elanous 0.2.24 → 0.2.25

package/src/intake-plane/lens.ts

@@ -43,8 +43,13 @@ export interface AnnotateIntakeLensResult {
   capped: boolean;
 }
 
+/** 렌즈가 판정하는 갈래 — 하루 상한을 갈래별로 번갈아 나눈다(한 갈래가 많아도 다른 갈래가 0 이 되지 않게). */
+export type LensLane = 'outbox' | 'github' | 'x';
+export const LENS_LANES: readonly LensLane[] = ['outbox', 'github', 'x'];
+
 interface GroupedItem {
   id: string;
+  lane?: LensLane;
   facts: { fact: string; current: string }[];
   url?: string;
 }
@@ -88,7 +93,7 @@ function groupOutbox(root: string, day: string): GroupedItem[] {
       if (!id || !fact) continue;
       let group = groups.get(id);
       if (!group) {
-        group = { id, facts: [] };
+        group = { id, lane: 'outbox', facts: [] };
         groups.set(id, group);
         order.push(id);
       }
@@ -113,12 +118,39 @@ function ledgerLensItems(root: string, day: string, existing: ReadonlySet<string
         .map((fact) => ({ fact, current: '' }));
       if (!facts.length) continue;
       seen.add(item.id);
-      items.push({ id: item.id, facts, url: item.url });
+      items.push({ id: item.id, lane: source, facts, url: item.url });
     }
   }
   return items;
 }
 
+/**
+ * 남은 몫(remaining)을 갈래별로 번갈아 채운다 — 매 칸마다 «이미 판정된 수 ⊕ 이번에 고른 수»가 가장 적은 갈래에서
+ * 하나를 꺼낸다(동점이면 LENS_LANES 순서). 비거나 다 쓴 갈래의 몫은 남은 갈래로 넘어간다. 총량은 remaining 을 넘지 않는다.
+ */
+export function fairLensBatch<T extends { id: string; lane?: LensLane }>(
+  pending: readonly T[],
+  doneByLane: Readonly<Partial<Record<LensLane, number>>>,
+  remaining: number,
+): T[] {
+  const queues = new Map<LensLane, T[]>(LENS_LANES.map((lane) => [lane, []]));
+  for (const item of pending) queues.get(item.lane ?? 'outbox')!.push(item);
+  const used = new Map<LensLane, number>(LENS_LANES.map((lane) => [lane, doneByLane[lane] ?? 0]));
+  const picked = new Set<string>();
+  for (let n = 0; n < remaining; n++) {
+    let best: LensLane | undefined;
+    for (const lane of LENS_LANES) {
+      if (!queues.get(lane)!.length) continue;
+      if (best === undefined || used.get(lane)! < used.get(best)!) best = lane;
+    }
+    if (best === undefined) break;
+    picked.add(queues.get(best)!.shift()!.id);
+    used.set(best, used.get(best)! + 1);
+  }
+  // 원래 순서를 지킨다(흡수 → GitHub → X).
+  return pending.filter((item) => picked.has(item.id));
+}
+
 function judgedIds(file: string): Set<string> {
   return new Set(readJsonl(file).flatMap((row) => typeof row.id === 'string' && row.id ? [row.id] : []));
 }
@@ -171,10 +203,20 @@ export async function annotateIntakeLens(
   const pending = items.filter((item) => !done.has(item.id));
   const remaining = Math.max(0, LENS_DAILY_CAP - done.size);
   const capped = pending.length > remaining;
-  const batch = pending.slice(0, remaining);
+  const doneByLane: Partial<Record<LensLane, number>> = {};
+  for (const item of items) {
+    if (!done.has(item.id)) continue;
+    const lane = item.lane ?? 'outbox';
+    doneByLane[lane] = (doneByLane[lane] ?? 0) + 1;
+  }
+  const batch = capped ? fairLensBatch(pending, doneByLane, remaining) : pending;
   if (capped) {
-    const skippedIds = pending.slice(remaining).map((item) => item.id);
+    const chosen = new Set(batch.map((item) => item.id));
+    const skippedIds = pending.filter((item) => !chosen.has(item.id)).map((item) => item.id);
+    const byLane = (list: readonly GroupedItem[]) => Object.fromEntries(LENS_LANES.map((lane) =>
+      [lane, list.filter((item) => (item.lane ?? 'outbox') === lane).length]));
     log('capped', { day, total: pending.length, judged: batch.length, skippedIds,
+      pendingByLane: byLane(pending), judgedByLane: byLane(batch), doneByLane,
       ...(skippedIds.length ? { marker: `외 ${skippedIds.length}건 · 원장 \`elanous intake items\`` } : {}) });
   }
   const judgeOne = deps.judge ?? ((input: LensJudgeInput) => defaultJudge(input));

