elanous 0.2.22 → 0.2.24

package/src/smart-wizard/capability-index.ts

@@ -0,0 +1,231 @@
+import { Database } from 'bun:sqlite';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { buildCapabilityMatrix } from '../agent-mission/capability-matrix.js';
+import { createCapabilityReaders } from '../agent-mission/capability-readers.js';
+import type { CapabilityEntry } from '../agent-mission/capability-types.js';
+import { readCodexPluginsFromAppServer, type CodexPluginObservation } from '../acp/codex-plugins.js';
+import { kgsDefaultDbPath } from '../knowledge/kgs/sqlite-store.js';
+import { OFFICIAL_INDEX_KEYS } from '../market/official-keys.js';
+import { verifyIndex, type MarketplaceIndex } from '../market/signed-index.js';
+import { readClaudePackageLedger, type ClaudePackageLedger } from '../plugins/adapters/claude-package.js';
+import { ELANOUS_MARKET_URL } from '../plugins/install/market-fetch.js';
+import { buildSkillIndex, skillIndexProblems, type SkillIndexEntry } from '../skills/index.js';
+import { defaultSkillDirs } from '../user-config.js';
+
+export type CapabilitySource = 'skills' | 'plugins' | 'knowledge' | 'codex' | 'claude' | 'market';
+export type CapabilityAuth = 'subscription' | 'free' | 'api-key' | 'paid' | 'unknown';
+export interface IndexedCapability {
+  readonly id: string;
+  readonly kind: 'skill' | 'plugin' | 'knowledge' | 'connector';
+  readonly source: CapabilitySource;
+  readonly provenance: string;
+  readonly auth: CapabilityAuth;
+  readonly state: 'installed' | 'candidate' | 'ready' | 'unavailable' | 'unknown';
+  readonly capabilities: readonly string[];
+}
+export interface CapabilityIndex {
+  readonly sources: Record<CapabilitySource, 'ok' | 'unknown'>;
+  readonly entries: readonly IndexedCapability[];
+}
+
+export interface CapabilityIndexReaders {
+  skills?: () => readonly SkillIndexEntry[];
+  skillProblems?: () => readonly { name: string; dir: string }[];
+  plugins?: () => readonly { name: string; market: string }[];
+  knowledge?: () => readonly { name: string; provenance: string }[];
+  codex?: () => Promise<CodexPluginObservation>;
+  claude?: () => ClaudePackageLedger;
+  /** Production verifies fetched bytes; tests may inject a checked fixture. */
+  market?: () => Promise<MarketplaceIndex>;
+  matrix?: () => readonly CapabilityEntry[];
+  /** Default-path observations (used only when `skills` / `plugins` are not injected). */
+  localSkills?: () => LocalSkillsObservation;
+  localPlugins?: () => LocalPluginsObservation;
+  /** Already verified by the caller (never accepts unverified JSON). */
+  verifiedMarket?: MarketplaceIndex;
+}
+
+export interface LocalSkillsObservation {
+  readonly entries: readonly SkillIndexEntry[];
+  /** Roots that exist (or could not be proven absent) but could not be read. */
+  readonly unreadableRoots: readonly string[];
+}
+
+/** Per-root read: an unreadable root is reported, readable roots keep their candidates. */
+export function readLocalSkills(dirs: readonly string[] = defaultSkillDirs()): LocalSkillsObservation {
+  // A missing root is optional; any other stat/read failure must remain unknown.
+  const readable: string[] = [];
+  const unreadableRoots: string[] = [];
+  for (const dir of dirs) {
+    try {
+      if (!statSync(dir).isDirectory()) throw new Error('skill root is not a directory');
+      readdirSync(dir);
+      readable.push(dir);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      unreadableRoots.push(dir);
+    }
+  }
+  return { entries: readable.length ? buildSkillIndex(readable) : [], unreadableRoots };
+}
+
+/** Strict form: throws when any root is unreadable. */
+export function listLocalSkills(dirs: readonly string[] = defaultSkillDirs()): readonly SkillIndexEntry[] {
+  const observed = readLocalSkills(dirs);
+  if (observed.unreadableRoots.length) throw new Error(`unreadable skill roots: ${observed.unreadableRoots.join(', ')}`);
+  return observed.entries;
+}
+
+export interface LocalPluginsObservation {
+  readonly plugins: readonly { name: string; market: string }[];
+  /** `absent` = ENOENT (no installs recorded); `unreadable` = exists but stat/read/parse failed. */
+  readonly ledger: 'ok' | 'absent' | 'unreadable';
+  /** Plugin directories that exist (or could not be proven absent) but could not be listed. */
+  readonly unreadableDirs: readonly string[];
+}
+
+/** ENOENT → absent; every other failure is a read failure, never "no candidates". */
+function statKind(path: string, want: 'any' | 'file' = 'any'): 'present' | 'absent' | 'unreadable' {
