elanous 0.2.21 → 0.2.22

package/src/loops/neighbor-runtime.ts

@@ -0,0 +1,88 @@
+import { debug } from '../debug/log.js';
+import { openMsgStore } from '../msg/msg-store.js';
+import { judgeNeighbor, type Neighbor } from './neighbors.js';
+import { join } from 'node:path';
+
+export type LoopHealth = 'healthy' | 'degraded';
+export type NeighborIncident = { observer: string; neighbor: string; state: 'absent'; reason: string; action: Neighbor['onAbsent']['action']; to: string; at: string; lastSeenAt: string | null };
+
+export const SEAT_NEIGHBORS: Record<string, Neighbor[]> = Object.fromEntries(['OP', 'TC', 'MK', 'UX'].map(seat => [seat,
+  [
+    ...['OP', 'TC', 'MK', 'UX'].filter(peer => peer !== seat).map(peer => ({
+      id: peer === 'MK' ? 'cmo-seat' : `${peer.toLowerCase()}-seat`, exchange: ['status'] as Neighbor['exchange'],
+      heartbeat: { everyMinutes: 15, missedTicks: 2 },
+      onAbsent: peer === 'OP' ? { action: 'delegate' as const, delegateTo: 'steward' }
+        : peer === 'TC' ? { action: 'escalate' as const, delegateTo: 'orchestrator' }
+          : { action: 'defer' as const, delegateTo: 'orchestrator' },
+    })),
+    { id: 'orchestrator', exchange: ['status'], heartbeat: { everyMinutes: 120, missedTicks: 2 },
+      onAbsent: { action: 'escalate', delegateTo: 'human' } },
+  ],
+]));
+
+type Signal = { at: string; health: LoopHealth; ends_at: string | null };
+
+function withStore<T>(root: string, fn: (store: ReturnType<typeof openMsgStore>) => T): T {
+  const store = openMsgStore(join(root, 'msg', 'messages.db'));
+  try {
+    store.db.exec(`CREATE TABLE IF NOT EXISTS loop_signals (loop_id TEXT PRIMARY KEY, at TEXT NOT NULL, health TEXT NOT NULL, ends_at TEXT);
+      CREATE TABLE IF NOT EXISTS loop_watches (observer TEXT NOT NULL, neighbor TEXT NOT NULL, first_at TEXT NOT NULL, PRIMARY KEY(observer, neighbor));
+      CREATE TABLE IF NOT EXISTS loop_incidents (observer TEXT NOT NULL, neighbor TEXT NOT NULL, signal_at TEXT NOT NULL,
+        reason TEXT NOT NULL, action TEXT NOT NULL, recipient TEXT NOT NULL, at TEXT NOT NULL,
+        PRIMARY KEY(observer, neighbor, signal_at, reason));`);
+    return fn(store);
+  } finally { store.close(); }
+}
+
+/** Durable signal, independent of chat sessions or the seat work-item ledger. */
+export function emitLoopHeartbeat(root: string, loopId: string, health: LoopHealth, now: Date, endsAt?: string): void {
+  if (!/^[a-z][a-z0-9-]*$/.test(loopId) || !Number.isFinite(now.getTime())) throw new Error('invalid loop heartbeat');
+  if (endsAt && !Number.isFinite(Date.parse(endsAt))) throw new Error('invalid heartbeat end');
+  withStore(root, store => {
+    store.db.query(`INSERT INTO loop_signals(loop_id, at, health, ends_at) VALUES(?, ?, ?, ?)
+      ON CONFLICT(loop_id) DO UPDATE SET at=excluded.at, health=excluded.health, ends_at=excluded.ends_at
+      WHERE loop_signals.at <= excluded.at`).run(loopId, now.toISOString(), health, endsAt ?? null);
+  });
+  debug.log(`loop.${loopId}`, 'heartbeat', { loopId, at: now.toISOString(), health, endsAt: endsAt ?? null });
+}
+
+/** First watch starts the missing-signal clock. Action receipt and message commit atomically. */
+export function checkLoopNeighbors(root: string, observer: string, neighbors: readonly Neighbor[], now: Date): NeighborIncident[] {
+  return withStore(root, store => {
+    const incidents: NeighborIncident[] = [];
+    for (const neighbor of neighbors) {
+      if (neighbor.id === observer) continue;
+      try {
+        store.db.exec('BEGIN IMMEDIATE');
+        store.db.query('INSERT OR IGNORE INTO loop_watches(observer, neighbor, first_at) VALUES(?, ?, ?)').run(observer, neighbor.id, now.toISOString());
+        const signal = store.db.query('SELECT at, health, ends_at FROM loop_signals WHERE loop_id=?').get(neighbor.id) as Signal | null;
+        const watch = store.db.query('SELECT first_at FROM loop_watches WHERE observer=? AND neighbor=?').get(observer, neighbor.id) as { first_at: string };
+        const judgment = judgeNeighbor({ neighbor, lastSeenAt: signal?.at ?? watch.first_at, now });
+        const expired = !!signal?.ends_at && Date.parse(signal.ends_at) <= now.getTime();
+        // A declared lease (ends_at in the future) outranks the heartbeat interval: a scheduled loop idle between
+        // windows is not absent until its own declared end passes.
+        const leased = !!signal?.ends_at && !expired;
+        const absent = expired || signal?.health === 'degraded' || (!leased && judgment.state === 'absent');
+        if (!absent) { store.db.exec('COMMIT'); continue; }
+        const reason = expired ? 'end-expired' : signal?.health === 'degraded' ? 'degraded' : judgment.reason;
+        const signalAt = signal?.at ?? watch.first_at;
+        const { action, delegateTo: to } = neighbor.onAbsent;
+        const inserted = store.db.query(`INSERT OR IGNORE INTO loop_incidents(observer, neighbor, signal_at, reason, action, recipient, at)
+          VALUES(?, ?, ?, ?, ?, ?, ?)`).run(observer, neighbor.id, signalAt, reason, action, to, now.toISOString());
+        if (inserted.changes) {
+          const incident: NeighborIncident = { observer, neighbor: neighbor.id, state: 'absent', reason, action, to,
+            at: now.toISOString(), lastSeenAt: signal?.at ?? null };
+          store.append({ from: observer, to, kind: `neighbor-${action}`,
+            body: `[${observer} → ${to}] ${neighbor.id} ${reason}: ${action}` });
+          incidents.push(incident);
+        }
+        store.db.exec('COMMIT');
+      } catch (error) {
+        try { store.db.exec('ROLLBACK'); } catch { /* no open transaction */ }
+        debug.log('loop.neighbors', 'check-failed', { observer, neighbor: neighbor.id, error: String(error) }, { level: 'warn' });
+      }
+    }
+    for (const incident of incidents) debug.log('loop.neighbors', 'absent', incident, { level: 'warn' });
+    return incidents;
+  });
+}