package/src/intake-plane/requirement-funnel.ts

@@ -12,6 +12,7 @@ import { getUserConfig } from '../user-config.js';
 import { dateKey } from '../time/format.js';
 import { cardIndexPath, CardStore, type TaskCard } from '../task-cards/card-store.js';
 import { loadIntakeLedger, type IntakeItem } from './items.js';
+import { RequirementLedger } from '../requirements/requirement-ledger.js';
 import { parseRubric, rubricGrade, rubricScore } from '../release-loop/rubric.js';
 
 export type RequirementSource = 'directive' | 'intake' | 'grounding' | 'coordination' | 'linear';
@@ -67,6 +68,8 @@ export interface FunnelOptions {
   allowedLicenses?: readonly string[];
   placement?: PlacementDeps;
   adopt?: (candidate: RequirementCandidate, version: string, cellId: string, evidence: string) => void;
+  /** REQ-INTAKE-ALL (0.2.25) piece 1: REQ-LEDGER side-record — every candidate captured once (idempotent on candidate id); adopted decisions fold to `placed`. */
+  ledger?: RequirementLedger;
 }
 
 /** How many of the last 24 hours' unlinked directives the single P0 brief line names (the full backlog is one count). */
@@ -170,6 +173,15 @@ export function runRequirementFunnel(options: FunnelOptions): RequirementFunnelR
       cellId, version: placement.version, rubric });
     if (!isDirective) used++;
   }
+  // REQ-INTAKE-ALL (0.2.25) piece 1: record every funnel candidate into the REQ-LEDGER side-ledger
+  // (idempotent on candidate id). The ledger is a side-record — a capture failure must not change the
+  // funnel result or any other command's default behavior (preservation contract).
+  if (options.ledger) {
+    try { captureFunnelCandidates(decisions, options.ledger); }
+    catch (error) {
+      debug.log('intake.requirement-funnel', 'ledger-capture-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+  }
   const unlinkedDirectives = [...directiveCandidates(options.historicalDirectives ?? []).filter(candidate =>
     candidate.text && Number.isFinite(Date.parse(candidate.receivedAt)) && Date.parse(candidate.receivedAt) <= now.getTime()
     && !linkFor(candidate, cells) && !arrivals.some(arrival => arrival.id === candidate.id)),
@@ -202,7 +214,46 @@ export function runRequirementFunnel(options: FunnelOptions): RequirementFunnelR
   return { counts, candidates: groups.size, decisions, unlinkedDirectives, briefItems };
 }
 