+  try { const stat = statSync(path); return want === 'file' && !stat.isFile() ? 'absent' : 'present'; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === 'ENOENT' ? 'absent' : 'unreadable'; }
+}
+
+export function readLocalPlugins(
+  ledgerPath: string = join(elanousStateRoot(), 'plugins', 'installed.json'),
+  localDirs: readonly string[] = [resolve(import.meta.dir, '../../plugins')],
+): LocalPluginsObservation {
+  const plugins: { name: string; market: string }[] = [];
+  let ledger: LocalPluginsObservation['ledger'] = 'absent';
+  const ledgerKind = statKind(ledgerPath);
+  if (ledgerKind === 'unreadable') ledger = 'unreadable';
+  else if (ledgerKind === 'present') {
+    try {
+      const rows: unknown = JSON.parse(readFileSync(ledgerPath, 'utf8'));
+      if (!Array.isArray(rows) || !rows.every(row => row && typeof row.name === 'string' && typeof row.market === 'string')) throw new Error('invalid installed plugin ledger');
+      plugins.push(...rows.map(row => ({ name: row.name as string, market: row.market as string })));
+      ledger = 'ok';
+    } catch { ledger = 'unreadable'; }
+  }
+  const unreadableDirs: string[] = [];
+  for (const dir of localDirs) {
+    const kind = statKind(dir);
+    if (kind === 'absent') continue;
+    const found: { name: string; market: string }[] = [];
+    try {
+      if (kind === 'unreadable') throw new Error('plugin directory unreadable');
+      for (const item of readdirSync(dir, { withFileTypes: true })) {
+        if (!item.isDirectory()) continue;
+        const path = join(dir, item.name);
+        const manifests = [statKind(join(path, 'plugin.ts'), 'file'), statKind(join(path, 'plugin.json'), 'file')];
+        if (manifests.includes('present')) found.push({ name: item.name, market: dir });
+        else if (manifests.includes('unreadable')) unreadableDirs.push(path);
+      }
+      plugins.push(...found);
+    } catch { unreadableDirs.push(dir); }
+  }
+  return { plugins, ledger, unreadableDirs };
+}
+
+function listLocalKnowledge(): readonly { name: string; provenance: string }[] {
+  const path = kgsDefaultDbPath();
+  if (!existsSync(path)) throw new Error('knowledge store unavailable');
+  const db = new Database(path, { readonly: true, create: false });
+  try {
+    return (db.query('SELECT slug, version FROM kgs_pack ORDER BY slug, version').all() as Array<{ slug: string; version: string }>)
+      .map(row => ({ name: `${row.slug}@${row.version}`, provenance: path }));
+  } finally { db.close(); }
+}
+
+async function readOfficialMarket(): Promise<MarketplaceIndex> {
+  const url = new URL('marketplace.json', ELANOUS_MARKET_URL);
+  const [raw, sig] = await Promise.all([fetch(url), fetch(new URL('index.sig', url))]);
+  if (!raw.ok || !sig.ok) throw new Error('official index unavailable');
+  const checked = verifyIndex({ marketplaceBytes: new Uint8Array(await raw.arrayBuffer()), signatureText: await sig.text(), trustedKeys: OFFICIAL_INDEX_KEYS });
+  if (!checked.ok || checked.index.name !== 'elanous') throw new Error('official index unverified');
+  return checked.index;
+}
+
+function marketAuth(entry: MarketplaceIndex['plugins'][number]): CapabilityAuth {
+  const policy = entry.policy?.authentication?.toLowerCase();
+  if (policy === 'api-key' || policy === 'api_key') return 'api-key';
+  if (policy === 'subscription') return 'subscription';
+  if (policy === 'paid') return 'paid';
+  if (policy === 'none' || policy === 'free') return 'free';
+  return 'unknown';
+}
+
+/** Read-only, per-source index. No source failure is interpreted as an empty inventory. */
+export async function buildCapabilityIndex(readers: CapabilityIndexReaders = {}): Promise<CapabilityIndex> {
+  const sources: CapabilityIndex['sources'] = { skills: 'ok', plugins: 'ok', knowledge: 'ok', codex: 'ok', claude: 'ok', market: 'ok' };
+  const entries: IndexedCapability[] = [];
+  const attempt = async (source: CapabilitySource, read: () => Promise<void> | void): Promise<void> => {
+    const start = entries.length;
+    try { await read(); } catch { sources[source] = 'unknown'; entries.splice(start); }
+  };
+  await attempt('skills', () => {
+    const observed: LocalSkillsObservation = readers.skills
+      ? { entries: readers.skills(), unreadableRoots: [] }
+      : (readers.localSkills ?? readLocalSkills)();
+    for (const skill of observed.entries) entries.push({ id: skill.name, kind: 'skill', source: 'skills', provenance: skill.rootDir, auth: 'unknown', state: 'installed', capabilities: [skill.name] });
+    if (observed.unreadableRoots.length) {
+      sources.skills = 'unknown';