package/src/loops/orchestrator/author-depth.ts

@@ -12,7 +12,7 @@ import { getUserConfig, ORCHESTRATOR_DEFAULTS, type OrchestratorSeat } from '../
 import { checkAuthorInput } from './author-input-check.js';
 import { AuthorLedger } from './author-ledger.js';
 import { collectWork, findOverlaps, type WorkItem } from './overlap.js';
-import { seatOfTree, trafficTick, TRAFFIC_SEATS } from './traffic.js';
+import { isTrafficLaunch, seatOfTree, trafficTick, TRAFFIC_SEATS } from './traffic.js';
 
 export type AuthorCell = Pick<ChecklistItem, 'id' | 'title' | 'owner' | 'status' | 'evidence'> & { version: string };
 export type AuthorQueueRow = Pick<QueueItem, 'seat' | 'status'> & Partial<Pick<QueueItem, 'input' | 'kind'>>;
@@ -101,8 +101,12 @@ export interface CollectAuthorDepthDeps {
   versions?: () => readonly [string, string];
   ledger?: Pick<AuthorLedger, 'request'>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
+  listProcesses?: typeof defaultListHarnessProcesses;
 }
 
+/** Budget for the shadow's process read (it runs inside the queue lock, whose waiters give up after 30 s). */
+export const AUTHOR_DEPTH_PROCESS_DEADLINE_MS = 10_000;
+
 function defaultVersions(now: Date, root = releaseLedgerRoot()): readonly [string, string] {
   if (!existsSync(join(root, 'release', 'features.sqlite'))) throw new Error('release schedule ledger unavailable');
   const upcoming = listSchedules(root).filter(row => row.cutAt && Date.parse(row.cutAt) > now.getTime())
@@ -122,15 +126,6 @@ export function collectAuthorDepth(deps: CollectAuthorDepthDeps = {}): AuthorDep
   };
   const cfg = deps.caps && deps.running ? null : observe('config', () => getUserConfig().loops?.orchestrator ?? ORCHESTRATOR_DEFAULTS);
   const caps = deps.caps ? observe('caps', deps.caps) : cfg === null ? null : observe('caps', () => cfg.seatCaps);
-  const running = deps.running ? observe('running', deps.running) : cfg === null ? null : observe('running', () => {
-    const observation = defaultListHarnessProcesses();
-    if (observation.status !== 'ok') throw new Error(`process observation ${observation.status}`);
-    const processes = observation.records.map(process => ({ ...process,
-      seat: seatOfTree(process.cwdStatus === 'unknown' ? undefined : process.cwd, cfg) }));
-    const measured = trafficTick({ processes, now, caps: cfg.seatCaps, openCells: [] });
-    if (measured.unassigned) throw new Error(`${measured.unassigned} unassigned harness launch process(es)`);
-    return Object.fromEntries(measured.seats.map(row => [row.seat, row.running]));
-  });
   const queued = observe('queue', deps.queued ?? (() => listHarnessQueue({ root: deps.root })));
   const releaseRoot = deps.root ?? releaseLedgerRoot();
   const versions = observe('versions', deps.versions ?? (() => defaultVersions(now, releaseRoot)));
@@ -139,7 +134,30 @@ export function collectAuthorDepth(deps: CollectAuthorDepthDeps = {}): AuthorDep
       throw new Error('checklist ledger unavailable');
     return deps.cells?.(version) ?? listChecklist(version, deps.root).items.map(item => ({ ...item, version }));
   }));
-  const overlaps = observe('overlap', deps.overlaps ?? (() => {
+  // Without release cells there is no candidate to compare, and the host reads below are the expensive ones (every launch's
+  // cwd · open PRs over the network) — a fresh --test universe has no release ledger, so it skips them (10-08 tick hang).
+  const noCells = cells === null && !deps.cells;
+  if (noCells && !deps.running && cfg !== null) unreadable.push({ source: 'running', reason: 'skipped: no release cells to compare' });
+  const running = deps.running ? observe('running', deps.running) : cfg === null || noCells ? null : observe('running', () => {