-/** Existing ledgers only; no source collector or sender is started here. */
+/**
+ * REQ-INTAKE-ALL (0.2.25) piece 1 — record the funnel's five entrances (directive · intake · grounding ·
+ * coordination · linear) into the REQ-LEDGER. Each decision captures one row per candidate (its `sources`
+ * members) with status `captured`, kind fixed to `fr`, source {kind, at: receivedAt}, statement = one-line
+ * text and tags = [priority] (the funnel's own P1 default when the candidate carries none). Idempotent on
+ * candidate id — re-running adds no rows. Adopted decisions fold their rows to `placed`. Per source with
+ * fresh rows it emits debug.log('requirements.intake', 'captured', {source, count}). Ledger validation
+ * (secret-shape rejection, allowlist) stays REQ-LEDGER's share; kind classification (REQ-KINDS) is a later
+ * piece — kind is fixed to `fr` here.
+ */
+export function captureFunnelCandidates(candidates: readonly RequirementDecision[], ledger: RequirementLedger): void {
+  const statuses = new Map(ledger.list().map(row => [row.id, row.status] as const));
+  const fresh = new Map<RequirementSource, number>();
+  for (const decision of candidates) {
+    for (const candidate of decision.sources) {
+      if (statuses.has(candidate.id)) continue;
+      // One bad candidate (secret-shaped text · unparseable time) must not stop the rest of the capture.
+      try {
+        const at = new Date(candidate.receivedAt).toISOString(); // ledger takes UTC `…Z` only; sources may carry offsets
+        ledger.capture({ id: candidate.id, statement: oneLine(candidate.text), kind: 'fr',
+          source: { kind: candidate.source, at }, tags: [candidate.priority ?? 'P1'] });
+      } catch (error) {
+        debug.log('intake.requirement-funnel', 'ledger-capture-failed', { id: candidate.id, source: candidate.source,
+          error: error instanceof Error ? error.message : String(error) });
+        continue;
+      }
+      statuses.set(candidate.id, 'captured');
+      fresh.set(candidate.source, (fresh.get(candidate.source) ?? 0) + 1);
+    }
+    if (decision.status !== 'adopted') continue;
+    for (const candidate of decision.sources) {
+      if (statuses.get(candidate.id) !== 'captured') continue;
+      ledger.place(candidate.id);
+      statuses.set(candidate.id, 'placed');
+    }
+  }
+  for (const [source, count] of fresh) debug.log('requirements.intake', 'captured', { source, count });
+}
+
+/** Existing ledgers only; no source collector or sender is started here. Side effect: captures every candidate into this universe's REQ-LEDGER (REQ-INTAKE-ALL). */
 export function readRequirementFunnel(options: { stateDir?: string; now?: Date; mode?: 'shadow' | 'live'; dailyCap?: number;
   allowedLicenses?: readonly string[]; grounding?: readonly IncomingRequirement[]; coordination?: readonly IncomingRequirement[];
   linear?: readonly IncomingRequirement[]; placement?: PlacementDeps } = {}): RequirementFunnelResult {
@@ -276,6 +327,7 @@ export function readRequirementFunnel(options: { stateDir?: string; now?: Date;
     grounding: today(options.grounding ?? fromQueue('outbox/grounding.jsonl')),
     coordination: today(options.coordination ?? cardRequests.coordination), linear: today(options.linear ?? cardRequests.linear) }, historicalDirectives, cells, now, mode,
     dailyCap, adoptedToday: todayCount, allowedLicenses, placement: { ...options.placement, schedules },
+    ledger: new RequirementLedger({ stateDir }),
     adopt: (candidate, version, cellId, evidence) => {
       placeCell({ id: cellId, title: candidate.text, owner: candidate.owner ?? 'OP', priority: candidate.priority ?? 'P1',
         predecessors: [], ...(candidate.deadlineVersion ? { deadlineVersion: candidate.deadlineVersion } : {}) }, { ...options.placement, now, schedules });

