elanous 0.2.22 → 0.2.23

package/src/skills/runner.ts

@@ -3,6 +3,9 @@
 // substitute template variables, and run them through the selected LLM provider.
 
 import { debug } from '../debug/log.js';
+import type { SkillTier } from './skill-tier.js';
+import { randomUUID } from 'node:crypto';
+import { recordSkillRunSafe, type SkillRun } from './skill-feedback.js';
 import { readFileSync, readdirSync, existsSync, statSync } from 'fs';
 import { join } from 'path';
 import { LOCAL_SKILLS_DIR } from '../config.js';
@@ -307,7 +310,7 @@ export interface SkillManifest {
 }
 
 /** Ordered weak→strong. Session 21. */
-export type SkillTier = 'T3' | 'T2' | 'T1';
+export type { SkillTier } from './skill-tier.js';
 const TIER_RANK: Record<SkillTier, number> = { T3: 1, T2: 2, T1: 3 };
 
 /** True when `active` is at least as strong as `min`. Missing `min`
@@ -690,6 +693,9 @@ export interface ExecuteSkillOpts {
    *  pure-builder input so tests and future callers can reason about
    *  the final message shape without opening the SQLite store. */
   promptBankContext?: string;
+  /** Use this provider instead of resolving one from config/model hint
+   *  (tests and hosts that already hold a provider). */
+  provider?: LLMProvider;
 }
 
 export interface ExecuteSkillResult {
@@ -968,6 +974,57 @@ export async function executeSkill(
   args: string,
   onChunk: (delta: string, full: string) => void,
   opts: ExecuteSkillOpts = {},
+): Promise<ExecuteSkillResult> {
+  // SK1: one feedback ledger line per run. Recording is fail-soft — the
+  // result returned and the exception thrown are exactly the run's own.
+  let started: number | undefined;
+  try { started = Date.now(); } catch { /* clock trouble must not block the skill */ }
+  const feedback = (outcome: SkillRun['outcome'], failureKind?: string): SkillRun => ({
+    skill: manifest.name,
+    runId: randomUUID(),
+    outcome,
+    ...(failureKind ? { failureKind } : {}),
+    userCorrected: false,
+    retries: 0,
+    durationMs: started === undefined ? 0 : Math.max(0, Date.now() - started),
+    at: new Date().toISOString(),
+  });
+  const record = (outcome: SkillRun['outcome'], failureKind?: string): void => {
+    try {
+      recordSkillRunSafe(feedback(outcome, failureKind));
+    } catch (error) {
+      // Building the record itself failed — still fail-soft, still observed.
+      try {
+        debug.log('skill.feedback', 'record-failed', { skill: manifest.name, error: String(error) }, { level: 'warn' });
+      } catch { /* never let observation change the skill outcome */ }
+    }
+  };
+  let result: ExecuteSkillResult;
+  try {
+    result = await executeSkillUnrecorded(manifest, args, onChunk, opts);
+  } catch (error) {
+    record('failure', skillFailureKind(error));
+    throw error;
+  }
+  record('success');
+  return result;
+}
+
+/** Failure kind for the feedback ledger: the exception's name, else 'error'. */
+function skillFailureKind(error: unknown): string {
+  try {
+    const name = (error as { name?: unknown } | null)?.name;
+    return typeof name === 'string' && name !== '' ? name : 'error';
+  } catch {
+    return 'error';
+  }
+}
+
+async function executeSkillUnrecorded(
+  manifest: SkillManifest,
+  args: string,
+  onChunk: (delta: string, full: string) => void,
+  opts: ExecuteSkillOpts,
 ): Promise<ExecuteSkillResult> {
   debug.log('skill.router', 'executeSkill', {
     skill: manifest.name,
@@ -982,7 +1039,7 @@ export async function executeSkill(
   // vars. Previously getProvider(modelHint) — env-only — meant a user
   // with config.provider=openai-codex but XAI_API_KEY still in env
   // would see every skill fall back to Grok.
-  const provider: LLMProvider = resolveDefaultProvider(rawModelHint);
+  const provider: LLMProvider = opts.provider ?? resolveDefaultProvider(rawModelHint);
   // If the skill's declared model belongs to a DIFFERENT provider
   // family than the one user-config resolved to, drop it. Example:
   // user has openai-codex configured but a skill's SKILL.md says

package/src/skills/skill-feedback.ts

@@ -1,5 +1,7 @@
-import { appendFileSync, readFileSync } from 'node:fs';
+import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { debug } from '../debug/log.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
 
 export interface SkillRun {
   skill: string;
@@ -25,6 +27,34 @@ export function appendSkillRun(ledgerPath: string, run: SkillRun): void {
   appendFileSync(ledgerPath, `${JSON.stringify(run)}\n`, 'utf8');
 }
 
