elanous 0.2.23 → 0.2.25

package/src/instance/dev-project.ts

@@ -0,0 +1,133 @@
+import { execFileSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+
+export interface DevProjectDeps {
+  git?: (dir: string, args: readonly string[]) => string | null;
+  stateDir?: string;
+}
+
+interface DevProjectRegistry {
+  projects: Record<string, string>;
+}
+
+interface DevProjectCache {
+  identityKey: string;
+  devProject: string;
+}
+
+const ULID_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+
+export function resolveDevProject(dir: string, deps: DevProjectDeps = {}): string {
+  const suppliedDir = resolve(dir);
+  const git = deps.git ?? runGit;
+  const gitRoot = git(suppliedDir, ['rev-parse', '--show-toplevel'])?.trim();
+  const root = gitRoot ? resolve(gitRoot) : suppliedDir;
+  let identityKey: string;
+  // A repo with no commit yet (`git init` only) has no first commit to anchor on — it falls back to
+  // the path identity like a plain folder until its first commit exists.
+  const rootCommits = gitRoot
+    ? git(root, ['rev-list', '--max-parents=0', 'HEAD'])?.trim().split(/\s+/).filter(Boolean) ?? []
+    : [];
+
+  if (rootCommits.length > 0) {
+    const firstCommit = rootCommits.length === 1 ? rootCommits[0]! : rootCommits
+      .map((commit) => ({
+        commit,
+        timestamp: Number(git(root, ['show', '-s', '--format=%ct', commit])?.trim()),
+      }))
+      .filter(({ timestamp }) => Number.isFinite(timestamp))
+      .sort((left, right) => left.timestamp - right.timestamp || left.commit.localeCompare(right.commit))[0]?.commit;
+    if (!firstCommit) throw new Error(`Unable to resolve oldest root commit for git project at ${root}`);
+    const remote = git(root, ['remote', 'get-url', 'origin']);
+    identityKey = `git:${firstCommit}:${normalizeRemoteUrl(remote ?? '')}`;
+  } else {
+    identityKey = `path:${createHash('sha256').update(root).digest('hex')}`;
+  }
+
+  const stateDir = resolve(deps.stateDir ?? elanousStateRoot());
+  const registryPath = join(stateDir, 'dev-projects.json');
+  const registry = readRegistry(registryPath);
+  const id = registry.projects[identityKey] ?? newDevProjectId();
+  if (!registry.projects[identityKey]) {
+    registry.projects[identityKey] = id;
+    writeJsonAtomically(registryPath, registry);
+  }
+
+  // The cache is disposable (RFC §4f): a read-only root must not stop the id from resolving.
+  try {
+    writeJsonAtomically(join(root, '.elanous', 'project.json'), { identityKey, devProject: id } satisfies DevProjectCache);
+  } catch { /* cache only */ }
+  return id;
+}
+
+function runGit(dir: string, args: readonly string[]): string | null {
+  try {
+    return execFileSync('git', ['-C', dir, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch {
+    return null;
+  }
+}
+
+function normalizeRemoteUrl(remote: string): string {
+  const value = remote.trim();
+  if (!value) return '';
+
+  const scp = /^(?![a-z][a-z0-9+.-]*:\/\/)(?:[^@/]+@)?([^:/]+):(.+)$/.exec(value);
+  if (scp) return normalizeRemotePath(`${scp[1]!.toLowerCase()}/${scp[2]}`);
+
+  try {
+    const url = new URL(value);
+    return normalizeRemotePath(`${url.hostname.toLowerCase()}${url.pathname}`);
+  } catch {
+    return normalizeRemotePath(resolve(value));
+  }
+}
+
+function normalizeRemotePath(value: string): string {
+  return value.replace(/\\/g, '/').replace(/\/+$/, '').replace(/\.git$/i, '');
+}
+
+/**
+ * The registry is the source of truth for prj- ids. A missing file starts a fresh registry; an
+ * existing but unreadable/corrupt one throws instead of silently re-issuing every project a new id.
+ */
+function readRegistry(path: string): DevProjectRegistry {
+  let raw: string;
+  try {
+    raw = readFileSync(path, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { projects: {} };
+    throw error;
+  }
+  let parsed: Partial<DevProjectRegistry> | undefined;
+  try { parsed = JSON.parse(raw) as Partial<DevProjectRegistry>; } catch { parsed = undefined; }
+  if (parsed?.projects && typeof parsed.projects === 'object' && !Array.isArray(parsed.projects)) {
+    return { projects: parsed.projects as Record<string, string> };
+  }
+  throw new Error(`dev-projects registry is corrupt: ${path}`);
+}
+
+function writeJsonAtomically(path: string, value: unknown): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporaryPath = join(dirname(path), `.${basename(path)}.${process.pid}.${newDevProjectId()}.tmp`);
+  writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { flag: 'wx' });
+  renameSync(temporaryPath, path);
+}
+
+function newDevProjectId(): string {
+  const now = BigInt(Date.now());
+  let timestamp = '';
+  for (let index = 9; index >= 0; index -= 1) {
+    timestamp += ULID_ALPHABET[Number((now >> BigInt(index * 5)) & 31n)];
+  }
+
+  const entropy = BigInt(`0x${randomBytes(10).toString('hex')}`);
+  let random = '';
+  for (let index = 15; index >= 0; index -= 1) {
+    random += ULID_ALPHABET[Number((entropy >> BigInt(index * 5)) & 31n)];
+  }
+  return `prj-${timestamp}${random}`;
+}