+      for (const dir of observed.unreadableRoots) entries.push({ id: dir, kind: 'skill', source: 'skills', provenance: dir, auth: 'unknown', state: 'unknown', capabilities: [] });
+    }
+    const problems = (readers.skillProblems ?? skillIndexProblems)();
+    if (problems.length) {
+      sources.skills = 'unknown';
+      for (const problem of problems) entries.push({ id: problem.name, kind: 'skill', source: 'skills', provenance: problem.dir, auth: 'unknown', state: 'unknown', capabilities: [problem.name] });
+    }
+  });
+  let installed: readonly { name: string; market: string }[] | undefined;
+  await attempt('plugins', () => {
+    if (readers.plugins) installed = readers.plugins();
+    else {
+      const observed = (readers.localPlugins ?? readLocalPlugins)();
+      installed = observed.plugins;
+      // Absent ledger keeps the earlier contract (unknown); unreadable ledger/dirs never read as "no installs".
+      if (observed.ledger !== 'ok' || observed.unreadableDirs.length) sources.plugins = 'unknown';
+      for (const dir of observed.unreadableDirs) entries.push({ id: dir, kind: 'plugin', source: 'plugins', provenance: dir, auth: 'unknown', state: 'unknown', capabilities: [] });
+    }
+    for (const plugin of installed) entries.push({ id: plugin.name, kind: 'plugin', source: 'plugins', provenance: plugin.market, auth: 'unknown', state: 'installed', capabilities: [plugin.name] });
+  });
+  await attempt('knowledge', () => {
+    for (const pack of (readers.knowledge ?? listLocalKnowledge)()) entries.push({ id: pack.name, kind: 'knowledge', source: 'knowledge', provenance: pack.provenance, auth: 'unknown', state: 'installed', capabilities: [pack.name] });
+  });
+  await attempt('codex', async () => {
+    const observation = await (readers.codex ?? readCodexPluginsFromAppServer)();
+    if (observation.status === 'unknown') { sources.codex = 'unknown'; return; }
+    for (const plugin of observation.plugins) entries.push({ id: plugin.name, kind: 'plugin', source: 'codex', provenance: plugin.marketplace, auth: 'unknown', state: plugin.enabled ? 'installed' : 'unavailable', capabilities: [plugin.name] });
+  });
+  await attempt('claude', () => {
+    const ledger = (readers.claude ?? readClaudePackageLedger)();
+    if (ledger.status !== 'ok') sources.claude = 'unknown';
+    for (const pkg of ledger.packages) entries.push({ id: pkg.plugin, kind: 'plugin', source: 'claude', provenance: `${pkg.marketplace}:${pkg.source}`, auth: 'unknown', state: 'installed', capabilities: [pkg.plugin] });
+  });
+  await attempt('market', async () => {
+    const index = readers.verifiedMarket ?? await (readers.market ?? readOfficialMarket)();
+    if (index.name !== 'elanous') throw new Error('not official market');
+    for (const plugin of index.plugins) {
+      entries.push({ id: plugin.name, kind: 'plugin', source: 'market', provenance: `${index.name}:${plugin.source.source}`, auth: marketAuth(plugin),
+        state: sources.plugins === 'unknown' ? 'unknown' : installed?.some(row => row.name === plugin.name && row.market === index.name) ? 'installed' : 'candidate',
+        capabilities: [plugin.name, ...plugin['ai.elanous'].capabilities, ...(plugin['ai.elanous'].vocab ?? [])] });
+      for (const connector of plugin['ai.elanous'].connectors) entries.push({ id: connector.id, kind: 'connector', source: 'market', provenance: `${index.name}:${plugin.name}`, auth: marketAuth(plugin), state: sources.plugins === 'unknown' ? 'unknown' : 'candidate', capabilities: [connector.id] });
+    }
+    for (const pack of index.knowledgePacks ?? []) {
+      if (pack.visibility !== 'public') continue;
+      entries.push({ id: pack.name, kind: 'knowledge', source: 'market', provenance: index.name, auth: 'unknown', state: 'candidate', capabilities: [pack.name] });
+    }
+  });
+  // Matrix is an additional service observation, not proof of plugin installation.
+  let matrix: readonly CapabilityEntry[] = [];
+  try { matrix = (readers.matrix ?? (() => buildCapabilityMatrix(createCapabilityReaders())))(); }
+  catch { /* Matrix is supplementary; plugin inventories keep their own observation status. */ }
+  for (const service of matrix) {
+    // Only backends that are index sources are attributed; grok has no source row here, so it is not relabelled.
+    if (!service.service || service.service === '*' || (service.backend !== 'codex' && service.backend !== 'claude')) continue;
+    entries.push({ id: service.service, kind: 'connector', source: service.backend, provenance: `${service.backend}:mcp`, auth: 'unknown', state: service.state, capabilities: [service.service] });
+  }
+  return { sources, entries };
+}

