elanous 0.2.22 → 0.2.23

package/src/self-implement/run-ledger.ts

@@ -2,14 +2,14 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statS
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { refuseProductionLedgerWriteInTest } from '../harness/ledger-write-guard.js';
 import { tracedPathReferences, verbatimOriginalAsk } from './goal-author.js';
-import { parseAskTargetPathHintsResult } from '../self-dev/launch-preflight.js';
+import { parseAskTargetPathHintsResult } from '../self-dev/launch-preflight-text.js';
 import { isRunStatus } from './run-status-mapping.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { normalizeRunId } from '../harness/harness-space.js';
 import { resolveLogTargets, type LogTarget } from '../cli/logs-cli.js';
 import { LogStore, logsDbPath, type LogStoreRow } from '../mss/logging/log-store.js';
 import { loadSelfDevRun, selfDevRunsDir } from '../self-dev/run-store.js';
-import { extractHarnessReviewAcceptance } from '../harness/harness-seams.js';
+import { extractHarnessReviewAcceptance } from './goal-digest.js';
 import { resolveGoalDocumentsDir } from './goal-documents-dir.js';
 import { debug } from '../debug/log.js';
 import { withRunLedgerLock, restoreArchivedRunLedger } from './run-ledger-compact.js';
@@ -1561,7 +1561,8 @@ interface UnfinishedLedgerFacts {
   fixedLifecycle: UnfinishedRunLifecycle;
 }
 
-const UNFINISHED_LEDGER_CACHE_LIMIT = 5_000;
+// A full federated scan can exceed 5,000 files; keep the previous scan resident for mtime-checked reuse.
+const UNFINISHED_LEDGER_CACHE_LIMIT = 32_768;
 const unfinishedLedgerCache = new Map<string, { size: number; mtimeMs: number; facts: UnfinishedLedgerFacts }>();
 const unfinishedReaderIds = new WeakMap<RunLedgerReader, number>();
 let nextUnfinishedReaderId = 1;

