elanous 0.2.21 → 0.2.23

package/src/mss/logging/horizon-watch.ts

@@ -0,0 +1,168 @@
+import { Database } from 'bun:sqlite';
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { debug } from '../../debug/log.js';
+import { registerStandaloneLogSink } from '../../domains/standalone-log-sink.js';
+import { LogStore, logsDbPath } from './log-store.js';
+
+type HorizonStatus = 'present' | 'empty' | 'unreadable';
+type Attribution = 'first-sample' | 'none' | 'attributed' | 'unattributed-loss';
+
+export interface HorizonSample {
+  atMs: number;
+  oldestTsMs: number | null;
+  status: HorizonStatus;
+  spanHours: number | null;
+  advancedMs: number;
+  deletedEvents: number;
+  attribution: Attribution;
+}
+
+export type HorizonTick = HorizonSample & { outcome: 'ok' | 'fail' };
+
+export interface HorizonWatchOptions { db?: string; state?: string }
+export interface HorizonWatchDeps {
+  openStore?: (path: string) => Pick<LogStore, 'horizon' | 'queryAll' | 'close'>;
+  now?: () => number;
+  stateDir?: string;
+}
+
+function lastReadableSample(path: string): HorizonSample | null {
+  let content = '';
+  try { content = readFileSync(path, 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+  for (const line of content.trimEnd().split('\n').reverse()) {
+    if (!line) continue;
+    const sample = JSON.parse(line) as HorizonSample;
+    if (sample.status !== 'unreadable') return sample;
+  }
+  try { return JSON.parse(readFileSync(join(dirname(path), 'last-readable.json'), 'utf8')) as HorizonSample; }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function saveReadableCheckpoint(path: string, sample: HorizonSample): void {
+  const checkpoint = join(dirname(path), 'last-readable.json');
+  mkdirSync(dirname(path), { recursive: true });
+  const temporary = `${checkpoint}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, JSON.stringify(sample) + '\n');
+    renameSync(temporary, checkpoint);
+  } finally { rmSync(temporary, { force: true }); }
+}
+
+function saveSample(path: string, sample: HorizonSample): void {
+  let lines: string[];
+  try { lines = readFileSync(path, 'utf8').trimEnd().split('\n').filter(Boolean); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    lines = [];
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, [...lines.slice(-499), JSON.stringify(sample)].join('\n') + '\n');
+    renameSync(temporary, path);
+  } finally { rmSync(temporary, { force: true }); }
+  if (sample.status !== 'unreadable') saveReadableCheckpoint(path, sample);
+}
+
+/** Read the store only; samples live outside logs.db and observations go through debug sinks. */
+export function runHorizonWatchTick(opts: HorizonWatchOptions = {}, deps: HorizonWatchDeps = {}): HorizonTick {
+  const path = join(deps.stateDir ?? opts.state ?? join(elanousStateRoot(), 'log-horizon'), 'samples.jsonl');
+  // Serialize the entire read/compare/append transaction across cron and manual processes.
+  // This lock database is in the sample state directory, never in logs.db.
+  mkdirSync(dirname(path), { recursive: true });
+  const lock = new Database(join(dirname(path), 'samples.lock.db'));
+  try {
+    lock.run('PRAGMA busy_timeout = 120000');
+    lock.run('BEGIN IMMEDIATE');
+    try {
+      return recordSample();
+    } finally {
+      lock.run('ROLLBACK');
+    }
+  } finally {
+    lock.close();
+  }
+
+  function recordSample(): HorizonTick {
+    const now = deps.now ?? Date.now;
+    // The tick clock is read *after* the horizon read (see below), so every `deleted` event logged before the
+    // horizon was observed has ts <= atMs. Windows are half-open (prev.atMs, atMs]: each event is counted once.
+    let atMs: number | undefined;
+    let oldestTsMs: number | null = null;
+  let status: HorizonStatus = 'unreadable';
+  let deletedEvents = 0;
+  let store: ReturnType<NonNullable<HorizonWatchDeps['openStore']>> | undefined;
+  let previous: HorizonSample | null = null;
+  try {
+    store = (deps.openStore ?? LogStore.openReadOnly)(opts.db ?? logsDbPath());
+    const horizon = store.horizon();
+    atMs = now();
+    status = horizon.status;
+    oldestTsMs = horizon.status === 'present' ? horizon.oldestTsMs : null;
+    previous = lastReadableSample(path);
+    if (previous) {
+      deletedEvents = store.queryAll({
+        exactCategories: ['log-store.retention'], events: ['deleted'], sinceMs: previous.atMs + 1, untilMs: atMs,
+      }).length;
+    }
+  } catch (error) {
+    debug.log('log-store.horizon', 'read-failed', { reason: String(error) }, { level: 'warn' });
+    status = 'unreadable';
+    oldestTsMs = null;
+  } finally { store?.close(); }
+  atMs ??= now();
+
+  const advancedMs = status === 'present' && previous?.status === 'present' && previous.oldestTsMs !== null
+    ? Math.max(0, oldestTsMs! - previous.oldestTsMs) : 0;
+  const attribution: Attribution = status === 'unreadable' ? 'none'
+    : !previous ? 'first-sample'
+    : advancedMs === 0 ? 'none'
+    : deletedEvents > 0 ? 'attributed' : 'unattributed-loss';
+  const sample: HorizonSample = {
+    atMs, oldestTsMs, status,
+    spanHours: oldestTsMs === null ? null : (atMs - oldestTsMs) / 3_600_000,
+    advancedMs, deletedEvents, attribution,
+  };
+  try { saveSample(path, sample); }
+  catch (error) {
+    debug.log('log-store.horizon', 'sample-write-failed', { reason: String(error) }, { level: 'warn' });
+    return { ...sample, outcome: 'fail' };
+  }
+  debug.log('log-store.horizon', 'sample', {
+    oldestTs: oldestTsMs === null ? null : new Date(oldestTsMs).toISOString(),
+    spanHours: sample.spanHours, advancedMs, deletedEvents, attribution,
+  }, { level: attribution === 'unattributed-loss' ? 'warn' : 'info' });
+  return { ...sample, outcome: status === 'unreadable' ? 'fail' : 'ok' };
+  }
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const opts: HorizonWatchOptions = {};
+  let json = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') json = true;
+    else if (arg === '--db' && args[i + 1]) opts.db = args[++i];
+    else if (arg === '--state' && args[i + 1]) opts.state = args[++i];
+    else { process.stderr.write(`Unknown or incomplete option: ${arg}\n`); process.exit(1); }
+  }
+  const sinkReady = await registerStandaloneLogSink('log-horizon');
+  // A sink failure must not suppress the sample: the store read (and an 'unreadable' record) still happens,
+  // but the tick cannot claim success because its observation never reached logs.db.
+  const tick = runHorizonWatchTick(opts);
+  const result = sinkReady ? tick : { ...tick, outcome: 'fail' as const, reason: 'log-sink-registration-failed' };
+  if (json) process.stdout.write(`${JSON.stringify(result)}\n`);
+  else process.stdout.write(`${result.outcome}: ${result.attribution} (${result.status})${sinkReady ? '' : ' · log-sink-registration-failed'}\n`);
+  if (result.outcome === 'fail') process.exitCode = 1;
+}

