00:00Z`) - todayUtc) / 86_400_000);
+    const daysUntil = (date: string) => Math.round((Date.parse(`${date}T00:00:00Z`) - todayUtc) / 86_400_000);
+    const dateEvidence = deps.dateEvidence ?? (recordedDateEvidence as CooDateEvidence);
+    const verifiedDate = (date: string | null | undefined): string | null => {
+      if (!date || !/^\d{4}-\d{2}-\d{2}$/.test(date)) return null;
+      const time = Date.parse(`${date}T00:00:00Z`);
+      return Number.isFinite(time) && new Date(time).toISOString().slice(0, 10) === date ? date : null;
+    };
+    const evidenceFor = (item: LinearProjectIssue) => dateEvidence.project === project
+      ? dateEvidence.verifiedIssues.find(row => row.identifier === item.identifier && row.url === item.url && row.title === item.title)
+      : undefined;
+    const deadlineFor = (item: LinearProjectIssue) => verifiedDate(evidenceFor(item)?.officialDeadline);
+    const rank = (item: LinearProjectIssue) => item.priority === 0 ? 5 : item.priority;
     issues.sort((a, b) => {
-      const deadlineOrder = a.dueDate == null ? (b.dueDate == null ? 0 : 1)
-        : b.dueDate == null ? -1 : daysUntil(a.dueDate) - daysUntil(b.dueDate);
-      return deadlineOrder || (a.priority === 0 ? 5 : a.priority) - (b.priority === 0 ? 5 : b.priority);
+      const aDue = deadlineFor(a);
+      const bDue = deadlineFor(b);
+      return rank(a) - rank(b) || (aDue === null ? (bDue === null ? 0 : 1)
+        : bDue === null ? -1 : daysUntil(aDue) - daysUntil(bDue));
     });
     count = issues.length;
     const lines = issues.map((item: LinearProjectIssue) => {
-      const days = item.dueDate ? daysUntil(item.dueDate) : null;
+      const evidence = evidenceFor(item);
+      const due = deadlineFor(item);
+      const days = due ? daysUntil(due) : null;
       if (days !== null && days < 0) overdue++;
-      const deadline = days === null ? '마감 없음' : days < 0 ? `지남 ${-days}일` : `D-${days}`;
-      return `${deadline} · ${item.title} · ${item.state.name} · ${item.assignee?.name ?? '미배정'}\n${item.url}`;
+      const deadline = due ? `확인된 마감일 ${due} (${days !== null && days < 0 ? `지남 ${-days}일` : `D-${days}`})` : '기한 미확인 · 확인 예정일 미정';
+      const preparation = verifiedDate(typeof evidence?.preparationPeriod === 'string'
+        ? evidence.preparationPeriod : evidence?.preparationPeriod?.start);
+      const representative = verifiedDate(evidence?.representativeActionDate);
+      const dates = [preparation && `준비 시작일 ${preparation}`, representative && `대표 손이 필요한 날 ${representative}`].filter(Boolean);
+      return `${deadline} · 우선순위 ${item.priority || '미지정'} · ${item.title} · ${item.state.name} · ${item.assignee?.name ?? '미배정'}${dates.length ? ` · ${dates.join(' · ')}` : ''}\n${item.url}`;
     });
     debug.log('coo.admin', 'read', { count, overdue, reason: 'ok' });
-    const scope = issues.truncated ? '최대 250건 중 조회한 항목만 마감 순으로 표시 (이후 항목은 포함되지 않음)\n' : '';
+    const scope = issues.truncated ? '최대 250건 중 조회한 항목만 우선순위·확인된 마감 순으로 표시 (이후 항목은 포함되지 않음)\n' : '';
     const prose = lines.length ? `${scope}${lines.join('\n')}` : '남은 행정 0건';
-    const card = formatElanousCard({ kind: 'coo-admin', items: issues.map(item => ({
-      title: item.title, due: item.dueDate?.slice(0, 10) ?? null,
-      daysLeft: item.dueDate ? daysUntil(item.dueDate) : null,
-      state: item.state.name, owner: item.assignee?.name ?? '미배정', url: item.url,
-    })) });
+    const card = formatElanousCard({ kind: 'coo-admin', items: issues.map(item => {
+      const due = deadlineFor(item);
+      return {
+        title: item.title, due, daysLeft: due ? daysUntil(due) : null,
+        state: item.state.name, owner: item.assignee?.name ?? '미배정', url: item.url,
+      };
+    }) });
     return `${prose}\n${card}`;
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);

package/src/domains/ops-status.ts

@@ -26,6 +26,7 @@ import { loadMandate, type TradeMandate } from './trade-mandate.js';
 import { debug, redactSecretText } from '../debug/log.js';
 import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
 import { detectRepeatedFailures, explainFailure } from './repeated-failure.js';
+import { listLoops, loopRecentRuns, type LoopRun } from '../loops/registry.js';
 