package/src/self-implement/run-step-projection.ts

@@ -0,0 +1,147 @@
+import type { RunLedgerEntry } from './run-ledger.js';
+
+export type RunStep =
+  | { seq: number; ts: string; type: 'node-enter'; node: string; visit: number }
+  | { seq: number; ts: string; type: 'node-exit'; node: string; outcome: string }
+  | { seq: number; ts: string; type: 'edge-taken'; from: string; to: string; via: string; condition?: string }
+  | { seq: number; ts: string; type: 'node-skipped'; node: string; reason: string; condition?: string }
+  | { seq: number; ts: string; type: 'node-added'; node: string; kind: string; decider: string; reason: string; trigger?: unknown; undo?: unknown }
+  | { seq: number; ts: string; type: 'edge-rerouted'; from: string; outcome: string; to: string; was: string; decider: string; reason: string }
+  | { seq: number; ts: string; type: 'unit-expanded'; node: string; unit: string; childRunId: string; resolution: number; decider: string; reason: string }
+  | { seq: number; ts: string; type: 'unit-collapsed'; node: string; resolution: number; decider: string; reason: string };
+
+export interface RunStepProjection {
+  runId: string;
+  graph: { graphId: string | null; version: string | null; variantHash: string | null };
+  steps: readonly RunStep[];
+  complete: boolean;
+  /** Number of recognized steps whose source record could not be projected. */
+  unreadable: number;
+  /** Source sequence and reason for every rejected or duplicate step. */
+  violations: readonly { seq: number | null; reason: string }[];
+}
+
+const STEP_EVENTS = new Set([
+  'node-enter', 'node-exit', 'edge-taken', 'node-skipped',
+  'node-added', 'edge-rerouted', 'unit-expanded', 'unit-collapsed',
+  'pipeline-node-entry', 'pipeline-node-exit', 'graph-edge-taken',
+]);
+const STRUCTURAL_EVENTS = new Set(['node-added', 'edge-rerouted', 'unit-expanded', 'unit-collapsed']);
+
+function text(data: Record<string, unknown>, key: string): string | null {
+  const value = data[key];
+  return typeof value === 'string' && value.trim().length > 0 ? value : null;
+}
+
+function validSeq(value: unknown): value is number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+}
+
+function stepType(entry: RunLedgerEntry): string | null {
+  if (STEP_EVENTS.has(entry.event)) {
+    if (entry.event === 'pipeline-node-entry') return 'node-enter';
+    if (entry.event === 'pipeline-node-exit') return 'node-exit';
+    if (entry.event === 'graph-edge-taken') return 'edge-taken';
+    return entry.event;
+  }
+  if (entry.event === 'applied' && entry.data.op === 'add-node') return 'node-added';
+  if (entry.event === 'applied' && entry.data.op === 'reroute') return 'edge-rerouted';
+  if (entry.event === 'applied' && entry.data.op === 'zoom-in') return 'unit-expanded';
+  if (entry.event === 'applied' && entry.data.op === 'collapse') return 'unit-collapsed';
+  return null;
+}
+
+function projectStep(entry: RunLedgerEntry, type: string, seq: number): RunStep | string {
+  const data = entry.data;
+  const ts = entry.timestamp;
+  if (typeof ts !== 'string' || !Number.isFinite(Date.parse(ts))) return 'timestamp missing or invalid';
+  const node = text(data, 'node');
+  const condition = text(data, 'condition');
+  if (STRUCTURAL_EVENTS.has(type) && (!text(data, 'decider') || !text(data, 'reason'))) {
+    return 'structural change requires decider and reason';
+  }
+  switch (type) {
+    case 'node-enter': {
+      const visit = data.visit;
+      return node && validSeq(visit) ? { seq, ts, type, node, visit } : 'node-enter requires node and positive visit';
+    }
+    case 'node-exit': {
+      const outcome = text(data, 'outcome');
+      return node && outcome ? { seq, ts, type, node, outcome } : 'node-exit requires node and outcome';
+    }
+    case 'edge-taken': {
+      const from = text(data, 'from');
+      const to = text(data, 'taken') ?? text(data, 'to');
+      const via = text(data, 'via') ?? (entry.event === 'graph-edge-taken' ? data.source === 'graph' ? 'outcome' : 'fallback' : null);
+      return from && to && via ? { seq, ts, type, from, to, via, ...(condition ? { condition } : {}) } : 'edge-taken requires from, to and via';
+    }
+    case 'node-skipped': {
+      const reason = text(data, 'reason');
+      return node && reason ? { seq, ts, type, node, reason, ...(condition ? { condition } : {}) } : 'node-skipped requires node and reason';
+    }
+    case 'node-added': {
+      const kind = text(data, 'kind');
+      return node && kind ? { seq, ts, type, node, kind, decider: text(data, 'decider')!, reason: text(data, 'reason')!, ...(data.trigger === undefined ? {} : { trigger: data.trigger }), ...(data.undo === undefined ? {} : { undo: data.undo }) } : 'node-added requires node and kind';
+    }
+    case 'edge-rerouted': {
+      const from = text(data, 'from');
+      const outcome = text(data, 'outcome');
+      const to = text(data, 'to');
+      const was = text(data, 'was');
+      return from && outcome && to && was ? { seq, ts, type, from, outcome, to, was, decider: text(data, 'decider')!, reason: text(data, 'reason')! } : 'edge-rerouted requires from, outcome, to and was';
+    }
+    case 'unit-expanded': {
+      const unit = text(data, 'unit') ?? text(data, 'into');
+      const childRunId = text(data, 'childRunId');
+      const resolution = data.resolution;
+      return node && unit && childRunId && typeof resolution === 'number' && Number.isSafeInteger(resolution) && resolution >= 0
+        ? { seq, ts, type, node, unit, childRunId, resolution, decider: text(data, 'decider')!, reason: text(data, 'reason')! }
+        : 'unit-expanded requires node, unit, childRunId and resolution';
+    }
+    case 'unit-collapsed': {
+      const resolution = data.resolution;
+      return node && typeof resolution === 'number' && Number.isSafeInteger(resolution) && resolution >= 0
+        ? { seq, ts, type, node, resolution, decider: text(data, 'decider')!, reason: text(data, 'reason')! }
+        : 'unit-collapsed requires node and resolution';
+    }
+    default: return 'unrecognized step';
+  }
+}
+
+/** Pure projection of already-read JSONL records; never guesses a sequence from timestamps or line positions. */
+export function projectRunLedgerSteps(runId: string, entries: readonly RunLedgerEntry[]): RunStepProjection {
+  const steps: RunStep[] = [];
+  const violations: { seq: number | null; reason: string }[] = [];
+  const seen = new Set<number>();
+  let graphId: string | null = null;
+  let version: string | null = null;
+  let variantHash: string | null = null;
+  for (const entry of entries) {
+    if (entry.runId !== runId) continue;
+    graphId = text(entry.data, 'graphId') ?? graphId;
+    version = text(entry.data, 'graphVersion') ?? version;
+    variantHash = text(entry.data, 'variantHash') ?? variantHash;
+    const type = stepType(entry);
+    if (!type) continue;
+    const topLevelSeq = (entry as RunLedgerEntry & { seq?: unknown }).seq;
+    const seq = topLevelSeq ?? entry.data.seq;
+    if (topLevelSeq !== undefined && entry.data.seq !== undefined && topLevelSeq !== entry.data.seq) {
+      violations.push({ seq: validSeq(topLevelSeq) ? topLevelSeq : null, reason: 'conflicting step seq' });
+      continue;
+    }
+    if (!validSeq(seq)) {
+      violations.push({ seq: null, reason: 'step requires positive safe-integer seq' });
+      continue;
+    }
+    if (seen.has(seq)) {
+      violations.push({ seq, reason: 'duplicate step seq' });
+      continue;
+    }
+    seen.add(seq);
+    const step = projectStep(entry, type, seq);
+    if (typeof step === 'string') violations.push({ seq, reason: step });
+    else steps.push(step);
+  }
+  steps.sort((a, b) => a.seq - b.seq);
+  return { runId, graph: { graphId, version, variantHash }, steps, complete: violations.length === 0, unreadable: violations.length, violations };
+}