package/src/smart-wizard/rung.ts

@@ -0,0 +1,74 @@
+// The condition extraction (including any LLM judgment) happens before this deterministic selector.
+export type WizardRung = 'a' | 'b' | 'c' | 'd' | 'e';
+export type GraphValueSignal = 'verification' | 'rework' | 'approval' | 'branching' | 'resume' | 'parallel' | 'resolution';
+
+export type RungConditions = {
+  capabilityGaps: number;
+  graphSignals: readonly GraphValueSignal[];
+  recurring: boolean;
+  needsMemory: boolean;
+  unattended: boolean;
+  roles: number;
+  differentCadences: boolean;
+  differentPermissions: boolean;
+  handoffs: number;
+};
+
+export type RungDecision = {
+  rung: WizardRung;
+  reasons: string[];
+  rejectedHigher: string[];
+};
+
+const graphSignalNames: readonly GraphValueSignal[] = [
+  'verification', 'rework', 'approval', 'branching', 'resume', 'parallel', 'resolution',
+];
+const rungOrder: readonly WizardRung[] = ['a', 'b', 'c', 'd', 'e'];
+
+/** Select the lowest rung sufficient for the supplied, already-established conditions. */
+export function classifyRung(conditions: RungConditions): RungDecision {
+  const { capabilityGaps, graphSignals, recurring, needsMemory, unattended, roles,
+    differentCadences, differentPermissions, handoffs } = conditions;
+  for (const [name, value] of Object.entries({ capabilityGaps, roles, handoffs })) {
+    if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer`);
+  }
+  if (graphSignals.some(signal => !graphSignalNames.includes(signal))) {
+    throw new TypeError('graphSignals contains an unknown signal');
+  }
+
+  const distinctSignals = graphSignalNames.filter(signal => graphSignals.includes(signal));
+  const graphWorthwhile = distinctSignals.length >= 2;
+  const loopNeeded = recurring && (needsMemory || unattended);
+  const collectiveNeeded = roles >= 2 && (differentCadences || differentPermissions) && handoffs >= 1;
+  let rung: WizardRung = 'a';
+  const reasons: string[] = [];
+  if (capabilityGaps > 0) {
+    rung = 'b';
+    reasons.push(`b: capability gaps ${capabilityGaps} > 0`);
+  }
+  if (graphWorthwhile) {
+    rung = 'c';
+    reasons.push(`c: ${distinctSignals.length} graph value signals >= 2 (${distinctSignals.join(', ')})`);
+  }
+  if (loopNeeded) {
+    rung = 'd';
+    reasons.push(`d: recurring and ${[needsMemory && 'needs memory', unattended && 'unattended'].filter(Boolean).join(' / ')}`);
+  }
+  if (collectiveNeeded) {
+    rung = 'e';
+    reasons.push(`e: ${roles} roles >= 2, ${[differentCadences && 'different cadences', differentPermissions && 'different permissions'].filter(Boolean).join(' / ')}, handoffs ${handoffs} >= 1`);
+  }
+  if (reasons.length === 0) reasons.push('a: no higher-rung condition met; one skill call or short chain suffices');
+
+  const rejected = {
+    b: `b: capability gaps ${capabilityGaps} = 0`,
+    c: `c: ${distinctSignals.length} distinct graph value signals < 2`,
+    d: `d: ${!recurring ? 'not recurring' : 'neither memory nor unattended execution'}`,
+    e: `e: ${[
+      roles < 2 && `roles ${roles} < 2`,
+      !differentCadences && !differentPermissions && 'neither different cadences nor different permissions',
+      handoffs < 1 && `handoffs ${handoffs} < 1`,
+    ].filter(Boolean).join('; ')}`,
+  };
+  return { rung, reasons, rejectedHigher: rungOrder.slice(rungOrder.indexOf(rung) + 1).map(higher => rejected[higher as keyof typeof rejected]) };
+}

package/src/steward/launch.ts

@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto';
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { join } from 'node:path';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+import { installedCliArgv, resolveHqLaunchSeat } from '../hq/seats.js';
 import { debug } from '../debug/log.js';
 import { publishInsideEvent } from '../nexus/api/inside-events.js';
 import { redactSecrets } from '../task-cards/card-store.js';
@@ -42,9 +44,11 @@ export interface LaunchDeps {
   settings: StewardSettings;
   ledger: LaunchLedger;
   /** Injected command boundary; the production adapter runs only argv, never a shell. */
-  command?: (args: string[]) => { exitCode: number; stdout: string; stderr?: string };
-  spawn?: (args: string[], log: string) => { pid: number };
+  command?: (args: string[], seat?: string) => { exitCode: number; stdout: string; stderr?: string };
+  spawn?: (args: string[], log: string, seat?: string) => { pid: number };
   gate?: (goalId: string, budget: BudgetDecision | 'unknown') => PreLaunchGateDecision;
+  /** Production commands run from the registered OP view; tests can supply an isolated view. */
+  launchSeat?: () => string;
 }
 