package/src/mss/logging/log-store.ts

@@ -17,7 +17,8 @@
 //     severity 는 SCHEME(이벤트 접미사) → `level` 컬럼으로 물질화.
 
 import { Database } from 'bun:sqlite';
-import { mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmdirSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
 import { dirname, join } from 'node:path';
 
@@ -81,9 +82,13 @@ export interface LogStoreRetention {
   maxAgeDays: number;
   /** DB 상한(MB). 초과 시 오래된 행부터 삭제. 0 이하 = 크기 정리 안 함. 기본 500. */
   maxDbMb: number;
+  /** 🩸 LOGS-RETENTION-WINDOW-1(10-10): size-cap floor in hours — the size pass never deletes rows newer than
+   *  this; when rows outside the floor are not enough it stops and logs `retention-floor-held`.
+   *  0 = legacy behaviour (oldest-first with no floor). Missing = 24. Age pass (`maxAgeDays`) is unaffected. */
+  minRetainHours?: number;
 }
 
-export const LOG_RETENTION_DEFAULTS: LogStoreRetention = { maxAgeDays: 7, maxDbMb: 500 };
+export const LOG_RETENTION_DEFAULTS: LogStoreRetention = { maxAgeDays: 7, maxDbMb: 500, minRetainHours: 24 };
 