 /** 예약 레지스트리 조회 관측 — 실패가 0으로 접히지 않게 남기는 창구. */
 export const OPS_STATUS_LOG_CATEGORY = 'ops.status';
@@ -34,6 +35,29 @@ export const OPS_SCHEDULES_LOOKUP_FAILED_EVENT = 'schedules.lookup-failed';
 /** 예약 레지스트리 행 조회 seam — 미지정 시 실 레지스트리 reader. */
 export type ListScheduleRows = () => ScheduleRow[];
 
+/** Graph-loop health input — run history is newest first. */
+export type GraphLoopRuns = () => Array<{
+  id: string;
+  enabled: boolean;
+  runs: Array<Pick<LoopRun, 'at' | 'status' | 'failedNodes'>>;
+}>;
+
+/** Bounded window per loop: a streak whose oldest read run is already >24h old is flagged; a longer
+ * all-failed history than this window can only under-report (never over-report) the streak length. */
+export const GRAPH_LOOP_HEALTH_RUN_WINDOW = 50;
+
+function defaultGraphLoopRuns(): ReturnType<GraphLoopRuns> {
+  const out: ReturnType<GraphLoopRuns> = [];
+  for (const loop of listLoops().filter(entry => entry.enabled)) {
+    // One unreadable run history must not hide the other loops.
+    try { out.push({ id: loop.id, enabled: loop.enabled, runs: loopRecentRuns(loop.id, {}, GRAPH_LOOP_HEALTH_RUN_WINDOW) }); }
+    catch (err) {
+      debug.log('ops.health', 'graph-loop-failure-skipped', { loop: loop.id, reason: redactSecretText(err instanceof Error ? err.message : String(err)) });
+    }
+  }
+  return out;
+}
+
 /** 조회 seam(테스트) — 미지정 시 실 스토어. */
 export interface OpsStatusOpts {
   now?: Date;
@@ -47,6 +71,8 @@ export interface OpsStatusOpts {
   planDraftFor?: (missionId: string) => string;
   /** Health-only log reader seam; the default reads the current instance's last ten minutes read-only. */
   recentLogs?: () => LogStoreRow[];
+  /** Health-only graph-loop registry reader; injection avoids the real state directory. */
+  graphLoopRuns?: GraphLoopRuns;
 }
 
 export interface CountByStatus { [status: string]: number }
@@ -341,6 +367,33 @@ export function opsHealth(opts: OpsStatusOpts = {}): OpsHealthReport {
     }
   }
 
+  // Graph-run history is independent of ops_events loops and of log-store failures.
+  try {
+    const loops = (opts.graphLoopRuns ?? defaultGraphLoopRuns)();
+    const nowMs = (opts.now ?? new Date()).getTime();
+    let flagged = 0;
+    for (const loop of loops) {
+      if (!loop.enabled) continue;
+      const runs = [...loop.runs].sort((a, b) => Date.parse(b.at) - Date.parse(a.at));
+      const failures = [] as typeof runs;
+      for (const run of runs) {
+        if (run.status !== 'failed') break;
+        failures.push(run);
+      }
+      const first = failures.at(-1);
+      if (failures.length < 2 || !first || !Number.isFinite(Date.parse(first.at)) || nowMs - Date.parse(first.at) <= 24 * 3600_000) continue;
+      anomalies.push({
+        kind: 'repeated_failure', entity: `loop:${loop.id}`,
+        detail: `그래프 루프 ${loop.id} 연속 실패 ${failures.length}회 · ${first.at} 부터 · 마지막 실패 노드 ${failures[0]!.failedNodes.join(', ')}`,
+        since: first.at,
+      });
+      flagged++;
+    }
+    debug.log('ops.health', 'graph-loop-failure', { loops: loops.length, flagged });
+  } catch (err) {
+    debug.log('ops.health', 'graph-loop-failure-skipped', { reason: redactSecretText(err instanceof Error ? err.message : String(err)) });
+  }
+
   // Independent log check: an unreadable log store must not hide task/loop/schedule anomalies.
   try {
     const recentLogs = opts.recentLogs ?? (() => {