+/**
+ * Ledger for skill runs: `<root>/skills/feedback.jsonl`, root defaulting to the
+ * effective instance (state) root — never a skill folder. Creates the directory.
+ */
+export function skillFeedbackLedgerPath(root: string = effectiveInstanceRoot()): string {
+  const dir = join(root, 'skills');
+  mkdirSync(dir, { recursive: true });
+  return join(dir, 'feedback.jsonl');
+}
+
+/**
+ * Fail-soft record of one skill run: resolving or writing the ledger never
+ * throws to the caller; a failure leaves a single `record-failed` observation.
+ */
+export function recordSkillRunSafe(run: SkillRun, ledgerPath?: string): void {
+  try {
+    appendSkillRun(ledgerPath ?? skillFeedbackLedgerPath(), run);
+  } catch (error) {
+    try {
+      debug.log('skill.feedback', 'record-failed', { skill: run.skill, error: String(error) }, { level: 'warn' });
+    } catch { /* observation must not break the skill result either */ }
+    return;
+  }
+  try {
+    debug.log('skill.feedback', 'recorded', { skill: run.skill, outcome: run.outcome, durationMs: run.durationMs });
+  } catch { /* fail-soft */ }
+}
+
 /** Read the JSONL ledger in append order; an absent ledger has no runs. */
 export function readSkillRuns(ledgerPath: string): SkillRun[] {
   let text: string;

package/src/skills/skill-tier.ts

@@ -0,0 +1 @@
+export type SkillTier = 'T3' | 'T2' | 'T1';