package/src/self-implement/run-stop.ts

@@ -63,7 +63,7 @@ export function classifyMergeHoldStop(mergeReason: string | undefined): RunStopC
   const reason = mergeReason ?? '';
   if (reason.startsWith('main-sync') || reason === 'default-branch-unresolved') return 'main-sync';
   if (reason === 'required-evidence-uncovered') return 'evidence-uncovered';
-  if (reason === 'review-must-fix' || reason.startsWith('review-budget')) return 'review-repeat';
+  if (reason === 'review-must-fix' || reason === 'review-warn-with-must-fix' || reason.startsWith('review-budget')) return 'review-repeat';
   if (reason.startsWith('review-diff') || reason === 'no-real-review') return 'review-out-of-scope';
   return 'unclassified';
 }

package/src/self-implement/seams.ts

@@ -23,11 +23,12 @@ import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
 import { forkSessionById, HARNESS_SESSION_ORIGIN, isHarnessSessionOrigin } from '../session/index.js';
-import { configuredWorktreeRoot, getUserConfig, resolveRoleLlm } from '../user-config.js';
+import { configuredWorktreeRoot, getUserConfig, resolveActiveProvider, resolveRoleLlm } from '../user-config.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { addHarnessQueue } from '../harness/harness-queue.js';
 import { readFollowUpMode } from './follow-up-goals.js';
-import { getProviderForConfig } from '../llm.js';
+import { getProviderForConfig, NoLlmProviderAvailableError } from '../llm.js';
+import { lookupLlmTierSpec } from '../model-tier/llm-tier-map.js';
 import { createWorktree, DEFAULT_BRANCH_WORKTREE_BASE, linkWorktreeDependencies, removeWorktree, resolveDefaultBranchBase, resolveMainRepoRoot } from '../git-fs/worktree.js';
 import { isWorktreeInUse, listActiveTerminalDirectories } from '../harness/harness-clean.js';
 import { readWorktreePorcelain } from './abandoned-classification.js';
@@ -198,7 +199,39 @@ export const SELF_IMPLEMENT_COMPLETION_REPORT_HINT = '자식이 최종 요약
 
 /** self-implement 실행 경계가 범용 brain에 전용 종료-보고 규칙을 주입한다. */
 export function createSelfImplementControlBrain(opts: Omit<LlmControlBrainOpts, 'systemHint'>) {
-  return createLlmControlBrain({ ...opts, systemHint: SELF_IMPLEMENT_COMPLETION_REPORT_HINT });
+  // ⭐ 이 부모에 쓸 provider 가 «하나도» 없으면(NoLlmProviderAvailableError) BRAIN-FAST 이전처럼 «지연 해석»
+  //   brain 을 돌려준다 — 생성 시점에 throw 하면 implement seam 전체가 자식을 띄우기도 전에 죽는다
+  //   (0.2.23 게이트 회귀 · 자식 LLM 은 따로 정해질 수 있다). provider 결정은 decide 시점 streamLLM 이 다시 한다.
+  //   ⛔ 다른 오류(예: provider 충돌)는 그대로 던진다.
+  const deferred = (error: unknown): ReturnType<typeof createLlmControlBrain> => {
+    if (!(error instanceof NoLlmProviderAvailableError)) throw error;
+    debug.log('self-implement', 'brain.model', { provider: null, model: opts.model ?? null, source: 'unresolved-deferred' }, { level: 'warn' });
+    return createLlmControlBrain({ ...opts, systemHint: SELF_IMPLEMENT_COMPLETION_REPORT_HINT });
+  };
+  let role: ReturnType<typeof resolveRoleLlm>;
+  try {
+    role = resolveRoleLlm('classify');
+  } catch (error) {
+    return deferred(error);
+  }
+  const explicit = role.source === 'flag' || role.source === 'config-role';
+  if (!opts.model && opts.provider && explicit && opts.provider !== role.provider) {
+    throw new Error(`brain provider conflict: caller=${opts.provider}, classify=${role.provider}`);
+  }
+  let provider: ReturnType<typeof resolveActiveProvider>;
+  try {
+    provider = opts.model ? (opts.provider ?? resolveActiveProvider(getUserConfig()))
+      : explicit ? role.provider : (opts.provider ?? resolveActiveProvider(getUserConfig()));
+  } catch (error) {
+    return deferred(error);
+  }
+  const budget = !opts.model && !explicit ? lookupLlmTierSpec(provider, 'budget') : undefined;
+  const model = opts.model ?? (explicit ? role.model : budget!.model);
+  const source = opts.model ? 'caller' : explicit ? role.source : 'tier-budget';
+  debug.log('self-implement', 'brain.model', { provider, model, source });
+  return createLlmControlBrain({ ...opts, model, provider,
+    ...(budget?.reasoningLevel ? { reasoningLevel: budget.reasoningLevel } : {}),
+    systemHint: SELF_IMPLEMENT_COMPLETION_REPORT_HINT });
 }
 