 /** 스토어 OOM 백스톱 — 정책 상한이 아니다. 정책은 각 경계(HTTP·툴)가 갖는다. */
 export const STORE_SAFETY_MAX = 100_000;
@@ -360,22 +365,65 @@ export class LogStore {
     }
     if (policy.maxDbMb > 0) {
       const pageCount = (this.db.query('PRAGMA page_count').get() as { page_count: number }).page_count;
+      const freePages = (this.db.query('PRAGMA freelist_count').get() as { freelist_count: number }).freelist_count;
       const pageSize = (this.db.query('PRAGMA page_size').get() as { page_size: number }).page_size;
-      const sizeMb = (pageCount * pageSize) / (1024 * 1024);
+      // 🩸 OBS-RET-RATCHET(2026-10-09): 빈 페이지까지 세면 VACUUM 없는 파일은 안 줄어든다 → 뜰 때마다 오래된 행 ≈5% 를
+      //   또 지우는 래칫이 됐다(운영 logs.db 528MB · 01:08Z 이전 행 소실). 상한은 «쓰는 페이지»로 잰다.
+      const sizeMb = ((pageCount - freePages) * pageSize) / (1024 * 1024);
       if (sizeMb > policy.maxDbMb) {
         // 초과분 비율만큼 오래된 행 삭제(대략 — 정밀 계산보다 반복 수렴 선호).
         const total = (this.db.query('SELECT COUNT(*) AS c FROM logs').get() as { c: number }).c;
         const dropCount = Math.max(1, Math.floor(total * Math.min(0.5, 1 - policy.maxDbMb / sizeMb)));
-        const r = this.db.run(
-          'DELETE FROM logs WHERE id IN (SELECT id FROM logs ORDER BY ts_ms ASC LIMIT ?)',
-          [dropCount],
-        );
-        deletedBySize = Number(r.changes ?? 0);
+        // 🩸 LOGS-RETENTION-WINDOW-1(10-10): prod write volume made this pass keep only ≈2h of rows, so evidence
+        //   for incidents a few hours old read as «0 rows». Rows inside the floor are never size-deleted.
+        const floorHours = policy.minRetainHours ?? LOG_RETENTION_DEFAULTS.minRetainHours ?? 0;
+        if (floorHours > 0) {
+          const floorCutoff = Date.now() - floorHours * 3_600_000;
+          // Byte-weighted split (payload text + fixed per-row overhead) — row counts alone misjudge mixed row sizes.
+          const split = this.db.query(
+            `SELECT COALESCE(SUM(CASE WHEN ts_ms < ? THEN w ELSE 0 END), 0) AS outsideBytes, COALESCE(SUM(w), 0) AS allBytes
+               FROM (SELECT ts_ms, 64 + LENGTH(ts) + LENGTH(category) + LENGTH(event) + COALESCE(LENGTH(data), 0) AS w FROM logs)`,
+          ).get(floorCutoff) as { outsideBytes: number; allBytes: number };
+          const r = this.db.run(
+            'DELETE FROM logs WHERE id IN (SELECT id FROM logs WHERE ts_ms < ? ORDER BY ts_ms ASC LIMIT ?)',
+            [floorCutoff, dropCount],
+          );
+          deletedBySize = Number(r.changes ?? 0);
+          // dropCount is capped at 50% per run; judge the floor against the full overshoot (by bytes) so a cap the
+          // floor can never reach is reported even when this run's capped batch was fully served from outside rows.
+          const neededShare = 1 - policy.maxDbMb / sizeMb;
+          const outsideShare = split.allBytes > 0 ? split.outsideBytes / split.allBytes : 0;
+          if (outsideShare < neededShare) {
+            debug.log('mss.logging', 'retention-floor-held', {
+              totalMb: Math.round(sizeMb * 10) / 10, maxTotalMb: policy.maxDbMb, floorHours,
+              neededShare: Math.round(neededShare * 1000) / 1000, outsideShare: Math.round(outsideShare * 1000) / 1000,
+              deletedRows: deletedBySize,
+            });
+          }
+        } else {
+          const r = this.db.run(
+            'DELETE FROM logs WHERE id IN (SELECT id FROM logs ORDER BY ts_ms ASC LIMIT ?)',
+            [dropCount],
+          );
+          deletedBySize = Number(r.changes ?? 0);
+        }
       }
     }
+    if (deletedByAge > 0 || deletedBySize > 0) {
+      const oldest = (this.db.query('SELECT MIN(ts_ms) AS t FROM logs').get() as { t: number | null }).t;
+      debug.log('log-store.retention', 'deleted', { deletedByAge, deletedBySize, oldestTs: oldest === null ? null : new Date(oldest).toISOString() });
+    }
     return { deletedByAge, deletedBySize };
   }
 