package/src/smart-wizard/capability-index.ts

@@ -0,0 +1,231 @@
+import { Database } from 'bun:sqlite';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { buildCapabilityMatrix } from '../agent-mission/capability-matrix.js';
+import { createCapabilityReaders } from '../agent-mission/capability-readers.js';
+import type { CapabilityEntry } from '../agent-mission/capability-types.js';
+import { readCodexPluginsFromAppServer, type CodexPluginObservation } from '../acp/codex-plugins.js';
+import { kgsDefaultDbPath } from '../knowledge/kgs/sqlite-store.js';
+import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
+import { verifyIndex, type MarketplaceIndex } from '../market/signed-index.js';
+import { readClaudePackageLedger, type ClaudePackageLedger } from '../plugins/adapters/claude-package.js';
+import { ELANOUS_MARKET_URL } from '../plugins/install/market-fetch.js';
+import { buildSkillIndex, skillIndexProblems, type SkillIndexEntry } from '../skills/index.js';
+import { defaultSkillDirs } from '../user-config.js';
+
+export type CapabilitySource = 'skills' | 'plugins' | 'knowledge' | 'codex' | 'claude' | 'market';
+export type CapabilityAuth = 'subscription' | 'free' | 'api-key' | 'paid' | 'unknown';
+export interface IndexedCapability {
+  readonly id: string;
+  readonly kind: 'skill' | 'plugin' | 'knowledge' | 'connector';
+  readonly source: CapabilitySource;
+  readonly provenance: string;
+  readonly auth: CapabilityAuth;
+  readonly state: 'installed' | 'candidate' | 'ready' | 'unavailable' | 'unknown';
+  readonly capabilities: readonly string[];
+}
+export interface CapabilityIndex {
+  readonly sources: Record<CapabilitySource, 'ok' | 'unknown'>;
+  readonly entries: readonly IndexedCapability[];
+}
+
+export interface CapabilityIndexReaders {
+  skills?: () => readonly SkillIndexEntry[];
+  skillProblems?: () => readonly { name: string; dir: string }[];
+  plugins?: () => readonly { name: string; market: string }[];
+  knowledge?: () => readonly { name: string; provenance: string }[];
+  codex?: () => Promise<CodexPluginObservation>;
+  claude?: () => ClaudePackageLedger;
+  /** Production verifies fetched bytes; tests may inject a checked fixture. */
+  market?: () => Promise<MarketplaceIndex>;
+  matrix?: () => readonly CapabilityEntry[];
+  /** Default-path observations (used only when `skills` / `plugins` are not injected). */
+  localSkills?: () => LocalSkillsObservation;
+  localPlugins?: () => LocalPluginsObservation;
+  /** Already verified by the caller (never accepts unverified JSON). */
+  verifiedMarket?: MarketplaceIndex;
+}
+
+export interface LocalSkillsObservation {
+  readonly entries: readonly SkillIndexEntry[];
+  /** Roots that exist (or could not be proven absent) but could not be read. */
+  readonly unreadableRoots: readonly string[];
+}
+
+/** Per-root read: an unreadable root is reported, readable roots keep their candidates. */
+export function readLocalSkills(dirs: readonly string[] = defaultSkillDirs()): LocalSkillsObservation {
+  // A missing root is optional; any other stat/read failure must remain unknown.
+  const readable: string[] = [];
+  const unreadableRoots: string[] = [];
+  for (const dir of dirs) {
+    try {
+      if (!statSync(dir).isDirectory()) throw new Error('skill root is not a directory');
+      readdirSync(dir);
+      readable.push(dir);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      unreadableRoots.push(dir);
+    }
+  }
+  return { entries: readable.length ? buildSkillIndex(readable) : [], unreadableRoots };
+}
+
+/** Strict form: throws when any root is unreadable. */
+export function listLocalSkills(dirs: readonly string[] = defaultSkillDirs()): readonly SkillIndexEntry[] {
+  const observed = readLocalSkills(dirs);
+  if (observed.unreadableRoots.length) throw new Error(`unreadable skill roots: ${observed.unreadableRoots.join(', ')}`);
+  return observed.entries;
+}
+
+export interface LocalPluginsObservation {
+  readonly plugins: readonly { name: string; market: string }[];
+  /** `absent` = ENOENT (no installs recorded); `unreadable` = exists but stat/read/parse failed. */
+  readonly ledger: 'ok' | 'absent' | 'unreadable';
+  /** Plugin directories that exist (or could not be proven absent) but could not be listed. */
+  readonly unreadableDirs: readonly string[];
+}
+
+/** ENOENT → absent; every other failure is a read failure, never "no candidates". */
+function statKind(path: string, want: 'any' | 'file' = 'any'): 'present' | 'absent' | 'unreadable' {