+    // Only launch processes are counted, so only they need a cwd; the whole read is bounded because the queue tick runs
+    // this shadow inside its lock (10-08: ~490 host processes × lsof kept a --test tick for minutes).
+    const started = Date.now();
+    const observation = (deps.listProcesses ?? defaultListHarnessProcesses)({ include: record => isTrafficLaunch(record.command),
+      cwdOnly: true, deadlineMs: AUTHOR_DEPTH_PROCESS_DEADLINE_MS });
+    if (observation.status !== 'ok') throw new Error(`process observation ${observation.status}`);
+    const late = observation.records.filter(process => process.cwdFailureReason?.startsWith('observation deadline')).length;
+    (deps.log ?? ((category: string, event: string, data: Record<string, unknown>) => debug.log(category, event, data)))(
+      'loop.orchestrator', 'author-depth-processes', { launches: observation.records.length, late, ms: Date.now() - started,
+        deadlineMs: AUTHOR_DEPTH_PROCESS_DEADLINE_MS });
+    if (late) throw new Error(`process observation deadline ${AUTHOR_DEPTH_PROCESS_DEADLINE_MS}ms: ${late} launch cwd(s) unread`);
+    const processes = observation.records.map(process => ({ ...process,
+      seat: seatOfTree(process.cwdStatus === 'unknown' ? undefined : process.cwd, cfg) }));
+    const measured = trafficTick({ processes, now, caps: cfg.seatCaps, openCells: [] });
+    if (measured.unassigned) throw new Error(`${measured.unassigned} unassigned harness launch process(es)`);
+    return Object.fromEntries(measured.seats.map(row => [row.seat, row.running]));
+  });
+  if (noCells && !deps.overlaps) unreadable.push({ source: 'overlap', reason: 'skipped: no release cells to compare' });
+  const overlaps = noCells && !deps.overlaps ? null : observe('overlap', deps.overlaps ?? (() => {
     const observed = collectWork();
     if (observed.unreadableTrees || observed.unreadableGoals || observed.work.some(item => item.unreadable))
       throw new Error(`incomplete work observation: trees=${observed.unreadableTrees} goals=${observed.unreadableGoals}`);

package/src/loops/orchestrator/overlap.ts

@@ -19,6 +19,9 @@ export interface CollectWorkDeps {
   config?: Pick<OrchestratorLoopConfig, 'seatTrees'>;
 }
 
+/** Budget for collectWork's per-process cwd reads. */
+export const COLLECT_WORK_PROCESS_DEADLINE_MS = 10_000;
+
 const repoRoot = resolve(import.meta.dir, '../../..');
 const defaultRunGh = (args: string[]): string => execFileSync('bun', ['bin/elanous.mjs', '--test', 'gh', ...args], {
   cwd: repoRoot, encoding: 'utf8', timeout: 60_000, maxBuffer: 20 * 1024 * 1024,
@@ -63,7 +66,10 @@ function goalFiles(text: string): string[] {
 export function collectWork(deps: CollectWorkDeps = {}): CollectWorkResult {
   const prs = JSON.parse((deps.runGh ?? defaultRunGh)(['pr', 'list', '--state', 'open', '--limit', '1000', '--json', 'number,title,body,headRefName,files,isDraft,labels'])) as OpenPr[];
   if (!Array.isArray(prs)) throw new Error('PR observation is not a list');
-  const observation = (deps.listProcesses ?? defaultListHarnessProcesses)();
+  // Only goal-carrying launches become work, so only they need a cwd; bounded so a host with hundreds of harness processes
+  // cannot hold the queue lock for minutes (10-08). Records past the budget stay cwd-unknown → their goal reads unreadable.
+  const observation = deps.listProcesses ? deps.listProcesses()
+    : defaultListHarnessProcesses({ include: record => goalPath(record.command) !== null, cwdOnly: true, deadlineMs: COLLECT_WORK_PROCESS_DEADLINE_MS });
   if (observation.status !== 'ok') throw new Error(`process observation ${observation.status}`);
   const cfg = deps.config ?? getUserConfig().loops?.orchestrator ?? ORCHESTRATOR_DEFAULTS;
   const excluded = { stalled: 0, superseded: 0, draft: 0 };