package/src/domains/outbound-alert.ts

@@ -17,6 +17,7 @@ import { getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveChannelBotToken } from '../channel-bot-token.js';
 import { explainReportRoute, isOperationalKind, kindRouteTarget, logKindRouteFallback, mainHomeTarget } from './telegram-kind-route.js';
 import { debug } from '../debug/log.js';
+import type { AddBriefItem } from '../briefing/brief-items.js';
 import { registerLogStoreSink, setLogInstanceName } from '../mss/logging/log-store.js';
 import type { LogSink } from '../mss/logging/sink.js';
 import { resolveDaemonEndpoint } from '../nexus/daemon-endpoint.js';
@@ -633,6 +634,13 @@ export function deliver(text: string, kind = 'alert', onBot?: (bot: string) => v
   return false;
 }
 
+type UndeliverableRecorder = (item: AddBriefItem) => void;
+let undeliverableRecorder: UndeliverableRecorder | null = null;
+/** Replace the ledger writer in tests; null restores the production ledger. */
+export function setUndeliverableRecorder(recorder: UndeliverableRecorder | null): void {
+  undeliverableRecorder = recorder;
+}
+
 /** OB8b — both paths failed: say so loudly, with the universe this process resolved, instead of a silent false.
  *  The usual cause (10-01 · MK): an ad-hoc `bun -e` or a script from a source tree resolves a cwd-derived test
  *  universe, so it finds neither the production daemon nor the production bot token. */
@@ -647,7 +655,22 @@ function reportUndeliverable(kind: string, daemonPath: DaemonPathClass | 'not-fo
   let route: ReturnType<typeof explainReportRoute> | null = null;
   try { if (cfg) route = explainReportRoute(cfg, kind); } catch { /* the report still goes out */ }
   ensureOutboundLogSink();
-  try { debug.log('outbound.send', 'undeliverable', { kind: safeObservationLabel(kind), daemonPath, universe, root, route: route?.reason ?? 'unknown' }); } catch { /* fail-soft */ }
+  const reason = route?.reason ?? 'unknown';
+  try { debug.log('outbound.send', 'undeliverable', { kind: safeObservationLabel(kind), daemonPath, universe, root, route: reason }); } catch { /* fail-soft */ }
+  try {
+    const record = undeliverableRecorder ?? ((item: AddBriefItem) => {
+      const { BriefItemsLedger } = require('../briefing/brief-items.js') as typeof import('../briefing/brief-items.js');
+      new BriefItemsLedger().add(item);
+    });
+    record({
+      domain: '운영', priority: 'P1', source: 'outbound.undeliverable',
+      text: `미전달: kind ${kind} · 데몬 ${daemonPath} · 경로 ${reason} · 우주 ${universe}`,
+      evidence: 'elanous logs --category outbound.send --event undeliverable',
+      dedupeKey: `${kind} · ${reason}`, dedupeWithinMs: 60 * 60_000,
+    });
+  } catch (error) {
+    try { debug.log('outbound.send', 'undeliverable-record-failed', { kind: safeObservationLabel(kind), route: reason, error: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
+  }
   const hint = universe === 'prod'
     ? '운영 데몬이 떠 있는지 확인: elanous nexus show'
     : '운영으로 보내려면 설치본 elanous 로 실행하거나 ELANOUS_STATE_DIR=~/.elanous 와 --config-dir ~/.elanous 를 준다';

package/src/exec-requests/planner.ts

@@ -7,6 +7,7 @@ import { defaultGraphsDir } from '../self-implement/graph-templates.js';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import type { ExecAttachment } from './store.js';
 import { debug } from '../debug/log.js';
+import { peerEditRunGate } from '../nexus/api/graph-peer-edit.js';
 import { OUTPUT_KINDS, pickDefaultOutput, type OutputKind } from './default-outputs.js';
 