+  try { const stat = statSync(path); return want === 'file' && !stat.isFile() ? 'absent' : 'present'; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === 'ENOENT' ? 'absent' : 'unreadable'; }
+}
+
+export function readLocalPlugins(
+  ledgerPath: string = join(elanousStateRoot(), 'plugins', 'installed.json'),
+  localDirs: readonly string[] = [resolve(import.meta.dir, '../../plugins')],
+): LocalPluginsObservation {
+  const plugins: { name: string; market: string }[] = [];
+  let ledger: LocalPluginsObservation['ledger'] = 'absent';
+  const ledgerKind = statKind(ledgerPath);
+  if (ledgerKind === 'unreadable') ledger = 'unreadable';
+  else if (ledgerKind === 'present') {
+    try {
+      const rows: unknown = JSON.parse(readFileSync(ledgerPath, 'utf8'));
+      if (!Array.isArray(rows) || !rows.every(row => row && typeof row.name === 'string' && typeof row.market === 'string')) throw new Error('invalid installed plugin ledger');
+      plugins.push(...rows.map(row => ({ name: row.name as string, market: row.market as string })));
+      ledger = 'ok';
+    } catch { ledger = 'unreadable'; }
+  }
+  const unreadableDirs: string[] = [];
+  for (const dir of localDirs) {
+    const kind = statKind(dir);
+    if (kind === 'absent') continue;
+    const found: { name: string; market: string }[] = [];
+    try {
+      if (kind === 'unreadable') throw new Error('plugin directory unreadable');
+      for (const item of readdirSync(dir, { withFileTypes: true })) {
+        if (!item.isDirectory()) continue;
+        const path = join(dir, item.name);
+        const manifests = [statKind(join(path, 'plugin.ts'), 'file'), statKind(join(path, 'plugin.json'), 'file')];
+        if (manifests.includes('present')) found.push({ name: item.name, market: dir });
+        else if (manifests.includes('unreadable')) unreadableDirs.push(path);
+      }
+      plugins.push(...found);
+    } catch { unreadableDirs.push(dir); }
+  }
+  return { plugins, ledger, unreadableDirs };
+}
+
+function listLocalKnowledge(): readonly { name: string; provenance: string }[] {
+  const path = kgsDefaultDbPath();
+  if (!existsSync(path)) throw new Error('knowledge store unavailable');
+  const db = new Database(path, { readonly: true, create: false });
+  try {
+    return (db.query('SELECT slug, version FROM kgs_pack ORDER BY slug, version').all() as Array<{ slug: string; version: string }>)
+      .map(row => ({ name: `${row.slug}@${row.version}`, provenance: path }));
+  } finally { db.close(); }
+}
+
+async function readOfficialMarket(): Promise<MarketplaceIndex> {
+  const url = new URL('marketplace.json', ELANOUS_MARKET_URL);
+  const [raw, sig] = await Promise.all([fetch(url), fetch(new URL('index.sig', url))]);
+  if (!raw.ok || !sig.ok) throw new Error('official index unavailable');
+  const checked = verifyIndex({ marketplaceBytes: new Uint8Array(await raw.arrayBuffer()), signatureText: await sig.text(), trustedKeys: OFFICIAL_INDEX_KEYS });
+  if (!checked.ok || checked.index.name !== 'elanous') throw new Error('official index unverified');
+  return checked.index;
+}
+
+function marketAuth(entry: MarketplaceIndex['plugins'][number]): CapabilityAuth {
+  const policy = entry.policy?.authentication?.toLowerCase();
+  if (policy === 'api-key' || policy === 'api_key') return 'api-key';
+  if (policy === 'subscription') return 'subscription';
+  if (policy === 'paid') return 'paid';
+  if (policy === 'none' || policy === 'free') return 'free';
+  return 'unknown';
+}
+
+/** Read-only, per-source index. No source failure is interpreted as an empty inventory. */
+export async function buildCapabilityIndex(readers: CapabilityIndexReaders = {}): Promise<CapabilityIndex> {
+  const sources: CapabilityIndex['sources'] = { skills: 'ok', plugins: 'ok', knowledge: 'ok', codex: 'ok', claude: 'ok', market: 'ok' };
+  const entries: IndexedCapability[] = [];
+  const attempt = async (source: CapabilitySource, read: () => Promise<void> | void): Promise<void> => {
+    const start = entries.length;
+    try { await read(); } catch { sources[source] = 'unknown'; entries.splice(start); }
+  };
+  await attempt('skills', () => {
+    const observed: LocalSkillsObservation = readers.skills
+      ? { entries: readers.skills(), unreadableRoots: [] }
+      : (readers.localSkills ?? readLocalSkills)();
+    for (const skill of observed.entries) entries.push({ id: skill.name, kind: 'skill', source: 'skills', provenance: skill.rootDir, auth: 'unknown', state: 'installed', capabilities: [skill.name] });
+    if (observed.unreadableRoots.length) {
+      sources.skills = 'unknown';