 function git(cwd: string, argv: string[]): { ok: boolean; out: string; stdout: string } {

package/src/self-implement/self-implement-cli.ts

@@ -124,7 +124,9 @@ export function singleRunAsJobResult(feature: string, r: SelfImplementResultWith
     ...(r.salvage !== undefined ? { salvage: r.salvage } : {}),
     ...(r.review?.reviewed === true && r.review.verdict === 'pass'
       && r.reviewedHeadCommit && /^[0-9a-f]{40}$/i.test(r.reviewedHeadCommit)
-      ? { selfReview: { verdict: r.review.verdict, head: r.reviewedHeadCommit } } : {}),
+      ? { selfReview: { verdict: r.review.verdict, head: r.reviewedHeadCommit,
+        // TA-LAND-MUSTFIX-ZERO — must-fix 수를 같이 나른다(목록이 없으면 «모름» = 안 싣는다 · land 관문이 막는다).
+        ...(Array.isArray(r.review.mustFix) && r.review.mustFix.every((fix) => typeof fix === 'string') ? { mustFixCount: r.review.mustFix.length } : {}) } } : {}),
     ...(r.review?.reviewed !== undefined ? { reviewed: r.review.reviewed } : {}),
     ...(r.review?.failureReason !== undefined ? { reviewReason: r.review.failureReason } : {}),
     // ⭐ 대표 지시(2026-09-08) — 걸음을 슈퍼바이저까지 나른다.