 export interface InstalledGraph {
@@ -105,6 +106,11 @@ async function coreAndMineGraphs(coreDir: string, mineDir: string): Promise<Inst
           const id = doc?.graph_id;
           if (typeof id !== 'string' || !/^[a-z0-9-]+$/.test(id) || seen.has(id)) continue;
           if (core && doc?.loop?.exec_request !== true) continue;
+          // W9c — a «mine» graph a peer changed is not runnable until the owner approves it (fail closed).
+          if (!core) {
+            const gate = peerEditRunGate(dir, id);
+            if (!gate.ok) { debug.log('exec-requests', 'skipped-peer-edit', { id, error: gate.error }); continue; }
+          }
           const inputs = doc?.loop?.inputs;
           const inputKeys = core && Array.isArray(inputs)
             ? inputs.filter((key): key is string => typeof key === 'string')

package/src/graph-kinds/registry.ts

@@ -20,13 +20,13 @@ export interface NodeKindEntry {
   run?: NodeKindRun;
 }
 
-export const HARNESS_CORE_KINDS = ['agent', 'gate', 'git', 'judge', 'observe', 'hitl', 'subgraph'] as const;
+export const HARNESS_CORE_KINDS = ['agent', 'gate', 'git', 'judge', 'observe', 'hitl', 'subgraph', 'prompt'] as const;
 
 // Workflow validation, the palette, and executor variant labels read the same keys.
 export const WORKFLOW_CORE_KINDS = ['prompt', 'bash', 'skill', 'cft', 'approval', 'if', 'switch', 'iteration', 'classify', 'extract', 'set', 'filter', 'template', 'http', 'showroom', 'task', 'scheduleTrigger', 'webhookTrigger', 'discordTrigger', 'telegramTrigger', 'manualTrigger', 'chatTrigger', 'subworkflow', 'knowledge'] as const;
 
 const descriptions: Record<GraphKind, readonly string[]> = {
-  harness: ['Run an agent', 'Check an execution gate', 'Perform git operations', 'Judge an outcome', 'Observe a result', 'Request human input', 'Run a child graph'],
+  harness: ['Run an agent', 'Check an execution gate', 'Perform git operations', 'Judge an outcome', 'Observe a result', 'Request human input', 'Run a child graph', 'Run an LLM prompt'],
   workflow: ['Run an LLM prompt', 'Run a shell command', 'Invoke a skill', 'Invoke a CFT method', 'Request approval', 'Branch on a condition', 'Select a case', 'Iterate items', 'Classify input', 'Extract structured data', 'Assign variables', 'Filter items', 'Render a template', 'Make an HTTP request', 'Run a showroom', 'Create a task', 'Start on a schedule', 'Start on a webhook', 'Start on Discord', 'Start on Telegram', 'Start manually', 'Start on chat', 'Call another workflow', 'Search the vault for context'],
 };
 
@@ -93,21 +93,21 @@ export function getNodeKind(graph: GraphKind, kind: string): NodeKindEntry | und
 
 function isNodeKindRun(run: NodeKindRun): boolean {
   if (!run || typeof run !== 'object' || Array.isArray(run)) return false;
-  if ('bash' in run) return typeof run.bash === 'string' && run.bash.trim().length > 0 && !('http' in run) && !('skill' in run) && !('mcp' in run);
+  if ('bash' in run) return typeof run.bash === 'string' && run.bash.trim().length > 0 && !('prompt' in run) && !('http' in run) && !('skill' in run) && !('mcp' in run);
   if ('http' in run) {
-    return !('skill' in run) && !('mcp' in run)
+    return !('prompt' in run) && !('skill' in run) && !('mcp' in run)
       && typeof run.http === 'object' && run.http !== null
       && typeof run.http.method === 'string' && run.http.method.trim().length > 0
       && typeof run.http.url === 'string' && run.http.url.trim().length > 0
       && (run.http.body === undefined || typeof run.http.body === 'string');
   }
-  if ('skill' in run) return !('mcp' in run)
+  if ('skill' in run) return !('prompt' in run) && !('mcp' in run)
     && typeof run.skill === 'object' && run.skill !== null
     && typeof run.skill.name === 'string' && run.skill.name.trim().length > 0
     && (run.skill.prompt === undefined || typeof run.skill.prompt === 'string');
   if ('mcp' in run) {
     const spec = run.mcp;
-    return typeof spec === 'object' && spec !== null && !Array.isArray(spec)
+    return !('prompt' in run) && typeof spec === 'object' && spec !== null && !Array.isArray(spec)
       && typeof spec.server === 'string' && /^[a-z0-9_-]+$/.test(spec.server)
       && typeof spec.tool === 'string' && /^[a-z0-9_-]+$/.test(spec.tool)
       && (spec.args === undefined || (typeof spec.args === 'object' && spec.args !== null && !Array.isArray(spec.args)));