+      for (const dir of observed.unreadableRoots) entries.push({ id: dir, kind: 'skill', source: 'skills', provenance: dir, auth: 'unknown', state: 'unknown', capabilities: [] });
+    }
+    const problems = (readers.skillProblems ?? skillIndexProblems)();
+    if (problems.length) {
+      sources.skills = 'unknown';
+      for (const problem of problems) entries.push({ id: problem.name, kind: 'skill', source: 'skills', provenance: problem.dir, auth: 'unknown', state: 'unknown', capabilities: [problem.name] });
+    }
+  });
+  let installed: readonly { name: string; market: string }[] | undefined;
+  await attempt('plugins', () => {
+    if (readers.plugins) installed = readers.plugins();
+    else {
+      const observed = (readers.localPlugins ?? readLocalPlugins)();
+      installed = observed.plugins;
+      // Absent ledger keeps the earlier contract (unknown); unreadable ledger/dirs never read as "no installs".
+      if (observed.ledger !== 'ok' || observed.unreadableDirs.length) sources.plugins = 'unknown';
+      for (const dir of observed.unreadableDirs) entries.push({ id: dir, kind: 'plugin', source: 'plugins', provenance: dir, auth: 'unknown', state: 'unknown', capabilities: [] });
+    }
+    for (const plugin of installed) entries.push({ id: plugin.name, kind: 'plugin', source: 'plugins', provenance: plugin.market, auth: 'unknown', state: 'installed', capabilities: [plugin.name] });
+  });
+  await attempt('knowledge', () => {
+    for (const pack of (readers.knowledge ?? listLocalKnowledge)()) entries.push({ id: pack.name, kind: 'knowledge', source: 'knowledge', provenance: pack.provenance, auth: 'unknown', state: 'installed', capabilities: [pack.name] });
+  });
+  await attempt('codex', async () => {
+    const observation = await (readers.codex ?? readCodexPluginsFromAppServer)();
+    if (observation.status === 'unknown') { sources.codex = 'unknown'; return; }
+    for (const plugin of observation.plugins) entries.push({ id: plugin.name, kind: 'plugin', source: 'codex', provenance: plugin.marketplace, auth: 'unknown', state: plugin.enabled ? 'installed' : 'unavailable', capabilities: [plugin.name] });
+  });
+  await attempt('claude', () => {
+    const ledger = (readers.claude ?? readClaudePackageLedger)();
+    if (ledger.status !== 'ok') sources.claude = 'unknown';
+    for (const pkg of ledger.packages) entries.push({ id: pkg.plugin, kind: 'plugin', source: 'claude', provenance: `${pkg.marketplace}:${pkg.source}`, auth: 'unknown', state: 'installed', capabilities: [pkg.plugin] });
+  });
+  await attempt('market', async () => {
+    const index = readers.verifiedMarket ?? await (readers.market ?? readOfficialMarket)();
+    if (index.name !== 'elanous') throw new Error('not official market');
+    for (const plugin of index.plugins) {
+      entries.push({ id: plugin.name, kind: 'plugin', source: 'market', provenance: `${index.name}:${plugin.source.source}`, auth: marketAuth(plugin),
+        state: sources.plugins === 'unknown' ? 'unknown' : installed?.some(row => row.name === plugin.name && row.market === index.name) ? 'installed' : 'candidate',
+        capabilities: [plugin.name, ...plugin['ai.elanous'].capabilities, ...(plugin['ai.elanous'].vocab ?? [])] });
+      for (const connector of plugin['ai.elanous'].connectors) entries.push({ id: connector.id, kind: 'connector', source: 'market', provenance: `${index.name}:${plugin.name}`, auth: marketAuth(plugin), state: sources.plugins === 'unknown' ? 'unknown' : 'candidate', capabilities: [connector.id] });
+    }
+    for (const pack of index.knowledgePacks ?? []) {
+      if (pack.visibility !== 'public') continue;
+      entries.push({ id: pack.name, kind: 'knowledge', source: 'market', provenance: index.name, auth: 'unknown', state: 'candidate', capabilities: [pack.name] });
+    }
+  });
+  // Matrix is an additional service observation, not proof of plugin installation.
+  let matrix: readonly CapabilityEntry[] = [];
+  try { matrix = (readers.matrix ?? (() => buildCapabilityMatrix(createCapabilityReaders())))(); }
+  catch { /* Matrix is supplementary; plugin inventories keep their own observation status. */ }
+  for (const service of matrix) {
+    // Only backends that are index sources are attributed; grok has no source row here, so it is not relabelled.
+    if (!service.service || service.service === '*' || (service.backend !== 'codex' && service.backend !== 'claude')) continue;
+    entries.push({ id: service.service, kind: 'connector', source: service.backend, provenance: `${service.backend}:mcp`, auth: 'unknown', state: service.state, capabilities: [service.service] });
+  }
+  return { sources, entries };
+}