package/src/instance/resolve.ts

@@ -56,6 +56,30 @@ export function resolveInstance(deps: ResolveDeps = {}): InstanceResolution {
   return { kind: 'test', root: normRoot(join(process.cwd(), '.elanous-test')), layer: 'default', why: '소스 트리 밖 실행(격리)' };
 }
 
+/** 부모가 도장으로 물려준 우주와 자식이 실제로 쓰는 우주가 다른가. 비어 있는 쪽은 비교하지 않는다. */
+export function universeMismatch(parentRoot: string | undefined, childRoot: string | undefined): { parentRoot: string; childRoot: string } | null {
+  const parent = parentRoot?.trim();
+  const child = childRoot?.trim();
+  if (!parent || !child) return null;
+  const p = normRoot(parent);
+  const c = normRoot(child);
+  return p === c ? null : { parentRoot: p, childRoot: c };
+}
+
+export type UniverseMeasure = { measurable: true } | { measurable: false; reason: '빈 우주' };
+
+/** 읽을 우주가 비어 있으면 «0» 이 아니라 «측정 불가» 로 말해야 한다. 디렉터리가 없거나 항목이 하나도 없으면 빈 우주다. */
+export function measureUniverse(root: string, entries: (dir: string) => string[] = defaultEntries): UniverseMeasure {
+  return entries(root).length > 0 ? { measurable: true } : { measurable: false, reason: '빈 우주' };
+}
+
+function defaultEntries(dir: string): string[] {
+  try {
+    const { readdirSync } = require('node:fs') as typeof import('node:fs');
+    return readdirSync(dir);
+  } catch { return []; }
+}
+
 /** 명시 config-dir 이 없으면 state-dir 과 config-dir 을 같은 우주로 유지한다. */
 export function configDirFollowingStateDir(
   explicitConfigDir: string | undefined,