package/src/loops/orchestrator/resync-shadow.ts

@@ -171,7 +171,7 @@ export async function runResyncShadow(max = 3, deps: ResyncShadowDeps = {}): Pro
       entry.resolvedFiles = outcome.resolvedFiles ?? [];
       if (outcome.sizeCollapse?.length || outcome.providerFailure?.length || outcome.testDeclarationLoss?.length) {
         entry.verdict = 'guard-tripped';
-      } else if (outcome.status === 'merged' || outcome.status === 'llm-resolved') {
+      } else if (outcome.status === 'merged' || outcome.status === 'llm-resolved' || outcome.status === 'deterministic-resolved') {
         if (entry.testFiles.length === 0) entry.verdict = 'merge-ok-no-tests';
         else {
           const test = (deps.runTests ?? defaultRunTests)(tmp, entry.testFiles);

package/src/loops/orchestrator/tick.ts

@@ -8,6 +8,7 @@ import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { getUserConfig, type OrchestratorLoopConfig } from '../../user-config.js';
 import { rubricPriority } from '../../release-loop/rubric.js';
 import { debug } from '../../debug/log.js';
+import { emitLoopHeartbeat } from '../neighbor-runtime.js';
 import { listSelfDevRuns, runSummaryLine, selfDevRunsDir } from '../../self-dev/run-store.js';
 import { planAction, runSeatLoopOnce, type SeatDeps, type SeatItem } from '../../seat-loop/seat-loop.js';
 import { addHarnessQueue, harnessQueueOutcome, setQueuedPoolHint } from '../../harness/harness-queue.js';
@@ -48,7 +49,8 @@ export type PlacementInput = { id: string; title: string; owner: string; priorit
 export type PlaceAdapter = (cell: PlacementInput, deps?: { dryRun?: boolean; now?: Date }) => Promise<{ version?: string } | null> | { version?: string } | null;
 export type RebalanceAdapter = (version: string) => Promise<{ decisions: unknown[]; blocked: Array<{ id: string; reason: string }> }> | { decisions: unknown[]; blocked: Array<{ id: string; reason: string }> };
 export interface TickDeps {
-  root?: string; now?: Date; mode?: Mode; runId?: string; window?: Window;
+  root?: string; now?: Date | (() => Date); mode?: Mode; runId?: string; window?: Window;
+  heartbeatIntervalMs?: number;
   cards?: () => TaskCard[]; split?: SplitAdapter; placeCell?: PlaceAdapter;
   degradation?: () => { llm: boolean; board: boolean };
   gridHosts?: readonly GridHost[];
@@ -101,6 +103,19 @@ export function kstWindow(now: Date): Window {
   const hour = Number(new Intl.DateTimeFormat('en-US', { timeZone: 'Asia/Seoul', hour: '2-digit', hourCycle: 'h23' }).format(now));
   return hour < 12 ? '08' : hour < 18 ? '12' : '18';
 }
+/** KST schedule of graphs/orchestrator/orchestrator.yaml (`0 8,12,18 * * *`). */
+const ORCHESTRATOR_HOURS_KST = [8, 12, 18] as const;
+/** Grace past the next scheduled window before neighbors may call the orchestrator absent. */
+export const ORCHESTRATOR_LEASE_GRACE_MS = 60 * 60_000;
+/** The next scheduled window strictly after `now` — the orchestrator is idle, not absent, until then. */
+export function nextOrchestratorWindowAt(now: Date): Date {
+  const kst = new Date(now.getTime() + 9 * 3_600_000);
+  for (let day = 0; day < 2; day++) for (const hour of ORCHESTRATOR_HOURS_KST) {
+    const at = Date.UTC(kst.getUTCFullYear(), kst.getUTCMonth(), kst.getUTCDate() + day, hour) - 9 * 3_600_000;
+    if (at > now.getTime()) return new Date(at);
+  }
+  throw new Error('unreachable: no orchestrator window within two days');
+}
 function kstDay(now: Date): string {
   return new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit' }).format(now);
 }
@@ -371,7 +386,8 @@ async function optionalAdapter<T>(path: string, name: string): Promise<T | undef
 