 const RUN_ID = /\brun-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i;
@@ -52,7 +56,7 @@ const DEFAULT_POOL = 'pool-node-b@node-b:8';
 // `harness budget --json` outcomes: proceed | next-provider | wait-reset | stop. next-provider still runs (the harness switches provider itself).
 const BUDGET_PROCEED: readonly string[] = ['proceed', 'next-provider'];
 const launchMode = (settings: StewardSettings): 'off' | 'shadow' | 'live' => launchModeOf(settings.mode ?? settings.launch ?? 'shadow');
-const cli = (args: string[]) => ['bun', 'bin/elanous.mjs', ...(process.env.NODE_ENV === 'test' ? ['--test'] : []), ...args];
+const cli = (args: string[]) => installedCliArgv([...(process.env.NODE_ENV === 'test' ? ['--test'] : []), ...args]);
 const sourceOf = (issue: TriageIssue): string => /^출처: (telegram|pwa|tui|cli)$/m.exec(issue.body)?.[1] ?? `linear:${issue.identifier}`;
 const promptOf = (issue: TriageIssue): string => `${issue.title}\n${issue.body.slice(0, 1500)}`;
 const argvFor = (issue: TriageIssue, settings: StewardSettings): string[] =>
@@ -100,15 +104,20 @@ export function planLaunches(rows: ScheduledDecision[], issues: TriageIssue[], l
   return { launches, hitl };
 }
 
-function runCommand(args: string[]): { exitCode: number; stdout: string; stderr: string } {
-  const result = Bun.spawnSync(args, { cwd: resolve(import.meta.dir, '../..'), stdout: 'pipe', stderr: 'pipe' });
+function stewardLaunchSeat(): string {
+  return resolveHqLaunchSeat('OP', getElanousConfigDir());
+}
+
+/** Read commands run in the registered OP seat as well: the tree this module was loaded from may be a stale clone. */
+function runCommand(args: string[], cwd = stewardLaunchSeat()): { exitCode: number; stdout: string; stderr: string } {
+  const result = Bun.spawnSync(args, { cwd, stdout: 'pipe', stderr: 'pipe' });
   return { exitCode: result.exitCode, stdout: result.stdout.toString(), stderr: result.stderr.toString() };
 }
 
-function spawnDetached(args: string[], log: string): { pid: number } {
+function spawnDetached(args: string[], log: string, seat = stewardLaunchSeat()): { pid: number } {
   const fd = openSync(log, 'a');
   try {
-    const child = Bun.spawn(args, { cwd: resolve(import.meta.dir, '../..'), stdout: fd, stderr: fd, stdin: 'ignore', detached: true });
+    const child = Bun.spawn(args, { cwd: seat, stdout: fd, stderr: fd, stdin: 'ignore', detached: true });
     child.unref();
     return { pid: child.pid };
   } finally { closeSync(fd); }
@@ -149,9 +158,12 @@ export function launch(item: LaunchItem, deps: LaunchDeps): LaunchEntry {
   // L6: a launch must remain on the isolated Pod pool, never fall back to the host or another substrate.
   if (!/^[a-zA-Z0-9_-]+(?:@[a-zA-Z0-9._-]+(?::[1-9][0-9]*)?)?$/.test(settings.podPool ?? DEFAULT_POOL))
     return blocked('blocked-location', 'invalid steward pod pool');
+  let seat: string;
+  try { seat = (deps.launchSeat ?? stewardLaunchSeat)(); }
+  catch (error) { return blocked('blocked-location', `steward OP seat unavailable: ${String(error)}`); }
   let budget: BudgetDecision | 'unknown' = 'unknown';
   try {
-    const result = command(cli(['harness', 'budget', '--json']));
+    const result = command(cli(['harness', 'budget', '--json']), seat);
     const decision = result.exitCode === 0 ? lastJson(result.stdout) : {};
     if (!BUDGET_PROCEED.includes(String(decision.outcome)))
       return blocked('skipped-budget', result.exitCode === 0 ? JSON.stringify(decision.reasons ?? ['budget unavailable']) : result.stderr ?? 'budget unavailable');
@@ -171,7 +183,7 @@ export function launch(item: LaunchItem, deps: LaunchDeps): LaunchEntry {
   ledger.launches[key] = entry;
   saveLaunchLedger(root, ledger);
   try {
-    entry.pid = (deps.spawn ?? spawnDetached)(argvFor(item.issue, settings), entry.log).pid;
+    entry.pid = (deps.spawn ?? spawnDetached)(argvFor(item.issue, settings), entry.log, seat).pid;
   } catch (error) {
     entry.status = 'failed';
     entry.reason = redactSecrets(String(error));

package/src/steward/triage-budget.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { debug } from '../debug/log.js';
 import type { TriageDecision, TriageIssue } from './triage.js';
+import { InvalidWorkingBackwardsDraft } from './working-backwards.js';
 