package/src/instance/spawn-elanous.ts

@@ -0,0 +1,45 @@
+// 자식 elanous 기동의 단일 입구. 우주는 부모가 한 번 정해 ELANOUS_STATE_DIR 도장으로 물려준다.
+import { spawn, spawnSync, type ChildProcess, type SpawnOptions, type SpawnSyncOptions, type SpawnSyncReturns } from 'node:child_process';
+import { resolve } from 'node:path';
+import { stateDirSourceForChild } from '../agent/identity-env.js';
+import { effectiveInstanceRoot } from './resolve.js';
+
+const DEFAULT_BIN = resolve(import.meta.dir, '../../bin/elanous.mjs');
+
+export interface SpawnElanousOptions {
+  /** 자식이 쓸 우주. 생략하면 부모의 effectiveInstanceRoot(). 명시한 값이 이긴다. */
+  stateDir?: string;
+  /** 실행할 elanous 진입 스크립트. 생략하면 이 트리의 bin/elanous.mjs. */
+  bin?: string;
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+}
+
+export interface ElanousInvocation {
+  command: string;
+  args: string[];
+  env: NodeJS.ProcessEnv;
+}
+
+/** 자식 기동 명세를 만든다. env 는 부모 env 위에 우주 도장(뿌리 ⊕ 출처)을 얹은 것이다. */
+export function elanousInvocation(args: readonly string[], opts: SpawnElanousOptions = {}): ElanousInvocation {
+  const root = opts.stateDir?.trim() || effectiveInstanceRoot();
+  const base = opts.env ?? process.env;
+  return {
+    command: process.execPath,
+    args: [opts.bin ?? DEFAULT_BIN, ...args],
+    env: { ...base, ELANOUS_STATE_DIR: root, ELANOUS_STATE_DIR_SOURCE: stateDirSourceForChild(root, base) },
+  };
+}
+
+export function spawnElanous(args: readonly string[], opts: SpawnElanousOptions & Omit<SpawnOptions, 'env' | 'cwd'> = {}): ChildProcess {
+  const { stateDir: _s, bin: _b, env: _e, ...rest } = opts;
+  const inv = elanousInvocation(args, opts);
+  return spawn(inv.command, inv.args, { ...rest, cwd: opts.cwd, env: inv.env });
+}
+
+export function spawnElanousSync(args: readonly string[], opts: SpawnElanousOptions & Omit<SpawnSyncOptions, 'env' | 'cwd'> = {}): SpawnSyncReturns<string | Buffer> {
+  const { stateDir: _s, bin: _b, env: _e, ...rest } = opts;
+  const inv = elanousInvocation(args, opts);
+  return spawnSync(inv.command, inv.args, { ...rest, cwd: opts.cwd, env: inv.env });
+}

package/src/intake-plane/collect-github.ts

@@ -29,6 +29,9 @@ export const DEFAULT_GITHUB_STAR_DAYS = 30;
  */
 export const DEFAULT_GITHUB_STAR_PER_QUERY = 20;
 
+/** 하루당 별 증가 상위 이 개수 행만 README 를 싣고 `surge.score` 를 받는다. */
+const GITHUB_SURGE_TOP = 3;
+
 export interface GithubStarRepo {
   fullName: string;
   url: string;
@@ -223,7 +226,7 @@ export async function collectGithubStars(
   }).sort((a, b) => (b.starsPerDay ?? -Infinity) - (a.starsPerDay ?? -Infinity) || b.stars - a.stars);
   const readmes = new Map<string, string>();
   if (!opts.dryRun) {
-    for (const row of repos.slice(0, 3)) {
+    for (const row of repos.slice(0, GITHUB_SURGE_TOP)) {
       try {
         readmes.set(row.repo, `README:\n${(await (opts.fetchReadme ?? ghApiFetchReadme)(row.repo)).slice(0, 1_500)}`);
       } catch {
@@ -231,7 +234,7 @@ export async function collectGithubStars(
       }
     }
   }
-  const raws: RawIntakeItem[] = repos.map((row) => ({
+  const raws: RawIntakeItem[] = repos.map((row, rank) => ({
     url: row.url,
     title: row.title,
     // 모든 행 첫 줄에 라이선스: SPDX · 확인된 부재는 «없음» · 응답이 알려 주지 않으면 «미상»(없음으로 읽지 않는다).
@@ -240,6 +243,8 @@ export async function collectGithubStars(
       stars: row.stars,
       ...(row.starsDelta !== undefined ? { starsDelta: row.starsDelta } : {}),
       ...(row.starsPerDay !== undefined ? { starsPerDay: row.starsPerDay } : {}),
+      // 급등 상위 3 행(README 를 싣는 그 셋)만 1위 3 · 2위 2 · 3위 1 — pickAbsorbQueue 가 `.score` 로 앞세운다.
+      ...(rank < GITHUB_SURGE_TOP ? { 'surge.score': GITHUB_SURGE_TOP - rank } : {}),
     },
   }));
   const result: CollectGithubResult = {

package/src/intake-plane/lens.ts

@@ -43,8 +43,13 @@ export interface AnnotateIntakeLensResult {
   capped: boolean;
 }
 