package/src/smart-wizard/rung.ts

@@ -0,0 +1,74 @@
+// The condition extraction (including any LLM judgment) happens before this deterministic selector.
+export type WizardRung = 'a' | 'b' | 'c' | 'd' | 'e';
+export type GraphValueSignal = 'verification' | 'rework' | 'approval' | 'branching' | 'resume' | 'parallel' | 'resolution';
+
+export type RungConditions = {
+  capabilityGaps: number;
+  graphSignals: readonly GraphValueSignal[];
+  recurring: boolean;
+  needsMemory: boolean;
+  unattended: boolean;
+  roles: number;
+  differentCadences: boolean;
+  differentPermissions: boolean;
+  handoffs: number;
+};
+
+export type RungDecision = {
+  rung: WizardRung;
+  reasons: string[];
+  rejectedHigher: string[];
+};
+
+const graphSignalNames: readonly GraphValueSignal[] = [
+  'verification', 'rework', 'approval', 'branching', 'resume', 'parallel', 'resolution',
+];
+const rungOrder: readonly WizardRung[] = ['a', 'b', 'c', 'd', 'e'];
+
+/** Select the lowest rung sufficient for the supplied, already-established conditions. */
+export function classifyRung(conditions: RungConditions): RungDecision {
+  const { capabilityGaps, graphSignals, recurring, needsMemory, unattended, roles,
+    differentCadences, differentPermissions, handoffs } = conditions;
+  for (const [name, value] of Object.entries({ capabilityGaps, roles, handoffs })) {
+    if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer`);
+  }
+  if (graphSignals.some(signal => !graphSignalNames.includes(signal))) {
+    throw new TypeError('graphSignals contains an unknown signal');
+  }
+
+  const distinctSignals = graphSignalNames.filter(signal => graphSignals.includes(signal));
+  const graphWorthwhile = distinctSignals.length >= 2;
+  const loopNeeded = recurring && (needsMemory || unattended);
+  const collectiveNeeded = roles >= 2 && (differentCadences || differentPermissions) && handoffs >= 1;
+  let rung: WizardRung = 'a';
+  const reasons: string[] = [];
+  if (capabilityGaps > 0) {
+    rung = 'b';
+    reasons.push(`b: capability gaps ${capabilityGaps} > 0`);
+  }
+  if (graphWorthwhile) {
+    rung = 'c';
+    reasons.push(`c: ${distinctSignals.length} graph value signals >= 2 (${distinctSignals.join(', ')})`);
+  }
+  if (loopNeeded) {
+    rung = 'd';
+    reasons.push(`d: recurring and ${[needsMemory && 'needs memory', unattended && 'unattended'].filter(Boolean).join(' / ')}`);
+  }
+  if (collectiveNeeded) {
+    rung = 'e';
+    reasons.push(`e: ${roles} roles >= 2, ${[differentCadences && 'different cadences', differentPermissions && 'different permissions'].filter(Boolean).join(' / ')}, handoffs ${handoffs} >= 1`);
+  }
+  if (reasons.length === 0) reasons.push('a: no higher-rung condition met; one skill call or short chain suffices');
+
+  const rejected = {
+    b: `b: capability gaps ${capabilityGaps} = 0`,
+    c: `c: ${distinctSignals.length} distinct graph value signals < 2`,
+    d: `d: ${!recurring ? 'not recurring' : 'neither memory nor unattended execution'}`,
+    e: `e: ${[
+      roles < 2 && `roles ${roles} < 2`,
+      !differentCadences && !differentPermissions && 'neither different cadences nor different permissions',
+      handoffs < 1 && `handoffs ${handoffs} < 1`,
+    ].filter(Boolean).join('; ')}`,
+  };
+  return { rung, reasons, rejectedHigher: rungOrder.slice(rungOrder.indexOf(rung) + 1).map(higher => rejected[higher as keyof typeof rejected]) };
+}

package/src/steward/launch.ts

@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto';
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { resolveHqLaunchSeat } from '../hq/seats.js';
 import { debug } from '../debug/log.js';
 import { publishInsideEvent } from '../nexus/api/inside-events.js';
 import { redactSecrets } from '../task-cards/card-store.js';
@@ -42,9 +44,11 @@ export interface LaunchDeps {
   settings: StewardSettings;
   ledger: LaunchLedger;
   /** Injected command boundary; the production adapter runs only argv, never a shell. */
-  command?: (args: string[]) => { exitCode: number; stdout: string; stderr?: string };
-  spawn?: (args: string[], log: string) => { pid: number };
+  command?: (args: string[], seat?: string) => { exitCode: number; stdout: string; stderr?: string };
+  spawn?: (args: string[], log: string, seat?: string) => { pid: number };
   gate?: (goalId: string, budget: BudgetDecision | 'unknown') => PreLaunchGateDecision;
+  /** Production commands run from the registered OP view; tests can supply an isolated view. */
+  launchSeat?: () => string;
 }
 
 const RUN_ID = /\brun-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i;
@@ -52,7 +56,7 @@ const DEFAULT_POOL = 'pool-node-b@node-b:8';
 // `harness budget --json` outcomes: proceed | next-provider | wait-reset | stop. next-provider still runs (the harness switches provider itself).
 const BUDGET_PROCEED: readonly string[] = ['proceed', 'next-provider'];
 const launchMode = (settings: StewardSettings): 'off' | 'shadow' | 'live' => launchModeOf(settings.mode ?? settings.launch ?? 'shadow');
-const cli = (args: string[]) => ['bun', 'bin/elanous.mjs', ...(process.env.NODE_ENV === 'test' ? ['--test'] : []), ...args];
+const cli = (args: string[]) => [process.execPath, resolve(import.meta.dir, '../../bin/elanous.mjs'), ...(process.env.NODE_ENV === 'test' ? ['--test'] : []), ...args];
 const sourceOf = (issue: TriageIssue): string => /^출처: (telegram|pwa|tui|cli)$/m.exec(issue.body)?.[1] ?? `linear:${issue.identifier}`;
 const promptOf = (issue: TriageIssue): string => `${issue.title}\n${issue.body.slice(0, 1500)}`;
 const argvFor = (issue: TriageIssue, settings: StewardSettings): string[] =>
@@ -100,15 +104,19 @@ export function planLaunches(rows: ScheduledDecision[], issues: TriageIssue[], l
   return { launches, hitl };
 }
 