+  /** Reclaim a bounded number of free pages after retention; legacy databases with auto_vacuum=NONE remain unchanged. */
+  reclaimFreePages(): void {
+    const mode = (this.db.query('PRAGMA auto_vacuum').get() as { auto_vacuum: number }).auto_vacuum;
+    if (mode !== 2) return;
+    const free = (this.db.query('PRAGMA freelist_count').get() as { freelist_count: number }).freelist_count;
+    if (free > 0) this.db.run(`PRAGMA incremental_vacuum(${Math.min(free, 128)})`);
+  }
+
   /**
    * ⛔⭐⭐⭐ **이 스토어에 «실제로 뜬» 카테고리와 그 수**(2026-08-19 · `OBS-T122`).
    *
@@ -658,6 +706,12 @@ export class LogStore {
     return (this.db.query('SELECT COUNT(*) AS c FROM logs').get() as { c: number }).c;
   }
 
+  /** Earliest retained event timestamp, regardless of insertion order. No schema or row writes. */
+  horizon(): { status: 'present'; oldestTsMs: number } | { status: 'empty' } {
+    const { oldestTsMs } = this.db.query('SELECT MIN(ts_ms) AS oldestTsMs FROM logs').get() as { oldestTsMs: number | null };
+    return oldestTsMs === null ? { status: 'empty' } : { status: 'present', oldestTsMs };
+  }
+
   close(): void {
     try { this.db.close(); } catch { /* noop */ }
   }
@@ -850,28 +904,163 @@ export class StoreSink implements LogSink {
   }
 }
 