package/src/self-implement/train-gate-remote.ts

@@ -0,0 +1,158 @@
+/** LAND-QUEUE-P3 — the merge train's integration gate (changed-file tsc · changed tests · PWA reach/build) for ONE
+ *  integration commit, run only on the gate host (node-b) through the GATE-REMOTE path (`runOnRemote`).
+ *  Unlike `dispatchHeavyCheck` it never falls back to a local run: a busy host or an infra failure is «unmeasured».
+ *  The only local commands are git (cat-file · rev-parse · push · diff). */
+import { debug } from '../debug/log.js';
+import { getDefaultLogStore } from '../mss/logging/log-store.js';
+import {
+  realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote,
+  type GateRemoteRunner, type GateRemoteSettings, type RemoteRunOutcome,
+} from './gate-remote.js';
+
+export type TrainGateOutcome = 'pass' | 'fail' | 'unmeasured';
+
+export interface TrainGateInput {
+  repo: string;
+  /** The integration commit (40-char sha, present locally — need not be checked out). */
+  commit: string;
+  /** The base the changed-file checks measure against (TSC_BASE_REF). */
+  baseSha: string;
+  /** Repo-relative changed paths of the integration commit vs baseSha. */
+  changedFiles: readonly string[];
+  /** Paths deleted by the integration commit — kept in `changedFiles` for tsc/PWA reach, never run as tests. */
+  deletedFiles?: readonly string[];
+  settings?: GateRemoteSettings;
+}
+
+export interface TrainGateResult { outcome: TrainGateOutcome; host: string; ms?: number; rc?: number; reason?: string }
+
+export interface TrainGateObservation {
+  host: string; commit: string; baseSha: string; outcome: TrainGateOutcome;
+  rc?: number; ms?: number; reason?: string; changedFiles: number;
+}
+
+export interface TrainGateDeps {
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+  /** Observation sink (default: category `merge-queue` in the log store, so a standalone CLI records it too). */
+  observe?: (entry: TrainGateObservation) => void;
+}
+
+const quote = (value: string) => `'${value.replaceAll("'", `'\\''`)}'`;
+const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
+
+/** The host-side shell body: each step runs only if the one before it passed. Exported for tests. */
+export function trainGateScript(baseSha: string, changedFiles: readonly string[], deleted: ReadonlySet<string> = new Set()): string {
+  // A deleted test file is a changed path (tsc/PWA reach) but not something to run.
+  const tests = changedFiles.filter((file) => TEST_FILE.test(file) && !deleted.has(file));
+  const steps = [
+    `TSC_BASE_REF=${quote(baseSha)} bun scripts/ci-typecheck-changed.ts --local`,
+    ...(tests.length ? [`bun run test:deterministic ${tests.map(quote).join(' ')}`] : []),
+    `bun scripts/ci-pwa-build-gate.ts --changed-files ${changedFiles.map(quote).join(' ')}`,
+  ];
+  return steps.join(' && ');
+}
+
+async function loadSettings(): Promise<GateRemoteSettings> {
+  try {
+    const { getUserConfig } = await import('../user-config.js');
+    return resolveGateRemoteSettings(getUserConfig().gateRemote);
+  } catch { return resolveGateRemoteSettings(undefined); }
+}
+
+function defaultObserve(entry: TrainGateObservation): void {
+  const store = getDefaultLogStore();
+  if (!store) return;
+  store.insertBatch([{ rec: { ts: new Date().toISOString(), category: 'merge-queue', event: 'train-gate', data: entry }, surface: 'merge-queue' }]);
+}
+
+/** The integration gate runs only on the gate host (LAND-QUEUE-P3 · review must-fix): another configured host is «unmeasured». */
+export const TRAIN_GATE_HOST = 'node-b';
+
+export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): Promise<TrainGateResult> {
+  const settings = input.settings ?? await loadSettings();
+  const host = settings.host;
+  if (host !== TRAIN_GATE_HOST) {
+    const entry: TrainGateObservation = { host, commit: input.commit, baseSha: input.baseSha, outcome: 'unmeasured', reason: `host-not-gate-host (${host} ≠ ${TRAIN_GATE_HOST})`, changedFiles: input.changedFiles.length };
+    debug.log('merge-queue', 'train-gate', entry);
+    try { (deps.observe ?? defaultObserve)(entry); } catch { /* observation only */ }
+    return { outcome: 'unmeasured', host, reason: entry.reason };
+  }
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = now() + settings.slotWaitSeconds * 1000;
+  const script = trainGateScript(input.baseSha, input.changedFiles, new Set(input.deletedFiles ?? []));
+  let outcome: RemoteRunOutcome;
+  for (;;) {
+    try {
+      outcome = runOnRemote({
+        repo: input.repo, host, mirror: settings.mirror, commit: input.commit, refs: [input.baseSha],
+        argv: ['sh', '-c', script], installPwa: true, hostCap: settings.hostCap,
+      }, runner);
+    } catch (error) {
+      outcome = { kind: 'infra', reason: `exception: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    if (outcome.kind !== 'busy') break;
+    const left = deadline - now();
+    if (left <= 0) break;
+    await sleep(Math.min(15_000, left));
+    if (now() >= deadline) break;
+  }
+  const result: TrainGateResult = outcome.kind === 'ran'
+    ? { outcome: outcome.rc === 0 ? 'pass' : 'fail', host, ms: outcome.ms, rc: outcome.rc }
+    : { outcome: 'unmeasured', host, reason: outcome.kind === 'busy' ? `host-busy (cap ${settings.hostCap} held for ${settings.slotWaitSeconds}s)` : outcome.reason };
+  const entry: TrainGateObservation = {
+    host, commit: input.commit, baseSha: input.baseSha, outcome: result.outcome,
+    rc: result.rc, ms: result.ms, reason: result.reason, changedFiles: input.changedFiles.length,
+  };
+  debug.log('merge-queue', 'train-gate', entry);
+  try { (deps.observe ?? defaultObserve)(entry); } catch (error) {
+    debug.log('merge-queue', 'train-gate-observe-failed', { error: error instanceof Error ? error.message : String(error) });
+  }
+  return result;
+}
+
+/** The merge train's `gate` seam: `(commitSha, prNumbers) → 'pass' | 'fail' | 'unmeasured'`. Changed files are the
+ *  integration commit's diff against `baseSha` (local git only); a diff failure is «unmeasured», never a local run. */
+export type TrainGate = (commitSha: string, prNumbers: readonly number[]) => Promise<TrainGateOutcome>;
+
+export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?: GateRemoteSettings }, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): TrainGate {
+  const unmeasured = (commitSha: string, reason: string): 'unmeasured' => {
+    const entry: TrainGateObservation = { host: opts.settings?.host ?? TRAIN_GATE_HOST, commit: commitSha, baseSha: opts.baseSha, outcome: 'unmeasured', reason, changedFiles: 0 };
+    debug.log('merge-queue', 'train-gate', entry);
+    try { (deps.observe ?? defaultObserve)(entry); } catch { /* observation only */ }
+    return 'unmeasured';
+  };
+  return async (commitSha) => {
+    try {
+      const diff = runner.local('git', ['diff', '--name-status', '-z', opts.baseSha, commitSha], opts.repo);
+      if (diff.rc !== 0 || diff.error) return unmeasured(commitSha, 'changed-files-unavailable');
+      const { changedFiles, deletedFiles } = parseNameStatus(diff.stdout);
+      return (await runTrainGateOnHost({ repo: opts.repo, commit: commitSha, baseSha: opts.baseSha, changedFiles, deletedFiles, settings: opts.settings }, runner, deps)).outcome;
+    } catch (error) {
+      // Any preparation failure (local git spawn, parse, settings) is «unmeasured» — never a rejected promise, never a local run.
+      return unmeasured(commitSha, `prepare-failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 200));
+    }
+  };
+}
+
+/** `git diff --name-status -z` → changed paths (renames contribute both sides) ⊕ deleted paths. Exported for tests. */
+export function parseNameStatus(out: string): { changedFiles: string[]; deletedFiles: string[] } {
+  const parts = out.split('\0').filter((part) => part !== '');
+  const changed: string[] = [];
+  const deleted: string[] = [];
+  for (let i = 0; i < parts.length;) {
+    const status = parts[i++]!;
+    if (/^[RC]/.test(status)) {
+      const from = parts[i++]; const to = parts[i++];
+      if (from) { changed.push(from); if (status.startsWith('R')) deleted.push(from); }
+      if (to) changed.push(to);
+    } else {
+      const path = parts[i++];
+      if (!path) break;
+      changed.push(path);
+      if (status === 'D') deleted.push(path);
+    }
+  }
+  return { changedFiles: [...new Set(changed)], deletedFiles: [...new Set(deleted)] };
+}