package/src/graph-runner/graph-cli.ts

@@ -154,10 +154,12 @@ export function registerGraphCommands(program: Command, runsDeps: { root?: strin
   graph.command('tick <file>')
     .description('Advance one graph run, resuming a pending decision or starting only when requested')
     .option('--start', 'Start a new run when the graph is idle')
+    .option('--schedule', 'Subscribe graph YAML triggers.schedule to the workflow scheduler and tick on each fire')
     .option('--input <json>', 'JSON object passed to a newly started run')
     .option('--json', 'Print the tick result as JSON')
-    .action(async (file: string, opts: { start?: boolean; input?: string; json?: boolean }) => {
+    .action(async (file: string, opts: { start?: boolean; schedule?: boolean; input?: string; json?: boolean }) => {
       try {
+        if (opts.schedule && (opts.start || opts.input !== undefined || opts.json)) throw new Error('--schedule cannot be combined with --start, --input or --json');
         if (opts.input !== undefined && !opts.start) throw new Error('--input requires --start');
         let input: Record<string, unknown> | undefined;
         if (opts.input !== undefined) {
@@ -169,11 +171,41 @@ export function registerGraphCommands(program: Command, runsDeps: { root?: strin
         }
         await (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink('graph');
         const { graphTick } = await import('./graph-tick.js');
+        if (opts.schedule) {
+          const { createScheduleSource } = await import('../workflow-runtime/triggers/schedule-source.js');
+          const graphFile = resolve(file);
+          const source = createScheduleSource();
+          // The CLI tick callback is the graph counterpart of the workflow scheduler's onEmit.
+          const onScheduledTick = async () => {
+            try {
+              const { notifyGraphEvents } = await import('./graph-notify.js');
+              const result = await graphTick(graphFile, { startIfIdle: true, deps: { notify: async () => { await notifyGraphEvents(); } } });
+              if (result.status === 'refused') console.error(`graph tick: refused: ${result.reason}`);
+              else if (result.status === 'failed') console.error(`graph tick: ${result.runId}: failed`);
+            } catch (error) {
+              debug.log('graph.runner', 'schedule-tick-failed', { file: graphFile, error: error instanceof Error ? error.message : String(error) });
+              console.error(`graph tick: ${error instanceof Error ? error.message : String(error)}`);
+            }
+          };
+          source.subscribeGraph(graphFile, onScheduledTick);
+          if (!source.subscriptions().length) throw new Error('graph triggers.schedule is missing');
+          await source.start();
+          if (source.handle()?.skipped.length) {
+            const reasons = source.handle()!.skipped.map(item => item.reason).join('; ');
+            await source.stop();
+            throw new Error(`graph schedule skipped: ${reasons}`);
+          }
+          console.log(`graph schedule: ${source.subscriptions().length} active`);
+          const shutdown = () => { void source.stop().then(() => { process.exitCode = 0; }); };
+          process.once('SIGINT', shutdown);
+          process.once('SIGTERM', shutdown);
+          return;
+        }
         const result = await graphTick(file, { startIfIdle: opts.start, ...(input === undefined ? {} : { input }),
           deps: { notify: async () => { const { notifyGraphEvents } = await import('./graph-notify.js'); await notifyGraphEvents(); } } });
         if (opts.json) await writeStdoutJson(JSON.stringify(result) + '\n');
         else console.log(`graph tick: ${result.action}${result.runId ? ` ${result.runId}: ${result.status}` : ''}`);
-        if (result.status === 'failed') process.exitCode = 1;
+        if (result.status === 'failed' || result.status === 'refused') process.exitCode = 1;
       } catch (error) {
         console.error(`graph tick: ${error instanceof Error ? error.message : String(error)}`);
         process.exitCode = 1;