+const RETENTION_INTERVAL_MS = 6 * 3600 * 1000;
+type RetentionLockOwner = { token: string; pid: number; start: string | null };
+
+/** PID reuse must not let a new process inherit a dead process's ownership. */
+function processStart(pid: number): string | null {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+    return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null;
+  } catch { return null; }
+}
+
+function ownerDead(owner: RetentionLockOwner): boolean {
+  if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) return false;
+  try {
+    process.kill(owner.pid, 0);
+    const currentStart = processStart(owner.pid);
+    if (owner.start !== null && currentStart !== null && owner.start !== currentStart) return true;
+    // A zombie still answers kill(pid, 0), but can no longer run retention.
+    try {
+      const stat = readFileSync(`/proc/${owner.pid}/stat`, 'utf8');
+      return stat.slice(stat.lastIndexOf(')') + 2).startsWith('Z ');
+    } catch { return false; }
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'ESRCH';
+  }
+}
+
+/** Only the guard row can authorize removal. A pre-publication temp file belongs to its row's token. */
+function removeRetentionLockDirectory(lockPath: string, token: string, interrupted: boolean): void {
+  if (!existsSync(lockPath)) return;
+  const marker = join(lockPath, 'owner');
+  const temporaryName = `owner.${token}.tmp`;
+  if (readdirSync(lockPath).some((name) => name !== 'owner' && name !== temporaryName)) {
+    throw new Error('retention lock has unknown entries');
+  }
+  if (existsSync(marker)) {
+    const published = readFileSync(marker, 'utf8');
+    if (published !== token && !(interrupted && token.startsWith(published))) {
+      throw new Error('retention lock owner changed');
+    }
+    rmSync(marker);
+  }
+  rmSync(join(lockPath, temporaryName), { force: true });
+  rmdirSync(lockPath);
+}
+
+/** The SQLite guard serializes stale-lock recovery and ownership changes, including process death mid-acquisition. */
+function acquireRetentionLock(lockPath: string): (() => void) | null {
+  const guard = new Database(`${lockPath}.db`);
+  const token = randomUUID();
+  let handedOff = false;
+  try {
+    guard.run('PRAGMA busy_timeout = 100');
+    guard.run('CREATE TABLE IF NOT EXISTS owner (slot INTEGER PRIMARY KEY CHECK(slot = 1), token TEXT NOT NULL, pid INTEGER NOT NULL, start TEXT)');
+    let acquired = false;
+    guard.run('BEGIN IMMEDIATE');
+    try {
+      const previous = guard.query('SELECT token, pid, start FROM owner WHERE slot = 1').get() as RetentionLockOwner | null;
+      if (previous && !ownerDead(previous)) return null;
+      if (existsSync(lockPath)) {
+        // A pre-guard lock has no provable owner: never remove it.
+        if (!previous) return null;
+        try { removeRetentionLockDirectory(lockPath, previous.token, true); }
+        catch { return null; }
+      }
+      guard.run('INSERT OR REPLACE INTO owner (slot, token, pid, start) VALUES (1, ?, ?, ?)', [token, process.pid, processStart(process.pid)]);
+      guard.run('COMMIT');
+      acquired = true;
+    } finally {
+      if (!acquired) guard.run('ROLLBACK');
+    }
+    // The ownership row is committed before mkdir: a crash in this gap is recoverable too.
+    try {
+      mkdirSync(lockPath);
+      const temporary = join(lockPath, `owner.${token}.tmp`);
+      writeFileSync(temporary, token, { flag: 'wx' });
+      renameSync(temporary, join(lockPath, 'owner'));
+    } catch (error) {
+      guard.run('BEGIN IMMEDIATE');
+      try {
+        // Keep the ownership row if cleanup fails: the next process can then
+        // prove who left the directory behind and recover it after this PID dies.
+        removeRetentionLockDirectory(lockPath, token, true);
+        guard.run('DELETE FROM owner WHERE slot = 1 AND token = ?', [token]);
+        guard.run('COMMIT');
+      } catch { guard.run('ROLLBACK'); }
+      throw error;
+    }
+    handedOff = true;
+    return () => {
+      try {
+        guard.run('BEGIN IMMEDIATE');
+        try {
+          const current = guard.query('SELECT token FROM owner WHERE slot = 1').get() as { token: string } | null;
+          if (current?.token === token) {
+            removeRetentionLockDirectory(lockPath, token, false);
+            guard.run('DELETE FROM owner WHERE slot = 1 AND token = ?', [token]);
+          }
+          guard.run('COMMIT');
+        } catch (error) { guard.run('ROLLBACK'); throw error; }
+      } finally { guard.close(); }
+    };
+  } finally { if (!handedOff) guard.close(); }
+}
+
+/** A shared stamp prevents short-lived non-owner processes from repeatedly pruning the same DB. */
+function runStampedRetention(store: LogStore, retention: LogStoreRetention, owner: boolean): void {
+  const stampPath = `${store.path}.retention.stamp`;
+  const lockPath = `${store.path}.retention.lock`;
+  const isFresh = (): boolean => {
+    try {
+      const age = Date.now() - Number(readFileSync(stampPath, 'utf8'));
+      return age >= 0 && age < RETENTION_INTERVAL_MS;
+    } catch { return false; }
+  };
+  if (!owner && isFresh()) return;
+  const release = acquireRetentionLock(lockPath);
+  if (!release) return;
+  try {
+    if (!owner && isFresh()) return;
+    store.enforceRetention(retention);
+    try { store.reclaimFreePages(); }
+    catch (error) { debug.log('log-store.retention', 'reclaim-failed', { reason: error instanceof Error ? error.message : String(error) }); }
+    const temporary = `${stampPath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(temporary, String(Date.now()));
+      renameSync(temporary, stampPath);
+    } finally { rmSync(temporary, { force: true }); }
+  } finally { release(); }
+}
+
 /** 부팅 1줄 등록 헬퍼 — 데몬/TUI/러너가 자기 surface 를 선언하고 스토어
  *  싱크를 단다. retention 은 호출측이 config 에서 읽어 전달(user-config
- *  순환 의존 회피). 반환 = unregister(테스트용) 또는 null(store 불가). */
+ *  순환 의존 회피). 반환 = unregister(테스트용) 또는 null(store 불가).
+ *  nexus owns the periodic job unless the caller explicitly opts in. */
 export function registerLogStoreSink(
   registerSink: (sink: LogSink) => () => void,
   surface: string,
   retention: LogStoreRetention = LOG_RETENTION_DEFAULTS,
+  opts: { retentionOwner?: boolean } = {},
 ): (() => void) | null {
   const store = getDefaultLogStore();
   if (!store) return null;
   const sink = new StoreSink(store, surface, { installExitHandlers: true });
   const off = registerSink(sink);
   try { nestDepth.observeNestAtBoot(); } catch { /* fail-soft — 관측 실패가 싱크 등록을 막지 않는다. */ }
-  // 보존정책 — 부팅 직후 1회(디퍼) + 6시간 주기. 실패는 조용히.
+  const owner = opts.retentionOwner ?? surface === 'nexus';
   const runRetention = (): void => {
-    try { store.enforceRetention(retention); } catch { /* fail-soft */ }
+    try { runStampedRetention(store, retention, owner); }
+    catch (error) { debug.log('log-store.retention', 'failed', { reason: error instanceof Error ? error.message : String(error) }); }
   };
-  setImmediate(runRetention);
-  const h = setInterval(runRetention, 6 * 3600 * 1000);
-  (h as unknown as { unref?: () => void }).unref?.();
+  const startup = setImmediate(runRetention);
+  const h = owner ? setInterval(runRetention, RETENTION_INTERVAL_MS) : null;
+  (h as unknown as { unref?: () => void } | null)?.unref?.();
   return () => {
-    clearInterval(h);
+    clearImmediate(startup);
+    if (h) clearInterval(h);
     sink.close();
     off();
   };