package/src/session-runtime/index.ts

@@ -365,6 +365,15 @@ const SESSION_TOOL_FAMILY_RULES: SessionToolFamilyRule[] = [
       '왜 실패', '기억', '회상', '알림', '이상 없', '뭐 돌', '뭐 하는 중',
     ]),
   },
+  {
+    id: 'release-read',
+    description: 'Read-only release status, features, cells, schedules, and current operations.',
+    names: ['release_status', 'context_now'],
+    match: (text) => hasAny(text, [
+      'release', 'version', 'checklist', '발행', '버전', '릴리스', '피처',
+      '체크리스트', '칸', '컷', '일정', '판올림', '다음 판', '이번 판', '운영 상태',
+    ]),
+  },
   {
     id: 'runtime-debug',
     description: 'Runtime inspection, traces, and input/debug history.',
@@ -1721,7 +1730,7 @@ const ESSENTIAL_NATIVE_RULE_IDS = [
   // Keep dev-harness in the assembly candidate set so the catalog policy below is the single model-exposure authority.
   'agent', 'agent-output', 'agent-reply', 'agent-stop', 'agent-list', 'self-implement', 'self-orchestrate', 'dev-harness',
 ] as const;
-const ESSENTIAL_HOST_FAMILY_IDS = ['self-ops'] as const;
+const ESSENTIAL_HOST_FAMILY_IDS = ['self-ops', 'release-read'] as const;
 const ESSENTIAL_RUNTIME_FAMILY_IDS = ['bash', 'run-shell', 'pty-shell', 'run-tests', 'elanous_skills_list', 'skill_exec', 'code-grounding'] as const;
 const ESSENTIAL_OPTIONAL_TOOL_NAMES = [
   'GetDashboardState',

package/src/session-runtime/retry-api.ts

@@ -80,6 +80,9 @@ export interface FetchApiWithRetryOpts {
   /** Fallbacks still unused. When > 0, k consecutive overload-class
    *  failures throw OverloadFailoverError before another retry sleep. */
   remainingFallbacks?: number;
+  /** BEDROCK-PROVIDER — 재시도 «직전»마다 요청을 다시 만든다(SigV4 서명은 `x-amz-date` 기준 수 분만 유효 —
+   *  `retry-after` 대기가 길면 옛 서명은 403). 없으면 종전처럼 같은 `init` 을 다시 쓴다(다른 provider 불변). */
+  refreshInit?: () => Promise<RequestInit>;
 }
 
 /** Raised when overload repeats k times and a fallback is still unused.
@@ -128,6 +131,8 @@ export async function fetchApiWithRetry(
   let lastErr: unknown;
   while (attempt < maxAttempts) {
     let response: Response | null = null;
+    // ⛔ try «밖» — 재서명 실패(자격 부재 등)는 재시도할 네트워크 오류가 아니다. 그대로 던진다.
+    if (attempt > 0 && opts.refreshInit) init = await opts.refreshInit();
     try {
       response = await fetch(url, init);
       if (response.ok) {
@@ -179,7 +184,12 @@ export async function fetchApiWithRetry(
       const fp = fingerprintError(err, `api:${opts.provider}`);
       const doomStatus = tracker.record(fp);
       const retryAfter = err instanceof ApiHttpError ? err.retryAfter : undefined;
-      const decision = decideRetry(err, {
+      // OpenRouter may report an upstream transient as a non-5xx HTTP status.
+      // Keep the original status/error for callers, but classify this specific body as retryable.
+      const policyError = opts.provider === 'openrouter' && err instanceof ApiHttpError
+        && /Provider returned error/i.test(err.bodyText)
+        ? Object.assign(new Error(err.message), { code: '503' }) : err;
+      const decision = decideRetry(policyError, {
         attempt,
         doomStatus,
         retryAfter,