package/src/graph-runner/graph-run-api.ts

@@ -11,6 +11,7 @@ import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { jsonResponse } from '../nexus/api/json-response.js';
+import { peerEditRefusalBody, peerEditRunGate } from '../nexus/api/graph-peer-edit.js';
 import { defaultGraphsDir } from '../self-implement/graph-templates.js';
 import { runGraph, type GraphRunState } from './runner.js';
 import { readWizardSteps, wizardRecipesFor } from '../graph-wizard/saved-steps.js';
@@ -143,6 +144,12 @@ export function handleGraphRunStart(rawId: string, deps: GraphRunApiDeps = {}):
   if (!id) return jsonResponse({ error: 'bad_request', reason: 'invalid graph id' }, 400);
   const mine = findMine(mineDirOf(deps), id);
   if (!mine) return jsonResponse({ error: 'not-found', id, reason: '내 그래프에만 실행이 있다 — 핵심 그래프는 복제해서 돌린다' }, 404);
+  // W9c — a peer «edit» save runs nothing on this machine until the owner approves it. Unreadable marker = refused.
+  const peerGate = peerEditRunGate(mineDirOf(deps), id);
+  if (!peerGate.ok) {
+    debug.log('graphs.run', 'refused-peer-edit', { id, error: peerGate.error }, { level: 'warn' });
+    return jsonResponse(peerEditRefusalBody(id, peerGate), 409);
+  }
   const recipesFile = deps.recipesFile ?? join(defaultGraphsDir(), 'demo', 'editor-recipes.yaml');
   let recipeText: string;
   let allowed: Set<string>;

package/src/graph-runner/graph-tick.ts

@@ -1,8 +1,10 @@
 import { randomUUID } from 'node:crypto';
-import { closeSync, mkdirSync, openSync, readFileSync, rmdirSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { closeSync, mkdirSync, openSync, readFileSync, realpathSync, rmdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { parse as parseYaml } from 'yaml';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { debug } from '../debug/log.js';
+import { peerEditRunGate } from '../nexus/api/graph-peer-edit.js';
 import { observeModelInputTokens } from '../harness/model-input-observation.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { DecisionLedger } from '../decisions/decision-ledger.js';
@@ -11,23 +13,74 @@ import { latestGraphRun, runGraph, type GraphRunOptions, type GraphRunState } fr
 export interface GraphTickOptions {
   startIfIdle?: boolean;
   input?: unknown;
+  mineDir?: string;
   deps?: GraphRunOptions['deps'] & { notify?: () => void | Promise<void>; isAlive?: (pid: number) => boolean };
 }
 
 export interface GraphTickResult {
-  action: 'waiting' | 'resumed' | 'started' | 'idle';
+  action: 'waiting' | 'resumed' | 'started' | 'idle' | 'refused';
   runId?: string;
-  status?: GraphRunState['status'];
+  status?: GraphRunState['status'] | 'refused';
+  reason?: 'peer-edit-unapproved' | 'peer-edit-unreadable';
 }
 