-function runCommand(args: string[]): { exitCode: number; stdout: string; stderr: string } {
-  const result = Bun.spawnSync(args, { cwd: resolve(import.meta.dir, '../..'), stdout: 'pipe', stderr: 'pipe' });
+function stewardLaunchSeat(): string {
+  return resolveHqLaunchSeat('OP', getElanousConfigDir());
+}
+
+function runCommand(args: string[], cwd = resolve(import.meta.dir, '../..')): { exitCode: number; stdout: string; stderr: string } {
+  const result = Bun.spawnSync(args, { cwd, stdout: 'pipe', stderr: 'pipe' });
   return { exitCode: result.exitCode, stdout: result.stdout.toString(), stderr: result.stderr.toString() };
 }
 
-function spawnDetached(args: string[], log: string): { pid: number } {
+function spawnDetached(args: string[], log: string, seat = stewardLaunchSeat()): { pid: number } {
   const fd = openSync(log, 'a');
   try {
-    const child = Bun.spawn(args, { cwd: resolve(import.meta.dir, '../..'), stdout: fd, stderr: fd, stdin: 'ignore', detached: true });
+    const child = Bun.spawn(args, { cwd: seat, stdout: fd, stderr: fd, stdin: 'ignore', detached: true });
     child.unref();
     return { pid: child.pid };
   } finally { closeSync(fd); }
@@ -149,9 +157,12 @@ export function launch(item: LaunchItem, deps: LaunchDeps): LaunchEntry {
   // L6: a launch must remain on the isolated Pod pool, never fall back to the host or another substrate.
   if (!/^[a-zA-Z0-9_-]+(?:@[a-zA-Z0-9._-]+(?::[1-9][0-9]*)?)?$/.test(settings.podPool ?? DEFAULT_POOL))
     return blocked('blocked-location', 'invalid steward pod pool');
+  let seat: string;
+  try { seat = (deps.launchSeat ?? stewardLaunchSeat)(); }
+  catch (error) { return blocked('blocked-location', `steward OP seat unavailable: ${String(error)}`); }
   let budget: BudgetDecision | 'unknown' = 'unknown';
   try {
-    const result = command(cli(['harness', 'budget', '--json']));
+    const result = command(cli(['harness', 'budget', '--json']), seat);
     const decision = result.exitCode === 0 ? lastJson(result.stdout) : {};
     if (!BUDGET_PROCEED.includes(String(decision.outcome)))
       return blocked('skipped-budget', result.exitCode === 0 ? JSON.stringify(decision.reasons ?? ['budget unavailable']) : result.stderr ?? 'budget unavailable');
@@ -171,7 +182,7 @@ export function launch(item: LaunchItem, deps: LaunchDeps): LaunchEntry {
   ledger.launches[key] = entry;
   saveLaunchLedger(root, ledger);
   try {
-    entry.pid = (deps.spawn ?? spawnDetached)(argvFor(item.issue, settings), entry.log).pid;
+    entry.pid = (deps.spawn ?? spawnDetached)(argvFor(item.issue, settings), entry.log, seat).pid;
   } catch (error) {
     entry.status = 'failed';
     entry.reason = redactSecrets(String(error));