package/src/skills/gift-install.ts

@@ -3,7 +3,13 @@ import { execFileSync } from 'node:child_process';
 import { cpSync, existsSync, lstatSync, mkdtempSync, mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { gunzipSync } from 'node:zlib';
 import { debug } from '../debug/log.js';
+import { ensureInternalMarketIndex, ensureMarketIndex, type MarketFetchOptions } from '../plugins/install/market-fetch.js';
+import { scanPackInternalRefs } from '../market/pack-internal-refs.js';
+import { createPack } from '../knowledge/kgs/pack.js';
+import { KgsSqliteStore } from '../knowledge/kgs/sqlite-store.js';
+import type { KnowledgeCard, KnowledgeKind } from '../knowledge/kgs/types.js';
 
 export interface GiftInstallOptions {
   pack: string;
@@ -23,6 +29,119 @@ export type GiftInstallResult =
   | { ok: true; names: string[]; paths: string[]; collisions: string[]; needsKeys: boolean; message: string }
   | { ok: false; reason: string; message: string };
 
+export type KnowledgePackInstallResult =
+  | { ok: true; packId: string; citations: string[] }
+  | { ok: false; reason: string };
+
+/** Install a named knowledge pack from a configured, signed market; no gift code or skill target is involved. */
+export async function installMarketKnowledgePack(input: {
+  pack: string;
+  market: string;
+  enterpriseId?: string;
+  marketOptions?: MarketFetchOptions;
+  fetch?: typeof fetch;
+  store?: Pick<KgsSqliteStore, 'writePack'>;
+}): Promise<KnowledgePackInstallResult> {
+  try {
+    const verified = input.enterpriseId
+      ? await ensureInternalMarketIndex(input.market, input.enterpriseId, input.marketOptions)
+      : await ensureMarketIndex(input.market, input.marketOptions);
+    const entry = verified.index.knowledgePacks?.find(item => item.name === input.pack);
+    if (!entry || (input.enterpriseId ? entry.visibility !== 'internal' || entry.enterpriseId !== input.enterpriseId : entry.visibility !== 'public')) {
+      return { ok: false, reason: 'pack-not-in-verified-market' };
+    }
+    const key = entry.artifact.key;
+    if (!key || key.startsWith('/') || key.includes('\\') || key.split('/').some(part => !part || part === '.' || part === '..')) {
+      return { ok: false, reason: 'invalid-artifact-key' };
+    }
+    const base = new URL(verified.market.url);
+    const artifactUrl = new URL(key, base);
+    if (key.includes('%') || key.includes('?') || key.includes('#') || base.protocol !== 'https:') return { ok: false, reason: 'invalid-artifact-key' };
+    if (artifactUrl.origin !== base.origin || !artifactUrl.pathname.startsWith(base.pathname) || artifactUrl.search || artifactUrl.hash) {
+      return { ok: false, reason: 'invalid-artifact-key' };
+    }
+    if (entry.artifact.bytes > MAX_DOWNLOAD_BYTES) return { ok: false, reason: 'artifact-mismatch' };
+    const response = await (input.fetch ?? fetch)(artifactUrl.href, { redirect: 'error' });
+    if (!response.ok || response.redirected || (response.url && response.url !== artifactUrl.href)) return { ok: false, reason: 'artifact-download-failed' };
+    const reader = response.body?.getReader();
+    if (!reader) return { ok: false, reason: 'artifact-download-failed' };
+    const chunks: Uint8Array[] = [];
+    let length = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > MAX_DOWNLOAD_BYTES || length > entry.artifact.bytes) { await reader.cancel(); return { ok: false, reason: 'artifact-mismatch' }; }
+      chunks.push(value);
+    }
+    const bytes = Buffer.concat(chunks);
+    if (bytes.length !== entry.artifact.bytes ||
+      createHash('sha256').update(bytes).digest('hex').toLowerCase() !== entry.artifact.sha256.toLowerCase()) {
+      return { ok: false, reason: 'artifact-mismatch' };
+    }
+    const archive = gunzipSync(bytes, { maxOutputLength: MAX_UNPACKED_BYTES });
+    const files = new Map<string, string>();
+    const decoder = new TextDecoder('utf-8', { fatal: true });
+    let endOffset = 0;
+    for (let offset = 0; offset + 512 <= archive.length;) {
+      const header = archive.subarray(offset, offset + 512);
+      if (header.every(byte => byte === 0)) { endOffset = offset; break; }
+      const field = (start: number, end: number) => header.subarray(start, end).toString('utf8').replace(/\0.*$/, '');
+      const checksum = parseInt(field(148, 156).trim(), 8);
+      const actualChecksum = header.reduce((sum, byte, index) => sum + (index >= 148 && index < 156 ? 32 : byte), 0);