 /** One tick owns the graph from the latest-state read through notification and the chosen action. */
 export async function graphTick(path: string, options: GraphTickOptions = {}): Promise<GraphTickResult> {
-  const document: unknown = parseYaml(readFileSync(path, 'utf8'));
-  const graphId = document && typeof document === 'object' && !Array.isArray(document)
-    ? (document as Record<string, unknown>).graph_id : undefined;
-  if (typeof graphId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(graphId) || graphId === '.' || graphId === '..') {
-    throw new Error(`invalid graph id: ${String(graphId)}`);
-  }
+  const mineDir = options.mineDir ?? join(elanousStateRoot(), 'graphs');
+  const inside = (dir: string, file: string): boolean => {
+    const contained = relative(dir, file);
+    return contained !== '' && contained !== '..' && !contained.startsWith(`..${sep}`) && !isAbsolute(contained);
+  };
+  const inspect = (): { source: string; graphId: string; ids: string[] } => {
+    const source = readFileSync(path, 'utf8');
+    const document: unknown = parseYaml(source);
+    const graphId = document && typeof document === 'object' && !Array.isArray(document)
+      ? (document as Record<string, unknown>).graph_id : undefined;
+    if (typeof graphId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(graphId) || graphId === '.' || graphId === '..') {
+      throw new Error(`invalid graph id: ${String(graphId)}`);
+    }
+    const ids: string[] = [];
+    const file = resolve(path);
+    const realFile = realpathSync(path);
+    let realMine: string | undefined;
+    try { realMine = realpathSync(mineDir); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }
+    for (const candidate of [file, realFile]) {
+      if (inside(resolve(mineDir), candidate) || (realMine && inside(realMine, candidate))) {
+        const name = basename(candidate);
+        if (/\.ya?ml$/.test(name)) ids.push(name.replace(/\.ya?ml$/, ''));
+      }
+    }
+    if (ids.length) ids.push(graphId);
+    return { source, graphId, ids: [...new Set(ids)] };
+  };
+  const initial = inspect();
+  const graphId = initial.graphId;
+  const peerRefusal = (ids: string[]): GraphTickResult | null => {
+    for (const id of ids) {
+      const gate = peerEditRunGate(mineDir, id);
+      if (gate.ok) continue;
+      debug.log('graph.runner', 'tick-peer-edit-refused', {
+        id,
+        editedBy: gate.error === 'peer-edit-unapproved' ? gate.record.editedBy : undefined,
+        version: gate.error === 'peer-edit-unapproved' ? gate.record.version : undefined,
+      });
+      return { action: 'refused', status: 'refused', reason: gate.error };
+    }
+    return null;
+  };
+  const refused = peerRefusal(initial.ids);
+  if (refused) return refused;
+  const peerEditRefused = Symbol('tick-peer-edit-refused');
+  let nodeRefusal: GraphTickResult | null = null;
+  const runDeps: GraphRunOptions['deps'] = {
+    ...options.deps,
+    beforeNode: () => {
+      options.deps?.beforeNode?.();
+      nodeRefusal = peerRefusal([...new Set([...initial.ids, ...inspect().ids])]);
+      if (nodeRefusal) throw peerEditRefused;
+    },
+  };
   const root = options.deps?.root ?? effectiveInstanceRoot();
   const lock = join(root, 'graph-runs', graphId, '.tick.lock');
   mkdirSync(join(root, 'graph-runs', graphId), { recursive: true });
@@ -38,6 +91,11 @@ export async function graphTick(path: string, options: GraphTickOptions = {}): P
     acquireTickLock(lock, graphId, options.deps?.isAlive ?? processAlive);
     acquired = true;
     await options.deps?.notify?.();
+    const current = inspect();
+    const refusedAfterNotify = peerRefusal([...new Set([...initial.ids, ...current.ids])]);
+    if (refusedAfterNotify) return refusedAfterNotify;
+    // The run identity and executed bytes must agree with the ledger and the gate.
+    if (current.graphId !== graphId) throw new Error(`graph id changed during tick: ${graphId} -> ${current.graphId}`);
     const latest = latestGraphRun(graphId, root);
     const growthCard = latest?.growthPark
       ? (options.deps?.growthDecision?.list ?? ((filters: { status: 'all' }) => new DecisionLedger({ stateDir: root }).list(filters)))({ status: 'all' })
@@ -49,10 +107,10 @@ export async function graphTick(path: string, options: GraphTickOptions = {}): P
     if (latest?.status === 'awaiting-approval' && !latest.pending?.decision && !growthDecided) {
       result = { action: 'waiting', runId: latest.runId, status: latest.status };
     } else if (latest?.status === 'running' || (latest?.status === 'awaiting-approval' && (latest.pending?.decision || growthDecided))) {
-      const state = await runGraph(path, { resumeRunId: latest.runId, deps: { ...options.deps, root } });
+      const state = await runGraph(path, { resumeRunId: latest.runId, graphSource: current.source, deps: { ...runDeps, root } });
       result = { action: 'resumed', runId: state.runId, status: state.status };
     } else if (options.startIfIdle) {
-      const state = await runGraph(path, { input: options.input, deps: { ...options.deps, root } });
+      const state = await runGraph(path, { input: options.input, graphSource: current.source, deps: { ...runDeps, root } });
       result = { action: 'started', runId: state.runId, status: state.status };
     } else {
       result = { action: 'idle' };
@@ -60,6 +118,9 @@ export async function graphTick(path: string, options: GraphTickOptions = {}): P
     (options.deps?.log ?? ((event: string, data: Record<string, unknown>) => debug.log('graph.runner', event, data)))
       ('tick', { graphId, action: result.action, ...(result.runId ? { runId: result.runId } : {}) });
     return result;
+  } catch (error) {
+    if (error === peerEditRefused && nodeRefusal) return nodeRefusal;
+    throw error;
   } finally {
     try {
       if (acquired) {