 /** A graph command invokes one node; only the per-run file carries data across processes. */
 export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Promise<TickState> {
-  const now = deps.now ?? new Date();
+  const currentTime = () => typeof deps.now === 'function' ? deps.now() : deps.now ?? new Date();
+  const now = currentTime();
   const window = deps.window ?? kstWindow(now);
   const root = deps.root ?? effectiveInstanceRoot();
   const runId = deps.runId ?? graphRunId() ?? `${kstDay(now)}-${window}`;
@@ -379,6 +395,16 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
   const orchestratorConfig = getUserConfig().loops?.orchestrator;
   const configured = deps.mode ?? orchestratorConfig?.mode;
   const mode: Mode = configured === 'off' || configured === 'live' ? configured : 'shadow';
+  const pulse = (health: 'healthy' | 'degraded', at: Date): void => {
+    try { emitLoopHeartbeat(root, 'orchestrator', health, at,
+      new Date(nextOrchestratorWindowAt(at).getTime() + ORCHESTRATOR_LEASE_GRACE_MS).toISOString()); }
+    catch (error) { debug.log('loop.orchestrator', 'heartbeat-failed', { error: String(error).slice(0, 200) }, { level: 'warn' }); }
+  };
+  if (mode !== 'off') pulse('healthy', now);
+  const heartbeatTimer = mode === 'off' ? undefined : setInterval(() => pulse('healthy', currentTime()), deps.heartbeatIntervalMs ?? 60 * 60_000);
+  heartbeatTimer?.unref();
+  let nodeError: unknown;
+  try {
   const state: TickState = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) as TickState : initial(runId, window, mode, kstDay(now));
   state.steps ??= [];
   if (state.window !== window || state.mode !== mode) throw new Error('orchestrator run window/mode changed');
@@ -739,6 +765,13 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, JSON.stringify(state));
   return state;
+  } catch (error) {
+    nodeError = error;
+    throw error;
+  } finally {
+    if (heartbeatTimer) clearInterval(heartbeatTimer);
+    if (mode !== 'off') pulse(nodeError === undefined ? 'healthy' : 'degraded', currentTime());
+  }
 }
 
 /** COORD-HA — the production supply of `TickDeps.degradation` (config `loops.orchestrator.degradationSignal`). Shadow (the

package/src/loops/orchestrator/traffic.ts

@@ -50,6 +50,8 @@ function realOrResolved(path: string): string {
 }
 
 const IS_LAUNCH = /(?:^|\s)(?:\S*\/)?elanous\.mjs\s+(?:(?:--test|--config-dir\s+\S+)\s+)?harness\s+(?:ask|say)(?=\s|$)/;
+/** A `harness ask|say` launch command line — the only processes `trafficTick` counts. */
+export const isTrafficLaunch = (command: string): boolean => IS_LAUNCH.test(command);
 
 /** Process-to-seat resolution occurs at the boundary; this decision does no IO. */
 export function trafficTick({ processes, now, caps, lastLaunchAt, idleSince, openCells, nextRound, totalSlots, idleMinutes = 30 }: {

package/src/loops/registry.ts

@@ -685,6 +685,11 @@ export function unregisteredCronLoops(entries: AllLoopEntry[], opts: LoopRegistr
   return warnings;
 }
 
+/** Newest-first run history of one loop without re-listing the registry (health reads a longer window than `loop status`). */
+export function loopRecentRuns(id: string, opts: LoopRegistryOptions = {}, count = 5): LoopRun[] {
+  return recentRuns(id, opts.stateRoot ?? effectiveInstanceRoot(), count);
+}
+
 export function loopStatus(id: string, opts: LoopRegistryOptions = {}): LoopEntry & { recentRuns: LoopRun[] } {
   const loop = listLoops(opts).find(entry => entry.id === id);
   if (!loop) throw new Error(`loop not found: ${id}`);

package/src/market/publish.ts

@@ -91,6 +91,8 @@ export interface PublishResult {
   ok: boolean;
   sequence: number;
   published: Array<{ name: string; version: string; sha256: string; bundled: string[] }>;
+  /** With keepExisting: previous index entries whose name has no folder under pluginsDir, carried over unchanged. */
+  kept: Array<{ name: string; version: string; sha256: string }>;
   skipped: Array<{ dir: string; reason: string; hits?: InternalRefHit[] }>;
   /** Published anyway, but a reviewer should look (e.g. a third-party graph relying on core recipes). */
   warnings: Array<{ dir: string; graph: string; reason: 'third-party-core-recipe'; recipes: string[] }>;
@@ -103,6 +105,8 @@ export function publishMarket(input: {
   market: { name: string; displayName: string };
   key: { keyId: string; privateKeyPem: string };
   source?: { repoUrl: string; sha: string; basePath: string };
+  /** Carry over previous entries whose name is not a plugin folder under pluginsDir (entry, archive and unpacked files untouched). */
+  keepExisting?: boolean;
   now?: Date;
 }): PublishResult {
   let sequence = 1;
@@ -307,6 +311,18 @@ export function publishMarket(input: {
       published.push({ name: manifest.name, version: manifest.version, sha256, bundled });
       debug.log('market.publish', 'bundled', { name: manifest.name, version: manifest.version, skills: bundled });
     }
+    const kept: PublishResult['kept'] = [];
+    if (input.keepExisting && previous) {
+      // Folders under pluginsDir own their names (even when skipped); every other previous entry stays as it was.
+      const present = new Set(readdirSync(input.pluginsDir).filter(dir => lstatSync(join(input.pluginsDir, dir)).isDirectory()));
+      for (const item of previous.plugins) {
+        if (present.has(item.name)) continue;
+        plugins.push(item);
+        kept.push({ name: item.name, version: item.version, sha256: item.artifact.sha256 });
+        debug.log('market.publish', 'kept', { name: item.name, version: item.version });
+      }
+      plugins.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    }
     const index: MarketplaceIndex = { name: input.market.name, interface: { displayName: input.market.displayName },
       sequence, generatedAt: (input.now ?? new Date()).toISOString(), plugins };
     const bytes = Buffer.from(JSON.stringify(index, null, 2) + '\n');
@@ -345,7 +361,7 @@ export function publishMarket(input: {
       signatureText: readFileSync(join(input.outDir, 'index.sig'), 'utf8'), trustedKeys });
     if (!verified.ok) throw new Error(`index verification failed: ${verified.reason}: ${verified.detail}`);
     for (const item of published) debug.log('market.publish', 'published', { name: item.name, version: item.version, sequence });
-    return { ok: !skipped.some(item => item.reason === 'internal-reference'), sequence, published, skipped, warnings };
+    return { ok: !skipped.some(item => item.reason === 'internal-reference'), sequence, published, kept, skipped, warnings };
   } catch (error) {
     const rawReason = error instanceof Error ? error.message : 'unknown-error';
     const reason = input.key.privateKeyPem && rawReason.includes(input.key.privateKeyPem) ? 'invalid signing key' : rawReason;