+/** 렌즈가 판정하는 갈래 — 하루 상한을 갈래별로 번갈아 나눈다(한 갈래가 많아도 다른 갈래가 0 이 되지 않게). */
+export type LensLane = 'outbox' | 'github' | 'x';
+export const LENS_LANES: readonly LensLane[] = ['outbox', 'github', 'x'];
+
 interface GroupedItem {
   id: string;
+  lane?: LensLane;
   facts: { fact: string; current: string }[];
   url?: string;
 }
@@ -88,7 +93,7 @@ function groupOutbox(root: string, day: string): GroupedItem[] {
       if (!id || !fact) continue;
       let group = groups.get(id);
       if (!group) {
-        group = { id, facts: [] };
+        group = { id, lane: 'outbox', facts: [] };
         groups.set(id, group);
         order.push(id);
       }
@@ -113,12 +118,39 @@ function ledgerLensItems(root: string, day: string, existing: ReadonlySet<string
         .map((fact) => ({ fact, current: '' }));
       if (!facts.length) continue;
       seen.add(item.id);
-      items.push({ id: item.id, facts, url: item.url });
+      items.push({ id: item.id, lane: source, facts, url: item.url });
     }
   }
   return items;
 }
 
+/**
+ * 남은 몫(remaining)을 갈래별로 번갈아 채운다 — 매 칸마다 «이미 판정된 수 ⊕ 이번에 고른 수»가 가장 적은 갈래에서
+ * 하나를 꺼낸다(동점이면 LENS_LANES 순서). 비거나 다 쓴 갈래의 몫은 남은 갈래로 넘어간다. 총량은 remaining 을 넘지 않는다.
+ */
+export function fairLensBatch<T extends { id: string; lane?: LensLane }>(
+  pending: readonly T[],
+  doneByLane: Readonly<Partial<Record<LensLane, number>>>,
+  remaining: number,
+): T[] {
+  const queues = new Map<LensLane, T[]>(LENS_LANES.map((lane) => [lane, []]));
+  for (const item of pending) queues.get(item.lane ?? 'outbox')!.push(item);
+  const used = new Map<LensLane, number>(LENS_LANES.map((lane) => [lane, doneByLane[lane] ?? 0]));
+  const picked = new Set<string>();
+  for (let n = 0; n < remaining; n++) {
+    let best: LensLane | undefined;
+    for (const lane of LENS_LANES) {
+      if (!queues.get(lane)!.length) continue;
+      if (best === undefined || used.get(lane)! < used.get(best)!) best = lane;
+    }
+    if (best === undefined) break;
+    picked.add(queues.get(best)!.shift()!.id);
+    used.set(best, used.get(best)! + 1);
+  }
+  // 원래 순서를 지킨다(흡수 → GitHub → X).
+  return pending.filter((item) => picked.has(item.id));
+}
+
 function judgedIds(file: string): Set<string> {
   return new Set(readJsonl(file).flatMap((row) => typeof row.id === 'string' && row.id ? [row.id] : []));
 }
@@ -171,10 +203,20 @@ export async function annotateIntakeLens(
   const pending = items.filter((item) => !done.has(item.id));
   const remaining = Math.max(0, LENS_DAILY_CAP - done.size);
   const capped = pending.length > remaining;
-  const batch = pending.slice(0, remaining);
+  const doneByLane: Partial<Record<LensLane, number>> = {};
+  for (const item of items) {
+    if (!done.has(item.id)) continue;
+    const lane = item.lane ?? 'outbox';
+    doneByLane[lane] = (doneByLane[lane] ?? 0) + 1;
+  }
+  const batch = capped ? fairLensBatch(pending, doneByLane, remaining) : pending;
   if (capped) {
-    const skippedIds = pending.slice(remaining).map((item) => item.id);
+    const chosen = new Set(batch.map((item) => item.id));
+    const skippedIds = pending.filter((item) => !chosen.has(item.id)).map((item) => item.id);
+    const byLane = (list: readonly GroupedItem[]) => Object.fromEntries(LENS_LANES.map((lane) =>
+      [lane, list.filter((item) => (item.lane ?? 'outbox') === lane).length]));
     log('capped', { day, total: pending.length, judged: batch.length, skippedIds,
+      pendingByLane: byLane(pending), judgedByLane: byLane(batch), doneByLane,
       ...(skippedIds.length ? { marker: `외 ${skippedIds.length}건 · 원장 \`elanous intake items\`` } : {}) });
   }
   const judgeOne = deps.judge ?? ((input: LensJudgeInput) => defaultJudge(input));