 export interface HashedTriageDecision extends TriageDecision {
   inputHash: string;
@@ -125,3 +126,64 @@ export async function triageWithinBudget({ issues, previous, judge, tracks, conc
   debug.log('steward.triage', 'budget', stats);
   return { decisions, stats };
 }
+
+export interface CarriedDraft<T> {
+  wish: T;
+  /** `deadline` = never started before the stage deadline; `timeout` = per-item or stage deadline hit mid-draft. */
+  reason: 'timeout' | 'deadline' | 'error';
+}
+
+type DraftOutcome<T> = { kind: 'drafted' } | { kind: 'invalid' } | { kind: 'carried'; reason: CarriedDraft<T>['reason'] };
+
+export async function draftWithinBudget<T>({ wishes, draft, concurrency = 4, perItemMs = 120_000, deadlineMs = 240_000, now = Date.now }: {
+  wishes: T[];
+  /** `expired` rejects once this item's own deadline passes; drafts should race their slow calls against it. */
+  draft: (wish: T, expired: Promise<never>) => Promise<void>;
+  concurrency?: number;
+  perItemMs?: number;
+  deadlineMs?: number;
+  now?: () => number;
+}): Promise<{ drafted: T[]; carried: Array<CarriedDraft<T>>; invalid: T[]; stats: { drafted: number; carried: number; invalid: number } }> {
+  const end = now() + deadlineMs;
+  const slots = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 4;
+  const outcomes: Array<DraftOutcome<T> | undefined> = new Array(wishes.length);
+  let stageTimer: ReturnType<typeof setTimeout> | undefined;
+  const stageExpired = new Promise<void>(resolve => { stageTimer = setTimeout(resolve, Math.max(0, end - now())); });
+  const timedOut = Symbol('draft-timeout');
+  let cursor = 0;
+  const worker = async (): Promise<void> => {
+    while (cursor < wishes.length) {
+      const remaining = end - now();
+      if (remaining <= 0) return;
+      const index = cursor++;
+      let itemTimer: ReturnType<typeof setTimeout> | undefined;
+      const expired = new Promise<never>((_, reject) => { itemTimer = setTimeout(() => reject(timedOut), Math.min(perItemMs, remaining)); });
+      // The draft may finish without ever racing this promise — never leave its rejection unhandled.
+      expired.catch(() => undefined);
+      const work = Promise.resolve().then(() => draft(wishes[index]!, expired));
+      const settled = work.then(() => undefined, () => undefined);
+      try {
+        await Promise.race([work, expired]);
+        outcomes[index] = { kind: 'drafted' };
+      } catch (error) {
+        outcomes[index] = error instanceof InvalidWorkingBackwardsDraft ? { kind: 'invalid' }
+          : { kind: 'carried', reason: error === timedOut ? 'timeout' : 'error' };
+        // A timed-out draft keeps its concurrency slot until the underlying call settles or the stage ends.
+        await Promise.race([settled, stageExpired]);
+      } finally { if (itemTimer) clearTimeout(itemTimer); }
+    }
+  };
+  try {
+    await Promise.all(Array.from({ length: Math.min(slots, wishes.length) }, () => worker()));
+  } finally { if (stageTimer) clearTimeout(stageTimer); }
+  const result = { drafted: [] as T[], carried: [] as Array<CarriedDraft<T>>, invalid: [] as T[] };
+  for (const [index, wish] of wishes.entries()) {
+    const outcome = outcomes[index];
+    if (outcome?.kind === 'drafted') result.drafted.push(wish);
+    else if (outcome?.kind === 'invalid') result.invalid.push(wish);
+    else result.carried.push({ wish, reason: outcome?.kind === 'carried' ? outcome.reason : 'deadline' });
+  }
+  const stats = { drafted: result.drafted.length, carried: result.carried.length, invalid: result.invalid.length };
+  debug.log('steward.triage', 'draft-budget', stats);
+  return { ...result, stats };
+}

package/src/steward/triage.ts

@@ -8,6 +8,10 @@ import { getUserConfig } from '../user-config.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { debug, redactSecretText } from '../debug/log.js';
 import { loopEvent } from '../loops/observe.js';
+import { checkLoops, daemonScheduleEntries, entriesFromRegistry, extendHealthyLauncher, launcherEvidence, notifyOwners, scheduleFindings, versionEvidence, type CheckEntry } from '../loops/checker.js';
+import { listSchedules, schedulesDbPath, type ScheduleRow } from '../domains/schedule-registry.js';
+import { Database } from 'bun:sqlite';
+import { defaultLoopRoot, listAllLoops, listLoops } from '../loops/registry.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { redactSecrets } from '../task-cards/card-store.js';
 import { directiveHash } from './directive.js';
@@ -17,7 +21,7 @@ import { planLaunches, launch, collectOutcomes, raiseHitl, readLaunchLedger, sav
 import { listFabricExecutionCandidates } from '../self-dev/fabric-plan-core.js';
 import { InvalidWorkingBackwardsDraft, recordWorkingBackwardsOnCards } from './working-backwards.js';
 import { CardStore } from '../task-cards/card-store.js';
-import { triageWithinBudget } from './triage-budget.js';
+import { draftWithinBudget, triageWithinBudget } from './triage-budget.js';
 import { askSteward, classifyIssue, installedCapabilities, planIssues, ruleJudgment, unsafeReason, type ClassifiedIssue, type StewardAsk } from './triage-plan.js';
 import { failureAlertText, markStageStart, markStageEnd, readFailureStreak, shouldAlert, writeFailureStreak, type FailureStreak, type StewardStage } from './failure-streak.js';
 