package/src/mss/logging/redaction.ts

@@ -93,3 +93,20 @@ export function redactLogRecord(rec: LogRecord, opts: RedactOpts = {}): LogRecor
   const mask = opts.mask ?? defaultMask;
   return { ...rec, data: redactValue(rec.data, keyBlock, mask, new WeakSet()) };
 }
+
+/** Pre-bundle knowledge-pack DLP. Reasons are fixed labels, never source text or secret values.
+ * This is separate from the opt-in log masking path above. */
+const KNOWLEDGE_PACK_DLP_RULES: ReadonlyArray<{ reason: string; pattern: RegExp }> = [
+  { reason: 'secret-value', pattern: /-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY(?: BLOCK)?-----|\bBearer\s+[A-Za-z0-9._~+/-]{12,}={0,2}\b|\b(?:sk-[A-Za-z0-9_-]{16,}|xai-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,}|xox[baprs]-[A-Za-z0-9-]{12,}|(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}|AIza[A-Za-z0-9_-]{35})\b|\b(?:api[_-]?key|secret[_-]?key|access[_-]?token|private[_-]?key|token)['"]?\s*[=:]\s*['"]?[A-Za-z0-9_./+~-]{16,}/iu },
+  // A key that names a password/secret makes ANY assigned value secret: short or punctuated values count too.
+  // Schema flags (`"secret": true`) are not values.
+  { reason: 'secret-value', pattern: /\b(?:password|passwd|pwd|passphrase|client[_-]?secret|secret)['"]?\s*[=:]\s*(?!(?:true|false|null)\b)(?:"[^"\n]+"|'[^'\n]+'|[^\s'",;{}\[\]]{4,})/iu },
+  { reason: 'personal-information', pattern: /\b01[016789]-?\d{3,4}-?\d{4}\b|\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b|\b\d{6}-[1-8]\d{6}\b/iu },
+  { reason: 'internal-identifier', pattern: /(?:사번|사내\s*식별자|내부\s*식별자|employee[_ -]?id|internal[_ -]?id)\s*(?:[:=]|\s)\s*[A-Za-z0-9][A-Za-z0-9_-]{3,}/iu },
+  { reason: 'sales-confidential', pattern: /영업\s*기밀|(?:sales\s+confidential|confidential\s+sales|영업\s*비밀)/iu },
+];
+
+export function scanKnowledgePackDlp(text: string): string[] {
+  const reasons = KNOWLEDGE_PACK_DLP_RULES.filter(({ pattern }) => pattern.test(text)).map(({ reason }) => reason);
+  return [...new Set(reasons)];
+}

package/src/native-tool-catalog.ts

@@ -9,7 +9,7 @@ import type { VerifierSpec } from './verifier/types.js';
 import type { GuardianSpec } from './guardian/types.js';
 import { ptyAvailable } from './pty-shell/registry.js';
 import { krFlowAvailable } from './skills/tools/kr-flow.js';
-import { SELF_COGNITION_MCP_CATALOG_ENTRIES } from './tool-runtime/self-cognition-runtimes.js';
+import { SELF_COGNITION_MCP_CATALOG_ENTRIES } from './tool-runtime/self-cognition-catalog.js';
 import { SKILLS_LIST_DESCRIPTION } from './onboarding/entry-hints.js';
 
 export type { NativeToolHost } from './tool-surface.js';