package/src/maturity/feature-maturity.ts

@@ -117,6 +117,7 @@ export const FEATURE_MATURITY = {
     widget: 'tool',
     log: 'tool',
     loops: 'beta',
+    board: 'beta',
     persona: 'beta', // G3 b — 대화별 페르소나(GOAL-BENCH B7 #23836)
     memory: 'beta',
     export: 'stable',
@@ -161,7 +162,7 @@ export const FEATURE_MATURITY = {
     ping: 'stable', provider: 'stable', sessions: 'stable', fork: 'stable', resume: 'stable',
     decisions: 'stable', work: 'stable', cancel: 'stable',
     skills: 'beta', skill: 'beta', digest: 'beta', intake: 'beta', ad: 'beta',
-    taste: 'beta', missions: 'beta', attach: 'beta', detach: 'beta', now: 'beta', loops: 'beta', runs: 'beta', release: 'beta', away: 'beta', project: 'beta', wish: 'beta',
+    taste: 'beta', missions: 'beta', attach: 'beta', detach: 'beta', now: 'beta', loops: 'beta', runs: 'beta', board: 'beta', release: 'beta', away: 'beta', project: 'beta', wish: 'beta',
     brain: 'tool', cc: 'tool', cdx: 'tool', gem: 'tool', local: 'tool',
     harness: 'ops',
     // Existing commands outside the CXO four-grade menu list are owner-only.

package/src/mss/logging/redaction.ts

@@ -93,3 +93,20 @@ export function redactLogRecord(rec: LogRecord, opts: RedactOpts = {}): LogRecor
   const mask = opts.mask ?? defaultMask;
   return { ...rec, data: redactValue(rec.data, keyBlock, mask, new WeakSet()) };
 }
+
+/** Pre-bundle knowledge-pack DLP. Reasons are fixed labels, never source text or secret values.
+ * This is separate from the opt-in log masking path above. */
+const KNOWLEDGE_PACK_DLP_RULES: ReadonlyArray<{ reason: string; pattern: RegExp }> = [
+  { reason: 'secret-value', pattern: /-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY(?: BLOCK)?-----|\bBearer\s+[A-Za-z0-9._~+/-]{12,}={0,2}\b|\b(?:sk-[A-Za-z0-9_-]{16,}|xai-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}|AIza[A-Za-z0-9_-]{35})\b|\b(?:api[_-]?key|secret[_-]?key|access[_-]?token|private[_-]?key|token)['"]?\s*[=:]\s*['"]?[A-Za-z0-9_./+~-]{16,}/iu },
+  // A key that names a password/secret makes ANY assigned value secret: short or punctuated values count too.
+  // Schema flags (`"secret": true`) are not values.
+  { reason: 'secret-value', pattern: /\b(?:password|passwd|pwd|passphrase|client[_-]?secret|secret)['"]?\s*[=:]\s*(?!(?:true|false|null)\b)(?:"[^"\n]+"|'[^'\n]+'|[^\s'",;{}\[\]]{4,})/iu },
+  { reason: 'personal-information', pattern: /\b01[016789]-?\d{3,4}-?\d{4}\b|\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b|\b\d{6}-[1-8]\d{6}\b/iu },
+  { reason: 'internal-identifier', pattern: /(?:사번|사내\s*식별자|내부\s*식별자|employee[_ -]?id|internal[_ -]?id)\s*(?:[:=]|\s)\s*[A-Za-z0-9][A-Za-z0-9_-]{3,}/iu },
+  { reason: 'sales-confidential', pattern: /영업\s*기밀|(?:sales\s+confidential|confidential\s+sales|영업\s*비밀)/iu },
+];
+
+export function scanKnowledgePackDlp(text: string): string[] {
+  const reasons = KNOWLEDGE_PACK_DLP_RULES.filter(({ pattern }) => pattern.test(text)).map(({ reason }) => reason);
+  return [...new Set(reasons)];
+}

package/src/nexus/api/draft-metrics.ts

@@ -1,6 +1,8 @@
 import { join } from 'node:path';
 import { debug } from '../../debug/log.js';
-import type { DraftMetrics } from '../../self-dev/draft-sweep.js';
+import type { DraftMetrics, OverlapMetrics } from '../../self-dev/draft-sweep.js';
+
+export type CeoDraftMetrics = DraftMetrics & { readonly overlap: OverlapMetrics | null };
 