@@ -59,13 +63,20 @@ export interface StewardDeps {
   ask?: StewardAsk;
   /** Maximum time for each working-backwards wish draft in schedule (milliseconds). */
   draftItemMs?: number;
+  /** Maximum time for the whole wish-drafting phase in schedule (milliseconds); wishes still undrafted are carried. */
+  draftDeadlineMs?: number;
   launchSettings?: Pick<StewardSettings, 'mode' | 'launch' | 'maxParallel' | 'podPool'>;
   launchCommand?: LaunchDeps['command'];
   spawnLaunch?: LaunchDeps['spawn'];
+  /** Isolated OP view for tests; production resolves the registered HQ seat (launch.ts stewardLaunchSeat). */
+  launchSeat?: LaunchDeps['launchSeat'];
   launchGate?: LaunchDeps['gate'];
   outcomeNotify?: Pick<OutcomeNotifyDeps, 'document' | 'message' | 'worktreeCommand' | 'loadOrigin' | 'loadOrigins'>;
   /** Internal command boundary: the current sync has already claimed this pid. */
   stageOwnedByCommand?: boolean;
+  /** Isolated scheduler inventory for this tick; production reads the unified registry. */
+  scheduleInventory?: () => CheckEntry[];
+  daemonSchedules?: () => ScheduleRow[];
 }
 