package/src/nexus/api/consult-requests.ts

@@ -2,7 +2,7 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, re
 import { randomUUID } from 'node:crypto';
 import { dirname, join } from 'node:path';
 import { debug } from '../../debug/log.js';
-import { routeOutbound } from '../outbound/router.js';
+import { sendTelegramReport } from '../../telegram-report.js';
 import { getUserConfig } from '../../user-config.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { jsonResponse } from './json-response.js';
@@ -23,7 +23,7 @@ interface ConsultRequest {
 export interface ConsultRequestsDeps {
   root?: () => string;
   now?: () => string;
-  /** Owner alert. Default = the daemon's own in-process router (the same one `/v1/outbound` uses).
+  /** Owner alert. Default = the daemon's in-process Telegram sender (operations role only).
    *  ⛔ Never `sendOutbound` here: it is a synchronous curl to this very daemon's `/v1/outbound`, so inside the
    *  daemon it blocks the event loop until it times out (~25 s · `unreachable`) and the alert is lost (CS1 · 10-01). */
   send?: (text: string, kind: string) => unknown;
@@ -88,9 +88,9 @@ export async function handleConsultRequests(req: Request, deps: ConsultRequestsD
   if (!body || typeof body !== 'object' || Array.isArray(body)) return rejected('body');
   const input = body as Record<string, unknown>;
   for (const field of ['name', 'contact'] as const) {
-    if (typeof input[field] !== 'string' || !input[field].trim()) return rejected(field);
+    if (typeof input[field] !== 'string' || !input[field].trim() || input[field].length > (field === 'name' ? 256 : 512)) return rejected(field);
   }
-  if (input.org !== undefined && (typeof input.org !== 'string' || !input.org.trim())) return rejected('org');
+  if (input.org !== undefined && (typeof input.org !== 'string' || !input.org.trim() || input.org.length > 256)) return rejected('org');
   if (input.kind !== 'company' && input.kind !== 'personal') return rejected('kind');
   if (input.interest !== 'A' && input.interest !== 'B') return rejected('interest');
   if (input.consent !== true) return rejected('consent');
@@ -114,15 +114,12 @@ export async function handleConsultRequests(req: Request, deps: ConsultRequestsD
   const alert = `📮 상담 문의 ${entry.receiptId} · ${entry.name}(${entry.kind === 'personal' ? '개인' : (entry.org ?? '회사')}) · 관심 ${entry.interest}\n앱에서 보기`;
   // Fire and forget — the receipt is already on disk; the answer must not wait for the channel.
   void Promise.resolve()
-    .then(() => (deps.send ?? notifyInProcess)(alert, 'alert'))
+    .then(() => (deps.send ?? notifyInProcess)(alert, 'ops-alert'))
     .catch((error: unknown) => { debug.log('consult.request', 'notify-failed', { receiptId: entry.receiptId, reason: error instanceof Error ? error.message : String(error) }); });
   return jsonResponse({ receiptId: entry.receiptId, receivedAt: entry.receivedAt }, 202);
 }
 
 async function notifyInProcess(text: string, kind: string): Promise<void> {
-  const result = await routeOutbound(getUserConfig(), { text, markdown: false, kind });
-  debug.log('consult.request', result.delivered ? 'notified' : 'notify-failed', {
-    delivered: result.delivered,
-    channels: result.channels.map((channel) => `${channel.type}:${channel.ok ? 'ok' : 'fail'}`),
-  });
+  const delivered = await sendTelegramReport(getUserConfig(), text, { markdown: false, kind });
+  debug.log('consult.request', delivered ? 'notified' : 'notify-failed', { delivered, channels: [`telegram:${delivered ? 'ok' : 'fail'}`] });
 }

package/src/nexus/api/discord-trigger-bot.ts

@@ -36,6 +36,7 @@ import { parseDiscordEndpoint, isOwnInstanceEndpoint } from '../../session/sessi
 import { createDiscordStreamSink } from '../../session/streaming/discord-stream-sink.js';
 import { splitForDiscord } from '../../discord.js';
 import { formatForDiscord } from '../../discord-markdown.js';
+import { receiveChannelEvent } from '../outbound/router.js';
 
 export interface NexusDiscordTriggerBotOpts {
   /** Bot token (without `Bot ` prefix). Production reads
@@ -109,11 +110,13 @@ export function createDiscordTriggerLogger(
  *  (`src/discord.ts:160-172` comment) so the wire is a near-identity
  *  with `raw` carrying the full gateway payload for debugging. */
 export function toDiscordEvent(tap: DcTriggerEvent): DiscordEvent {
+  const envelope = receiveChannelEvent('discord', tap);
+  if (!envelope || envelope instanceof Promise) throw new Error('discord connector cannot normalize accepted tap');
   return {
     kind: tap.kind,
-    channel: tap.channel,
-    user: tap.user,
-    body: tap.body,
+    channel: envelope.channel ?? tap.channel,
+    user: envelope.senderId ?? tap.user,
+    body: envelope.text,
     raw: tap,
   };
 }

package/src/nexus/api/draft-metrics.ts

@@ -1,6 +1,8 @@
 import { join } from 'node:path';
 import { debug } from '../../debug/log.js';
-import type { DraftMetrics } from '../../self-dev/draft-sweep.js';
+import type { DraftMetrics, OverlapMetrics } from '../../self-dev/draft-sweep.js';
+
+export type CeoDraftMetrics = DraftMetrics & { readonly overlap: OverlapMetrics | null };
 