package/src/intake-plane/ref-prefetch.ts

@@ -0,0 +1,110 @@
+import type { RegisteredIntakeSource } from './intake-sources.js';
+
+/** listChecklist(v).items 꼴 — 호출 쪽이 다음 두 판 칸을 모아 넘긴다. */
+export interface PrefetchCell {
+  id: string;
+  title: string;
+  status: string;
+  refs?: readonly string[];
+  /** 그 판 날짜(YYYY-MM-DD). 주제 until 로 실린다. */
+  until?: string;
+}
+
+export interface PrefetchTopic {
+  topic: string;
+  cellIds: string[];
+  until?: string;
+}
+
+export interface PrefetchTopicsOpts {
+  max?: number;
+}
+
+/**
+ * 의도적 경계: 이 파일은 제안만 만든다. intake CLI `prefetch --dry-run|--apply` 와
+ * REQ-LEDGER 테마 원천 교체는 다음 조각 — addSource · CLI 를 부르지 않는다.
+ */
+function backtickTokens(title: string): string[] {
+  const tokens: string[] = [];
+  const re = /`([^`]+)`/g;
+  for (let match = re.exec(title); match; match = re.exec(title)) {
+    const token = match[1]!.trim();
+    if (token) tokens.push(token);
+  }
+  return tokens;
+}
+
+function englishProperNouns(title: string): string[] {
+  const stripped = title.replace(/`[^`]*`/g, ' ');
+  const tokens: string[] = [];
+  // CamelCase · 내부 대문자 식별자, 또는 2글자 이상 대문자(하이픈 칸 id 포함).
+  const re = /\b(?:[A-Z][A-Za-z0-9]*[A-Z][A-Za-z0-9]*|[A-Z]{2,}(?:-[A-Z0-9]+)*)\b/g;
+  for (let match = re.exec(stripped); match; match = re.exec(stripped)) tokens.push(match[0]);
+  return tokens;
+}
+
+function rfcNames(refs: readonly string[] | undefined): string[] {
+  if (!refs) return [];
+  const names: string[] = [];
+  for (const ref of refs) {
+    const file = (ref.split('#')[0] ?? '').split('/').pop() ?? '';
+    const stem = file.replace(/\.[A-Za-z0-9]+$/, '').replace(/-\d{4}-\d{2}-\d{2}$/, '');
+    if (stem.startsWith('RFC-') && stem.length > 4) names.push(stem);
+  }
+  return names;
+}
+
+function laterDate(a: string | undefined, b: string | undefined): string | undefined {
+  if (!a) return b;
+  if (!b) return a;
+  return a >= b ? a : b;
+}
+
+function sourceId(topic: string): string {
+  const slug = topic.replace(/[^\w.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 48);
+  return `ref-prefetch-${slug || 'topic'}`;
+}
+
+export function prefetchTopics(cells: readonly PrefetchCell[], opts: PrefetchTopicsOpts = {}): PrefetchTopic[] {
+  const max = opts.max ?? 5;
+  const byTopic = new Map<string, { topic: string; count: number; cellIds: string[]; until?: string }>();
+  const order: string[] = [];
+  for (const cell of cells) {
+    if (cell.status !== 'yellow') continue;
+    const tokens = new Set([
+      ...englishProperNouns(cell.title),
+      ...backtickTokens(cell.title),
+      ...rfcNames(cell.refs),
+    ]);
+    for (const topic of tokens) {
+      let acc = byTopic.get(topic);
+      if (!acc) {
+        acc = { topic, count: 0, cellIds: [], until: cell.until };
+        byTopic.set(topic, acc);
+        order.push(topic);
+      }
+      acc.count++;
+      if (!acc.cellIds.includes(cell.id)) acc.cellIds.push(cell.id);
+      acc.until = laterDate(acc.until, cell.until);
+    }
+  }
+  return order
+    .map((topic) => byTopic.get(topic)!)
+    .sort((a, b) => b.count - a.count || order.indexOf(a.topic) - order.indexOf(b.topic))
+    .slice(0, Math.max(0, max))
+    .map(({ topic, cellIds, until }) => until === undefined ? { topic, cellIds } : { topic, cellIds, until });
+}
+
+export function prefetchSources(topics: readonly PrefetchTopic[], seat: string, now: Date): RegisteredIntakeSource[] {
+  // 판 날짜를 모르면 until 을 비운다 — now 로 채우면 untilMs(그날 00:00Z) 기준으로 이미 만료된 제안이 된다.
+  void now;
+  return topics.map((entry) => ({
+    id: sourceId(entry.topic),
+    seat,
+    kind: 'github-query',
+    spec: entry.topic,
+    every: '1d',
+    ...(entry.until === undefined ? {} : { until: entry.until }),
+    why: `REF-PREFETCH ⊕ ${entry.cellIds.join(' ')}`,
+  }));
+}