 /**
  * DRAFT-METRIC — CEO view source. Opening the page must never trigger a GitHub read:
@@ -14,7 +16,7 @@ export type DraftMetricsState = 'measuring' | 'ready' | 'unavailable';
 export interface DraftMetricsSnapshot {
   /** measuring = no value yet and a collection is running · unavailable = no value and the last collection failed. */
   readonly state: DraftMetricsState;
-  readonly metrics: DraftMetrics | null;
+  readonly metrics: CeoDraftMetrics | null;
   /** When the served value was collected (ISO). null without a value. */
   readonly measuredAt: string | null;
   /** A background collection is in flight. */
@@ -24,7 +26,7 @@ export interface DraftMetricsSnapshot {
 }
 
 export interface DraftMetricsSourceOptions {
-  readonly collect?: () => Promise<DraftMetrics>;
+  readonly collect?: () => Promise<CeoDraftMetrics>;
   readonly ttlMs?: number;
   readonly failureRetryMs?: number;
   readonly now?: () => number;
@@ -43,17 +45,29 @@ function isMetrics(value: unknown): value is DraftMetrics {
     && nullableNumber('oldestAgeHours') && nullableNumber('conversion48h');
 }
 
-/** Parses the CLI's single JSON line; anything else is a failed collection, never a zero. */
-export function parseDraftMetricsOutput(stdout: string): DraftMetrics {
+function isOverlapMetrics(value: unknown): value is OverlapMetrics {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const row = value as Record<string, unknown>;
+  const count = (key: string) => row[key] === null || (Number.isInteger(row[key]) && (row[key] as number) >= 0);
+  const nullableNumber = (key: string) => row[key] === null || (typeof row[key] === 'number' && Number.isFinite(row[key]) && (row[key] as number) >= 0);
+  return ['launches24h', 'launched', 'unmeasured', 'linked', 'autoLanded', 'salvaged', 'salvageUnmeasured'].every(count)
+    && typeof row.sourceIncomplete === 'boolean' && nullableNumber('secondSiblingMedianHours')
+    && (row.autoRate === null || (typeof row.autoRate === 'number' && Number.isFinite(row.autoRate) && row.autoRate >= 0 && row.autoRate <= 1));
+}
+
+/** Parses the CLI's single JSON line; malformed draft values fail, malformed overlap is unmeasured. */
+export function parseDraftMetricsOutput(stdout: string): CeoDraftMetrics {
   const line = stdout.trim().split('\n').reverse().find((text) => text.trim().startsWith('{'));
   if (!line) throw new Error('draft metrics: no JSON output');
   const parsed: unknown = JSON.parse(line);
   if (!isMetrics(parsed)) throw new Error('draft metrics: malformed output');
   const { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h } = parsed;
-  return { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h };
+  const candidate = (parsed as DraftMetrics & { overlap?: unknown }).overlap;
+  return { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h,
+    overlap: isOverlapMetrics(candidate) ? candidate : null };
 }
 
-async function collectViaCli(): Promise<DraftMetrics> {
+async function collectViaCli(): Promise<CeoDraftMetrics> {
   const root = join(import.meta.dir, '../../..');
   const proc = Bun.spawn(['bun', join(root, 'bin/elanous.mjs'), 'harness', 'drafts', 'metrics', '--json'], {
     cwd: root, stdout: 'pipe', stderr: 'pipe',
@@ -75,7 +89,7 @@ export function createDraftMetricsSource(options: DraftMetricsSourceOptions = {}
   const ttl = options.ttlMs ?? DRAFT_METRICS_TTL_MS;
   const retry = options.failureRetryMs ?? DRAFT_METRICS_FAILURE_RETRY_MS;
   const now = options.now ?? Date.now;
-  let value: { metrics: DraftMetrics; at: number } | null = null;
+  let value: { metrics: CeoDraftMetrics; at: number } | null = null;
   let failure: { reason: string; at: number } | null = null;
   let inFlight: Promise<void> | null = null;
 