 /**
  * DRAFT-METRIC — CEO view source. Opening the page must never trigger a GitHub read:
@@ -14,7 +16,7 @@ export type DraftMetricsState = 'measuring' | 'ready' | 'unavailable';
 export interface DraftMetricsSnapshot {
   /** measuring = no value yet and a collection is running · unavailable = no value and the last collection failed. */
   readonly state: DraftMetricsState;
-  readonly metrics: DraftMetrics | null;
+  readonly metrics: CeoDraftMetrics | null;
   /** When the served value was collected (ISO). null without a value. */
   readonly measuredAt: string | null;
   /** A background collection is in flight. */
@@ -24,7 +26,7 @@ export interface DraftMetricsSnapshot {
 }
 
 export interface DraftMetricsSourceOptions {
-  readonly collect?: () => Promise<DraftMetrics>;
+  readonly collect?: () => Promise<CeoDraftMetrics>;
   readonly ttlMs?: number;
   readonly failureRetryMs?: number;
   readonly now?: () => number;
@@ -43,17 +45,29 @@ function isMetrics(value: unknown): value is DraftMetrics {
     && nullableNumber('oldestAgeHours') && nullableNumber('conversion48h');
 }
 
-/** Parses the CLI's single JSON line; anything else is a failed collection, never a zero. */
-export function parseDraftMetricsOutput(stdout: string): DraftMetrics {
+function isOverlapMetrics(value: unknown): value is OverlapMetrics {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const row = value as Record<string, unknown>;
+  const count = (key: string) => row[key] === null || (Number.isInteger(row[key]) && (row[key] as number) >= 0);
+  const nullableNumber = (key: string) => row[key] === null || (typeof row[key] === 'number' && Number.isFinite(row[key]) && (row[key] as number) >= 0);
+  return ['launches24h', 'launched', 'unmeasured', 'linked', 'autoLanded', 'salvaged', 'salvageUnmeasured'].every(count)
+    && typeof row.sourceIncomplete === 'boolean' && nullableNumber('secondSiblingMedianHours')
+    && (row.autoRate === null || (typeof row.autoRate === 'number' && Number.isFinite(row.autoRate) && row.autoRate >= 0 && row.autoRate <= 1));
+}
+
+/** Parses the CLI's single JSON line; malformed draft values fail, malformed overlap is unmeasured. */
+export function parseDraftMetricsOutput(stdout: string): CeoDraftMetrics {
   const line = stdout.trim().split('\n').reverse().find((text) => text.trim().startsWith('{'));
   if (!line) throw new Error('draft metrics: no JSON output');
   const parsed: unknown = JSON.parse(line);
   if (!isMetrics(parsed)) throw new Error('draft metrics: malformed output');
   const { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h } = parsed;
-  return { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h };
+  const candidate = (parsed as DraftMetrics & { overlap?: unknown }).overlap;
+  return { inventory, oldestAgeHours, needsOwner, converted48h, cohort48h, conversion48h,
+    overlap: isOverlapMetrics(candidate) ? candidate : null };
 }
 
-async function collectViaCli(): Promise<DraftMetrics> {
+async function collectViaCli(): Promise<CeoDraftMetrics> {
   const root = join(import.meta.dir, '../../..');
   const proc = Bun.spawn(['bun', join(root, 'bin/elanous.mjs'), 'harness', 'drafts', 'metrics', '--json'], {
     cwd: root, stdout: 'pipe', stderr: 'pipe',
@@ -75,7 +89,7 @@ export function createDraftMetricsSource(options: DraftMetricsSourceOptions = {}
   const ttl = options.ttlMs ?? DRAFT_METRICS_TTL_MS;
   const retry = options.failureRetryMs ?? DRAFT_METRICS_FAILURE_RETRY_MS;
   const now = options.now ?? Date.now;
-  let value: { metrics: DraftMetrics; at: number } | null = null;
+  let value: { metrics: CeoDraftMetrics; at: number } | null = null;
   let failure: { reason: string; at: number } | null = null;
   let inFlight: Promise<void> | null = null;