package/src/intake-plane/requirement-funnel.ts

@@ -12,6 +12,7 @@ import { getUserConfig } from '../user-config.js';
 import { dateKey } from '../time/format.js';
 import { cardIndexPath, CardStore, type TaskCard } from '../task-cards/card-store.js';
 import { loadIntakeLedger, type IntakeItem } from './items.js';
+import { RequirementLedger } from '../requirements/requirement-ledger.js';
 import { parseRubric, rubricGrade, rubricScore } from '../release-loop/rubric.js';
 
 export type RequirementSource = 'directive' | 'intake' | 'grounding' | 'coordination' | 'linear';
@@ -67,6 +68,8 @@ export interface FunnelOptions {
   allowedLicenses?: readonly string[];
   placement?: PlacementDeps;
   adopt?: (candidate: RequirementCandidate, version: string, cellId: string, evidence: string) => void;
+  /** REQ-INTAKE-ALL (0.2.25) piece 1: REQ-LEDGER side-record — every candidate captured once (idempotent on candidate id); adopted decisions fold to `placed`. */
+  ledger?: RequirementLedger;
 }
 
 /** How many of the last 24 hours' unlinked directives the single P0 brief line names (the full backlog is one count). */
@@ -170,6 +173,15 @@ export function runRequirementFunnel(options: FunnelOptions): RequirementFunnelR
       cellId, version: placement.version, rubric });
     if (!isDirective) used++;
   }
+  // REQ-INTAKE-ALL (0.2.25) piece 1: record every funnel candidate into the REQ-LEDGER side-ledger
+  // (idempotent on candidate id). The ledger is a side-record — a capture failure must not change the
+  // funnel result or any other command's default behavior (preservation contract).
+  if (options.ledger) {
+    try { captureFunnelCandidates(decisions, options.ledger); }
+    catch (error) {
+      debug.log('intake.requirement-funnel', 'ledger-capture-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+  }
   const unlinkedDirectives = [...directiveCandidates(options.historicalDirectives ?? []).filter(candidate =>
     candidate.text && Number.isFinite(Date.parse(candidate.receivedAt)) && Date.parse(candidate.receivedAt) <= now.getTime()
     && !linkFor(candidate, cells) && !arrivals.some(arrival => arrival.id === candidate.id)),
@@ -202,7 +214,46 @@ export function runRequirementFunnel(options: FunnelOptions): RequirementFunnelR
   return { counts, candidates: groups.size, decisions, unlinkedDirectives, briefItems };
 }
 