package/src/steward/triage.ts

@@ -62,6 +62,8 @@ export interface StewardDeps {
   launchSettings?: Pick<StewardSettings, 'mode' | 'launch' | 'maxParallel' | 'podPool'>;
   launchCommand?: LaunchDeps['command'];
   spawnLaunch?: LaunchDeps['spawn'];
+  /** Isolated OP view for tests; production resolves the registered HQ seat (launch.ts stewardLaunchSeat). */
+  launchSeat?: LaunchDeps['launchSeat'];
   launchGate?: LaunchDeps['gate'];
   outcomeNotify?: Pick<OutcomeNotifyDeps, 'document' | 'message' | 'worktreeCommand' | 'loadOrigin' | 'loadOrigins'>;
   /** Internal command boundary: the current sync has already claimed this pid. */
@@ -450,7 +452,7 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
     }); } catch { /* logging must not change the schedule */ }
     writeFileSync(schedule, JSON.stringify(rows));
     const ledger = readLaunchLedger(root);
-    const launchDeps: LaunchDeps = { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch, gate: deps.launchGate };
+    const launchDeps: LaunchDeps = { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch, gate: deps.launchGate, launchSeat: deps.launchSeat };
     const cardDeps = { root, store: deps.cardStore, now: deps.now };
     collectOutcomes(ledger, launchDeps);
     const plan = planLaunches(rows, issues, ledger, settings);
@@ -510,7 +512,7 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       writeFileSync(path, JSON.stringify(state));
     }
     const ledger = readLaunchLedger(root);
-    const outcomes = collectOutcomes(ledger, { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch });
+    const outcomes = collectOutcomes(ledger, { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch, launchSeat: deps.launchSeat });
     for (const outcome of outcomes) {
       const issue = issues.find(item => item.identifier === outcome.issue) ??
         { identifier: outcome.issue, title: outcome.title, ref: '', body: '' };

package/src/storage/file-lock.ts

@@ -46,7 +46,7 @@ export interface LockOpts {
    * (a holder killed with -9 must not wedge waiters for `staleMs`).
    */
   breakDeadHolder?: boolean;
-  /** Sync lock only: called once, the first time the lock is found held by someone else. */
+  /** Called once, the first time the lock is found held by someone else. */
   onWait?: (holder: string) => void;
 }
 
@@ -137,6 +137,7 @@ export async function acquireLockAsync(lockPath: string, opts: LockOpts = {}): P
   const heartbeatMs = Math.max(50, Math.floor(staleMs / 3));
   // ⭐ **소유 토큰** — inode 보다 강하다(inode 는 재사용된다). 파일 내용이 곧 소유 증명이다.
   const token = `${process.pid}:${randomUUID()}`;
+  let waited = false;
 
   for (let attempt = 0; attempt < maxTries; attempt += 1) {
     try {
@@ -187,6 +188,12 @@ export async function acquireLockAsync(lockPath: string, opts: LockOpts = {}): P
       } catch {
         continue;
       }
+      if (!waited && opts.onWait) {
+        waited = true;
+        let holder = '';
+        try { holder = readFileSync(lockPath, 'utf8').trim(); } catch { /* gone */ }
+        try { opts.onWait(holder); } catch { /* observer only */ }
+      }
       await new Promise((resolve) => { setTimeout(resolve, retryBusyMs); });
     }
   }

package/src/task-agent/actions.ts

@@ -164,6 +164,10 @@ export async function executeNextAction(action: NextAction, deps: ActionDeps): P
       parsed = item as typeof parsed;
     } catch { return record('failed', 'invalid review JSON'); }
     if (parsed.reviewed !== true) return record('failed', 'review was not performed');
+    // TA-LAND-MUSTFIX-ZERO — «pass» 라도 must-fix 가 남았거나 수를 못 읽으면 land 로 가지 않는다(#25941 `canAuto` 와 같은 축).
+    //   `self review --json` 은 mustFix 배열을 «항상» 싣는다 — 배열이 아니면 «0» 이 아니라 «모름»으로 읽는다(fail-closed).
+    if (parsed.verdict === 'pass' && (!Array.isArray(parsed.mustFix) || !parsed.mustFix.every(fix => typeof fix === 'string'))) return card('review-must-fix-unknown: pass verdict without a readable must-fix list');
+    if (parsed.verdict === 'pass' && parsed.mustFix!.length > 0) return card(`review-warn-with-must-fix: pass verdict carries ${parsed.mustFix!.length} must-fix`);
     if (parsed.verdict === 'pass') { record('done', 'review pass'); return executeNextAction({ ...action, kind: 'land', history: [...(action.history ?? []), 'review pass'] }, deps); }
     if (parsed.verdict === 'fail' && Array.isArray(parsed.mustFix) && parsed.mustFix.length > 0 && parsed.mustFix.every(fix => typeof fix === 'string' && fix.trim())) { record('done', 'review fail'); return executeNextAction({ ...action, kind: 'retry', mustFix: parsed.mustFix, history: [...(action.history ?? []), 'review fail'] }, deps); }
     return card('review verdict or must-fix unavailable');