 /** rescue launches/harvests like live (HQ-SEAT). */
@@ -312,6 +323,61 @@ function logStageFailure(root: string, stage: StewardStage, reason: string): voi
   if (runId) try { rmSync(tickDecisionPath(root, runId), { force: true }); } catch { /* Observation must not change the failure. */ }
   logTickDecision(root, 'failed', `${stage}: ${reason}`);
 }
+const SCHEDULE_CHECK_MS = 15 * 60_000;
+
+/** Called by runStewardStage(sync) under its stage slot, never from the checker CLI. */
+async function checkStewardSchedules(root: string, settings: StewardSettings, deps: StewardDeps): Promise<void> {
+  const now = (deps.now ?? (() => new Date()))();
+  const marker = join(root, 'steward', 'schedule-check.json');
+  let previous: { at?: string } = {};
+  try { previous = JSON.parse(readFileSync(marker, 'utf8')) as typeof previous; }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }
+  const elapsed = now.getTime() - Date.parse(previous.at ?? '');
+  if (Number.isFinite(elapsed) && elapsed >= 0 && elapsed < SCHEDULE_CHECK_MS) return;
+  const inventory = deps.scheduleInventory ?? (() => {
+    const repo = deps.root ? process.cwd() : defaultLoopRoot();
+    const registryOptions = { now, root: repo, stateRoot: root,
+      ...(deps.root ? { schedules: [] } : {}) };
+    const { entries } = entriesFromRegistry({ now, listAllLoops: () => listAllLoops(registryOptions) });
+    const graphs = listLoops(registryOptions);
+    const byId = new Map(graphs.map(graph => [graph.id, graph.file]));
+    return versionEvidence(launcherEvidence(entries.map(entry => byId.has(entry.id)
+      ? { ...entry, file: byId.get(entry.id) } : entry), root), repo, root);
+  });
+  const daemonRows = deps.daemonSchedules ?? (() => {
+    const path = deps.root ? join(root, 'schedules.db') : schedulesDbPath();
+    if (!existsSync(path)) return [];
+    try {
+      const db = new Database(path, { readonly: true });
+      try { return listSchedules(db); } finally { db.close(); }
+    } catch (error) {
+      debug.log('steward.schedule-check', 'daemon-inventory-unavailable', { reason: redactSecretText(String(error)) });
+      return [];
+    }
+  });
+  const entries = inventory();
+  const seen = new Set(entries.map(entry => entry.id));
+  const checked = checkLoops([...entries, ...daemonScheduleEntries(daemonRows(), now).filter(row => !seen.has(row.id))], now);
+  const findings = scheduleFindings(checked, now);
+  if (settings.mode === 'live') {
+    let recovered = 0;
+    const unresolved = findings.filter(finding => {
+      try {
+        if (extendHealthyLauncher(root, finding, now)) { recovered++; return false; }
+      } catch (error) {
+        debug.log('steward.schedule-check', 'recovery-failed', { id: finding.id, reason: redactSecretText(String(error)) });
+      }
+      return true;
+    });
+    const remainingChecks = checked.filter(row => unresolved.some(finding => finding.id === row.id && finding.kind === row.state));
+    const ownerRequests = notifyOwners(remainingChecks, { root, now }, unresolved);
+    const opEscalations = notifyOwners(remainingChecks, { root, now }, unresolved, true);
+    debug.log('steward.schedule-check', 'routing', { ownerRequests, opEscalations, recovered });
+  }
+  debug.log('steward.schedule-check', 'checked', { count: checked.length, findings: findings.length, mode: settings.mode });
+  writeFileSync(marker, JSON.stringify({ at: now.toISOString() }));
+}
+
 function readState(path: string): { issues: Record<string, string>; digestDay?: string } {
   try { return JSON.parse(readFileSync(path, 'utf8')) as ReturnType<typeof readState>; }
   catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { issues: {} }; throw error; }
@@ -341,6 +407,11 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
   const runId = (graphRunId() ?? process.env.ELANOUS_RUN_ID?.trim()) || `steward-stage-${randomUUID()}`;
   let outcome: 'ok' | 'fail' = 'fail';
   try {
+  if (stage === 'sync') {
+    // The schedule check is an add-on to sync: its failure is observed, never allowed to stop the Linear sync.
+    try { await checkStewardSchedules(root, settings, deps); }
+    catch (error) { debug.log('steward.schedule-check', 'failed', { reason: redactSecretText(String(error)) }, { level: 'warn' }); }
+  }
   const key = await (deps.getSecret ?? getSecretAsync)('connector.linear.apiKey');
   if (!key) throw new Error('connector.linear.apiKey missing');
   if (stage === 'sync') {
@@ -418,27 +489,19 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       const carried = new Set<string>();
       if (store) try {
         recordTriageOnCards(wishes, issues, { root, store, now: deps.now });
-        for (const wish of wishes) {
-          const timedOut = Symbol('draft-timeout');
-          let timer: ReturnType<typeof setTimeout> | undefined;
-          const timeout = new Promise<never>((_, reject) => {
-            timer = setTimeout(() => reject(timedOut), deps.draftItemMs ?? 120_000);
-          });
-          // The draft may finish without ever racing this promise (no ask needed) — never leave its rejection unhandled.
-          timeout.catch(() => undefined);
-          try {
-            // Bound the ask itself so a late answer cannot write to a store closed after this tick.
-            const ask: StewardAsk = (prompt, role) => Promise.race([(deps.ask ?? askSteward)(prompt, role), timeout]);
-            await recordWorkingBackwardsOnCards([wish], issues, store, ask);
-          } catch (error) {
-            if (error instanceof InvalidWorkingBackwardsDraft) {
-              invalid.add(wish.issue);
-              debug.log('steward.stage', 'draft-invalid', { issue: wish.issue });
-            } else {
-              carried.add(wish.issue);
-              debug.log('steward.schedule', 'draft-carried', { issue: wish.issue, reason: error === timedOut ? 'timeout' : 'error' });
-            }
-          } finally { if (timer) clearTimeout(timer); }
+        const outcome = await draftWithinBudget({
+          wishes, perItemMs: deps.draftItemMs ?? 120_000, deadlineMs: deps.draftDeadlineMs ?? 240_000,
+          // Bound the ask itself so a late answer cannot write to a store closed after this tick.
+          draft: (wish, expired) => recordWorkingBackwardsOnCards([wish], issues, store,
+            (prompt, role) => Promise.race([(deps.ask ?? askSteward)(prompt, role), expired])),
+        });
+        for (const wish of outcome.invalid) {
+          invalid.add(wish.issue);
+          debug.log('steward.stage', 'draft-invalid', { issue: wish.issue });
+        }
+        for (const { wish, reason } of outcome.carried) {
+          carried.add(wish.issue);
+          debug.log('steward.schedule', 'draft-carried', { issue: wish.issue, reason });
         }
       } finally { if (!deps.cardStore) store.close(); }
       if (invalid.size || carried.size) rows = rows.map(row => invalid.has(row.issue)
@@ -450,7 +513,7 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
     }); } catch { /* logging must not change the schedule */ }
     writeFileSync(schedule, JSON.stringify(rows));
     const ledger = readLaunchLedger(root);
-    const launchDeps: LaunchDeps = { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch, gate: deps.launchGate };
+    const launchDeps: LaunchDeps = { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch, gate: deps.launchGate, launchSeat: deps.launchSeat };
     const cardDeps = { root, store: deps.cardStore, now: deps.now };
     collectOutcomes(ledger, launchDeps);
     const plan = planLaunches(rows, issues, ledger, settings);
@@ -510,7 +573,7 @@ export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'r
       writeFileSync(path, JSON.stringify(state));
     }
     const ledger = readLaunchLedger(root);
-    const outcomes = collectOutcomes(ledger, { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch });
+    const outcomes = collectOutcomes(ledger, { root, settings, ledger, command: deps.launchCommand, spawn: deps.spawnLaunch, launchSeat: deps.launchSeat });
     for (const outcome of outcomes) {
       const issue = issues.find(item => item.identifier === outcome.issue) ??
         { identifier: outcome.issue, title: outcome.title, ref: '', body: '' };