-/** Existing ledgers only; no source collector or sender is started here. */
+/**
+ * REQ-INTAKE-ALL (0.2.25) piece 1 — record the funnel's five entrances (directive · intake · grounding ·
+ * coordination · linear) into the REQ-LEDGER. Each decision captures one row per candidate (its `sources`
+ * members) with status `captured`, kind fixed to `fr`, source {kind, at: receivedAt}, statement = one-line
+ * text and tags = [priority] (the funnel's own P1 default when the candidate carries none). Idempotent on
+ * candidate id — re-running adds no rows. Adopted decisions fold their rows to `placed`. Per source with
+ * fresh rows it emits debug.log('requirements.intake', 'captured', {source, count}). Ledger validation
+ * (secret-shape rejection, allowlist) stays REQ-LEDGER's share; kind classification (REQ-KINDS) is a later
+ * piece — kind is fixed to `fr` here.
+ */
+export function captureFunnelCandidates(candidates: readonly RequirementDecision[], ledger: RequirementLedger): void {
+  const statuses = new Map(ledger.list().map(row => [row.id, row.status] as const));
+  const fresh = new Map<RequirementSource, number>();
+  for (const decision of candidates) {
+    for (const candidate of decision.sources) {
+      if (statuses.has(candidate.id)) continue;
+      // One bad candidate (secret-shaped text · unparseable time) must not stop the rest of the capture.
+      try {
+        const at = new Date(candidate.receivedAt).toISOString(); // ledger takes UTC `…Z` only; sources may carry offsets
+        ledger.capture({ id: candidate.id, statement: oneLine(candidate.text), kind: 'fr',
+          source: { kind: candidate.source, at }, tags: [candidate.priority ?? 'P1'] });
+      } catch (error) {
+        debug.log('intake.requirement-funnel', 'ledger-capture-failed', { id: candidate.id, source: candidate.source,
+          error: error instanceof Error ? error.message : String(error) });
+        continue;
+      }
+      statuses.set(candidate.id, 'captured');
+      fresh.set(candidate.source, (fresh.get(candidate.source) ?? 0) + 1);
+    }
+    if (decision.status !== 'adopted') continue;
+    for (const candidate of decision.sources) {
+      if (statuses.get(candidate.id) !== 'captured') continue;
+      ledger.place(candidate.id);
+      statuses.set(candidate.id, 'placed');
+    }
+  }
+  for (const [source, count] of fresh) debug.log('requirements.intake', 'captured', { source, count });
+}
+
+/** Existing ledgers only; no source collector or sender is started here. Side effect: captures every candidate into this universe's REQ-LEDGER (REQ-INTAKE-ALL). */
 export function readRequirementFunnel(options: { stateDir?: string; now?: Date; mode?: 'shadow' | 'live'; dailyCap?: number;
   allowedLicenses?: readonly string[]; grounding?: readonly IncomingRequirement[]; coordination?: readonly IncomingRequirement[];
   linear?: readonly IncomingRequirement[]; placement?: PlacementDeps } = {}): RequirementFunnelResult {
@@ -276,6 +327,7 @@ export function readRequirementFunnel(options: { stateDir?: string; now?: Date;
     grounding: today(options.grounding ?? fromQueue('outbox/grounding.jsonl')),
     coordination: today(options.coordination ?? cardRequests.coordination), linear: today(options.linear ?? cardRequests.linear) }, historicalDirectives, cells, now, mode,
     dailyCap, adoptedToday: todayCount, allowedLicenses, placement: { ...options.placement, schedules },
+    ledger: new RequirementLedger({ stateDir }),
     adopt: (candidate, version, cellId, evidence) => {
       placeCell({ id: cellId, title: candidate.text, owner: candidate.owner ?? 'OP', priority: candidate.priority ?? 'P1',
         predecessors: [], ...(candidate.deadlineVersion ? { deadlineVersion: candidate.deadlineVersion } : {}) }, { ...options.placement, now, schedules });