package/src/nexus/api/graph-peer-edit.ts

@@ -0,0 +1,77 @@
+// W9c run guard (TC security review of #25123) — a peer «edit» grant lets another token rewrite a «mine» graph.
+// Running that graph would run the peer's change with this machine's privileges, so a peer save leaves a
+// marker next to the graph's access grants (`<mine>/.access/<id>.peer-edit.json`) and every run entry for a
+// «mine» graph refuses it until the owner approves that exact version (or re-saves it themselves).
+// Fail closed: a marker that exists but cannot be read or parsed refuses the run.
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const PEER_EDIT_REFUSAL = '상대가 바꾼 그래프 — 변경을 확인하고 승인해야 실행할 수 있다';
+
+export interface PeerEditRecord {
+  /** `peer:<first 8 hex of the peer token's sha256>` — never the token itself. */
+  editedBy: string;
+  /** The version id the peer save produced (`pending` while the save is in flight). */
+  version: string;
+  at: string;
+  approved?: { version: string; at: string };
+}
+
+export type PeerEditGate =
+  | { ok: true }
+  | { ok: false; error: 'peer-edit-unapproved'; record: PeerEditRecord }
+  | { ok: false; error: 'peer-edit-unreadable'; reason: string };
+
+export function peerEditFile(mineDir: string, id: string): string {
+  return join(mineDir, '.access', `${id}.peer-edit.json`);
+}
+
+/** null = no peer ever saved this graph. Throws when the marker exists but is unreadable or malformed. */
+export function readPeerEdit(mineDir: string, id: string): PeerEditRecord | null {
+  let text: string;
+  try { text = readFileSync(peerEditFile(mineDir, id), 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
+  const parsed: unknown = JSON.parse(text);
+  const record = parsed as PeerEditRecord;
+  if (!parsed || typeof parsed !== 'object' || typeof record.editedBy !== 'string' || typeof record.version !== 'string'
+    || typeof record.at !== 'string'
+    || (record.approved !== undefined && (typeof record.approved !== 'object' || record.approved === null
+      || typeof record.approved.version !== 'string' || typeof record.approved.at !== 'string'))) {
+    throw new Error('invalid peer-edit marker');
+  }
+  return record;
+}
+
+export function writePeerEdit(mineDir: string, id: string, record: PeerEditRecord): void {
+  mkdirSync(join(mineDir, '.access'), { recursive: true, mode: 0o700 });
+  const target = peerEditFile(mineDir, id);
+  const temp = `${target}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(record), { mode: 0o600 });
+    renameSync(temp, target);
+  } finally { rmSync(temp, { force: true }); }
+}
+
+/** An owner-authorized save replaces the peer's bytes with bytes the owner chose. */
+export function clearPeerEdit(mineDir: string, id: string): void {
+  rmSync(peerEditFile(mineDir, id), { force: true });
+}
+
+export function peerEditRunGate(mineDir: string, id: string): PeerEditGate {
+  let record: PeerEditRecord | null;
+  try { record = readPeerEdit(mineDir, id); }
+  catch (error) { return { ok: false, error: 'peer-edit-unreadable', reason: String(error).slice(0, 200) }; }
+  if (!record || record.approved?.version === record.version) return { ok: true };
+  return { ok: false, error: 'peer-edit-unapproved', record };
+}
+
+/** The 409 body every refusing run entry returns — `reason` is what the editor shows. */
+export function peerEditRefusalBody(id: string, gate: Exclude<PeerEditGate, { ok: true }>): Record<string, unknown> {
+  return gate.error === 'peer-edit-unapproved'
+    ? { error: gate.error, id, reason: PEER_EDIT_REFUSAL, editedBy: gate.record.editedBy, version: gate.record.version, editedAt: gate.record.at }
+    : { error: gate.error, id, reason: PEER_EDIT_REFUSAL, detail: gate.reason };
+}

package/src/nexus/api/graph-wizard-api.ts

@@ -1,7 +1,11 @@
 import { debug } from '../../debug/log.js';
-import { GraphWizardInputError, generateGraphFromPrompt, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
+import { GraphWizardInputError, generateGraphFromPrompt, wizardInstalledPacks, type GraphWizardDeps, type GraphWizardTurn } from '../../graph-wizard/generate.js';
 import { jsonResponse } from './json-response.js';
 
+export function handleGraphWizardPacksGet(deps: GraphWizardDeps = {}): Response {
+  return jsonResponse({ packs: wizardInstalledPacks(deps) });
+}
+
 const MAX_PROMPT = 4000;
 const MAX_YAML = 200_000;
 
@@ -28,6 +32,9 @@ export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps
   if (body.currentYaml !== undefined && (typeof body.currentYaml !== 'string' || body.currentYaml.length > MAX_YAML)) {
     return jsonResponse({ error: 'bad_request', reason: 'currentYaml must be a string' }, 400);
   }
+  if (body.packId !== undefined && typeof body.packId !== 'string') {
+    return jsonResponse({ error: 'bad_request', reason: 'packId must be a string' }, 400);
+  }
   let history: GraphWizardTurn[] | undefined;
   if (body.history !== undefined) {
     if (!Array.isArray(body.history) || !body.history.every((t) => t && typeof t === 'object' &&
@@ -42,6 +49,7 @@ export async function handleGraphWizardPost(req: Request, deps: GraphWizardDeps
       ...(body.kind ? { kind: body.kind as 'harness' | 'workflow' } : {}),
       ...(typeof body.currentYaml === 'string' && body.currentYaml.trim() ? { currentYaml: body.currentYaml } : {}),
       ...(history ? { history } : {}),
+      ...(typeof body.packId === 'string' ? { packId: body.packId } : {}),
     }, deps);
     return jsonResponse({ ...result, base: result.base ?? null }, result.ok ? 200 : 422);
   } catch (error) {