+      if (checksum !== actualChecksum) return { ok: false, reason: 'invalid-archive' };
+      const size = parseInt(field(124, 136).trim(), 8);
+      const name = field(0, 100);
+      const prefix = field(345, 500);
+      const path = prefix ? `${prefix}/${name}` : name;
+      if (!Number.isSafeInteger(size) || size < 0 || !path || path.includes('\\') ||
+        path.split('/').some(part => !part || part === '.' || part === '..') || header[156] !== 48 ||
+        offset + 512 + size > archive.length || files.has(path)) return { ok: false, reason: 'invalid-archive' };
+      files.set(path, decoder.decode(archive.subarray(offset + 512, offset + 512 + size)));
+      offset += 512 + Math.ceil(size / 512) * 512;
+      if (files.size > MAX_ENTRIES) return { ok: false, reason: 'invalid-archive' };
+    }
+    if (!endOffset || archive.length - endOffset < 1024 || !archive.subarray(endOffset).every(byte => byte === 0)) return { ok: false, reason: 'invalid-archive' };
+    const manifest = JSON.parse(files.get('knowledge-pack.json') ?? 'null') as Record<string, unknown> | null;
+    if (files.size !== (Array.isArray(manifest?.content) ? manifest.content.length + 1 : -1)) return { ok: false, reason: 'invalid-content' };
+    if (!manifest || manifest.kind !== 'knowledge-pack' || manifest.name !== entry.name || manifest.version !== entry.version ||
+      !/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(entry.name) || !/^\d+\.\d+\.\d+$/.test(entry.version) ||
+      typeof manifest.description !== 'string' || !manifest.description || manifest.description.length > 200 ||
+      !Array.isArray(manifest.content) || !manifest.content.length ||
+      !Array.isArray(manifest.dependencies) || manifest.dependencies.length !== 0 ||
+      manifest.visibility !== entry.visibility || typeof manifest.license !== 'string' || !manifest.license ||
+      !manifest.signature || typeof manifest.signature !== 'object' ||
+      (manifest.signature as Record<string, unknown>).algorithm !== 'ed25519' ||
+      (manifest.signature as Record<string, unknown>).keyId !== verified.keyId) return { ok: false, reason: 'invalid-manifest' };
+    const now = new Date().toISOString();
+    const cards: KnowledgeCard[] = [];
+    for (const item of manifest.content) {
+      if (!item || typeof item !== 'object') return { ok: false, reason: 'invalid-content' };
+      const { path, kind } = item as Record<string, unknown>;
+      if (typeof path !== 'string' || !/^content\/[a-z0-9-]+(?:\/[a-z0-9-]+)*\.md$/.test(path) || typeof kind !== 'string' ||
+        !['document', 'glossary', 'procedure', 'rule', 'qa'].includes(kind) || !files.has(path)) return { ok: false, reason: 'invalid-content' };
+      const body = files.get(path)!;
+      cards.push({ schema_version: 2, id: path, createdAt: now, updatedAt: now, author: entry.name,
+        title: body.match(/^# (.+)$/m)?.[1] ?? path, body, nature: 'fact',
+        kind: ({ procedure: 'playbook', glossary: 'wiki', qa: 'card', rule: 'checklist', document: 'note' } as Record<string, KnowledgeKind>)[kind]!,
+        reliability: 'self-reported', source: { kind: 'external', url: artifactUrl.href }, tags: [entry.name] });
+    }
+    if (cards.length > 200 || new Set(cards.map(card => card.id)).size !== cards.length ||
+      scanPackInternalRefs([...files].map(([path, text]) => ({ path, text }))).length) return { ok: false, reason: 'invalid-content' };
+    const pack = createPack({ id: { slug: entry.name, version: entry.version }, title: manifest.description as string,
+      intent: manifest.description as string, audience: input.enterpriseId ? 'team' : 'public', kind: 'generic',
+      author: entry.name, cards });
+    if (input.store) input.store.writePack(pack);
+    else {
+      const store = new KgsSqliteStore();
+      try { store.writePack(pack); } finally { store.close(); }
+    }
+    return { ok: true, packId: `pack:${entry.name}@${entry.version}`, citations: cards.map(card => `pack:${entry.name}@${entry.version}#${card.id}`) };
+  } catch {
+    return { ok: false, reason: 'knowledge-pack-install-failed' };
+  }
+}
+
 // GK1 public bundle: packs/elanous-essentials/plugin.json extensions.ai.elanous.bundle.
 const ESSENTIAL_SKILLS = ['youtube-master', 'omni-crawl', 'omni-digest', 'diagram-master', 'lecture-note-digitizer'];
 // A malicious or broken gift must not exhaust the temp disk: cap the download, the unpacked total and the entry count.