package/src/intelligence-map/catalog-feed.ts

@@ -0,0 +1,119 @@
+// ── MK · 0.2.26 칸 CATALOG-FEED — signed catalog feed ──────────────────
+//
+// Folds a ModelCatalog into a verifiable feed document and verifies it on
+// the receiving side:
+//   buildCatalogFeed  — canonicalize (models sorted by id, stable-key JSON)
+//                       + sha256 content digest.
+//   signCatalogFeed   — ed25519 signature over the feed document (base64).
+//   verifyCatalogFeed — reject tampered / forged feeds with a reason.
+//
+// Design = 내부 문서 `RFC-smart-model-routing-and-catalog-2026-10-10` §판올림=카탈로그 동봉.
+// This piece is the judgment only — key generation/holding, the daily
+// publish cron, and fetching are the next slice.
+//
+// 🔎 세 얼굴 — 관측: verify 거부는 debug.log('intelligence-map.catalog-feed',
+// 'verify-rejected', { reason }) 로 남는다. 판단 근거: digest 는 «정렬·키 고정
+// JSON» 의 sha256 hex 라 서명과 무관하게 내용 변조를 가른다. 수복·인계: 거부
+// 사유가 'digest-mismatch' 면 서명 키는 맞고 «내용»이 바뀌었다 — 발행 측 카탈로그를
+// 다시 잰다; 'bad-signature' 면 키가 다르다.
+
+import { createHash, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
+import { debug } from '../debug/log.js';
+import type { ModelCatalog, ModelEntry } from './types.js';
+
+export interface CatalogFeed {
+  schema: 'elanous.catalog-feed/1';
+  issuedAt: string;
+  models: ModelEntry[];
+  digest: string;
+}
+
+export interface SignedCatalogFeed {
+  feed: CatalogFeed;
+  signature: string;
+}
+
+export type CatalogFeedVerifyResult =
+  | { ok: true; feed: CatalogFeed }
+  | { ok: false; reason: 'bad-signature' | 'digest-mismatch' | 'schema' };
+
+/** Canonical JSON — sorted object keys, deterministic spacing. Arrays keep
+ *  order; `models` is sorted by `id` before this is applied. */
+function canonicalJson(value: unknown): string {
+  // undefined follows JSON.stringify: dropped as an object key, null in an
+  // array — so a feed survives a JSON round trip with the same digest.
+  if (value === undefined) return 'null';
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  const obj = value as Record<string, unknown>;
+  const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(',')}}`;
+}
+
+/** sha256 hex of the canonical (sorted, key-stable) JSON of the feed. */
+function feedDigest(feed: Omit<CatalogFeed, 'digest'>): string {
+  return createHash('sha256').update(canonicalJson(feed)).digest('hex');
+}
+
+/** Fold a catalog into a signed-feed-ready document. `models` is sorted by
+ *  id so byte-identical catalogs always produce the same digest. */
+export function buildCatalogFeed(catalog: ModelCatalog, issuedAt: Date): CatalogFeed {
+  const models = [...catalog.models].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  const base = {
+    schema: 'elanous.catalog-feed/1' as const,
+    issuedAt: issuedAt.toISOString(),
+    models,
+  };
+  return { ...base, digest: feedDigest(base) };
+}
+
+/** Sign the feed document (whole feed, digest included) with an ed25519
+ *  private key (PEM). Signature is base64 over the canonical JSON of the
+ *  feed. */
+export function signCatalogFeed(
+  feed: CatalogFeed,
+  privateKeyPem: string,
+): { feed: CatalogFeed; signature: string } {
+  const signature = cryptoSign(null, Buffer.from(canonicalJson(feed)), privateKeyPem).toString('base64');
+  return { feed, signature };
+}
+
+/** Verify a signed feed: schema → content digest (recomputed, catches
+ *  tampering that keeps the original digest) → signature. Rejected feeds
+ *  are logged (제1원칙 관측) so the receiver's self-cognition can see why a
+ *  feed was refused. */
+export function verifyCatalogFeed(signed: SignedCatalogFeed, publicKeyPem: string): CatalogFeedVerifyResult {
+  if (signed === null || typeof signed !== 'object') return reject('schema');
+  const { feed, signature } = signed;
+  if (feed === null || typeof feed !== 'object' || feed.schema !== 'elanous.catalog-feed/1' || typeof feed.issuedAt !== 'string' || !Array.isArray(feed.models)
+    || typeof feed.digest !== 'string' || typeof signature !== 'string' || !feed.models.every(isModelEntryShape)) {
+    return reject('schema');
+  }
+  const { digest: _digest, ...body } = feed;
+  if (feedDigest(body) !== feed.digest) return reject('digest-mismatch');
+  let sigOk = false;
+  try {
+    sigOk = cryptoVerify(null, Buffer.from(canonicalJson(feed)), publicKeyPem, Buffer.from(signature, 'base64'));
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) return reject('bad-signature');
+  return { ok: true, feed };
+}
+
+/** Required ModelEntry fields at the receiving boundary — a signed feed with
+ *  a model missing any of these is a schema failure, not a usable catalog. */
+function isModelEntryShape(m: unknown): boolean {
+  if (m === null || typeof m !== 'object') return false;
+  const e = m as Record<string, unknown>;
+  const finite = (v: unknown) => typeof v === 'number' && Number.isFinite(v);
+  const strings = (v: unknown) => Array.isArray(v) && v.every((x) => typeof x === 'string');
+  return typeof e.id === 'string' && e.id.length > 0 && typeof e.provider === 'string' && typeof e.family === 'string'
+    && finite(e.contextWindow) && finite(e.inputPerMtok) && finite(e.outputPerMtok)
+    && typeof e.local === 'boolean' && strings(e.tags) && strings(e.bestFor);
+}
+
+function reject(reason: 'bad-signature' | 'digest-mismatch' | 'schema'): { ok: false; reason: typeof reason } {
+  debug.log('intelligence-map.catalog-feed', 'verify-rejected', { reason });
+  return { ok: false, reason };
+}