package/src/intelligence-map/catalog-feed.ts

@@ -0,0 +1,119 @@
+// ── MK · 0.2.26 칸 CATALOG-FEED — signed catalog feed ──────────────────
+//
+// Folds a ModelCatalog into a verifiable feed document and verifies it on
+// the receiving side:
+//   buildCatalogFeed  — canonicalize (models sorted by id, stable-key JSON)
+//                       + sha256 content digest.
+//   signCatalogFeed   — ed25519 signature over the feed document (base64).
+//   verifyCatalogFeed — reject tampered / forged feeds with a reason.
+//
+// Design = 내부 문서 `RFC-smart-model-routing-and-catalog-2026-10-10` §판올림=카탈로그 동봉.
+// This piece is the judgment only — key generation/holding, the daily
+// publish cron, and fetching are the next slice.
+//
+// 🔎 세 얼굴 — 관측: verify 거부는 debug.log('intelligence-map.catalog-feed',
+// 'verify-rejected', { reason }) 로 남는다. 판단 근거: digest 는 «정렬·키 고정
+// JSON» 의 sha256 hex 라 서명과 무관하게 내용 변조를 가른다. 수복·인계: 거부
+// 사유가 'digest-mismatch' 면 서명 키는 맞고 «내용»이 바뀌었다 — 발행 측 카탈로그를
+// 다시 잰다; 'bad-signature' 면 키가 다르다.
+
+import { createHash, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
+import { debug } from '../debug/log.js';
+import type { ModelCatalog, ModelEntry } from './types.js';
+
+export interface CatalogFeed {
+  schema: 'elanous.catalog-feed/1';
+  issuedAt: string;
+  models: ModelEntry[];
+  digest: string;
+}
+
+export interface SignedCatalogFeed {
+  feed: CatalogFeed;
+  signature: string;
+}
+
+export type CatalogFeedVerifyResult =
+  | { ok: true; feed: CatalogFeed }
+  | { ok: false; reason: 'bad-signature' | 'digest-mismatch' | 'schema' };
+
+/** Canonical JSON — sorted object keys, deterministic spacing. Arrays keep
+ *  order; `models` is sorted by `id` before this is applied. */
+function canonicalJson(value: unknown): string {
+  // undefined follows JSON.stringify: dropped as an object key, null in an
+  // array — so a feed survives a JSON round trip with the same digest.
+  if (value === undefined) return 'null';
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  const obj = value as Record<string, unknown>;
+  const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(',')}}`;
+}
+
+/** sha256 hex of the canonical (sorted, key-stable) JSON of the feed. */
+function feedDigest(feed: Omit<CatalogFeed, 'digest'>): string {
+  return createHash('sha256').update(canonicalJson(feed)).digest('hex');
+}
+
+/** Fold a catalog into a signed-feed-ready document. `models` is sorted by
+ *  id so byte-identical catalogs always produce the same digest. */
+export function buildCatalogFeed(catalog: ModelCatalog, issuedAt: Date): CatalogFeed {
+  const models = [...catalog.models].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  const base = {
+    schema: 'elanous.catalog-feed/1' as const,
+    issuedAt: issuedAt.toISOString(),
+    models,
+  };
+  return { ...base, digest: feedDigest(base) };
+}
+
+/** Sign the feed document (whole feed, digest included) with an ed25519
+ *  private key (PEM). Signature is base64 over the canonical JSON of the
+ *  feed. */
+export function signCatalogFeed(
+  feed: CatalogFeed,
+  privateKeyPem: string,
+): { feed: CatalogFeed; signature: string } {
+  const signature = cryptoSign(null, Buffer.from(canonicalJson(feed)), privateKeyPem).toString('base64');
+  return { feed, signature };
+}
+
+/** Verify a signed feed: schema → content digest (recomputed, catches
+ *  tampering that keeps the original digest) → signature. Rejected feeds
+ *  are logged (제1원칙 관측) so the receiver's self-cognition can see why a
+ *  feed was refused. */
+export function verifyCatalogFeed(signed: SignedCatalogFeed, publicKeyPem: string): CatalogFeedVerifyResult {
+  if (signed === null || typeof signed !== 'object') return reject('schema');
+  const { feed, signature } = signed;
+  if (feed === null || typeof feed !== 'object' || feed.schema !== 'elanous.catalog-feed/1' || typeof feed.issuedAt !== 'string' || !Array.isArray(feed.models)
+    || typeof feed.digest !== 'string' || typeof signature !== 'string' || !feed.models.every(isModelEntryShape)) {
+    return reject('schema');
+  }
+  const { digest: _digest, ...body } = feed;
+  if (feedDigest(body) !== feed.digest) return reject('digest-mismatch');
+  let sigOk = false;
+  try {
+    sigOk = cryptoVerify(null, Buffer.from(canonicalJson(feed)), publicKeyPem, Buffer.from(signature, 'base64'));
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) return reject('bad-signature');
+  return { ok: true, feed };
+}
+
+/** Required ModelEntry fields at the receiving boundary — a signed feed with
+ *  a model missing any of these is a schema failure, not a usable catalog. */
+function isModelEntryShape(m: unknown): boolean {
+  if (m === null || typeof m !== 'object') return false;
+  const e = m as Record<string, unknown>;
+  const finite = (v: unknown) => typeof v === 'number' && Number.isFinite(v);
+  const strings = (v: unknown) => Array.isArray(v) && v.every((x) => typeof x === 'string');
+  return typeof e.id === 'string' && e.id.length > 0 && typeof e.provider === 'string' && typeof e.family === 'string'
+    && finite(e.contextWindow) && finite(e.inputPerMtok) && finite(e.outputPerMtok)
+    && typeof e.local === 'boolean' && strings(e.tags) && strings(e.bestFor);
+}
+
+function reject(reason: 'bad-signature' | 'digest-mismatch' | 'schema'): { ok: false; reason: typeof reason } {
+  debug.log('intelligence-map.catalog-feed', 'verify-rejected', { reason });
+  return { ok: false, reason };
+}

package/src/intelligence-map/model-watch-intake.ts

@@ -103,6 +103,46 @@ export async function runModelWatchIntake(
   return { candidates, proposal, perSource };
 }
 
+export type PriceField = 'inputPerMtok' | 'outputPerMtok';
+
+export interface PriceChange {
+  id: string;
+  field: PriceField;
+  /** Price currently in the catalog (USD per 1M tokens). */
+  before: number;
+  /** Price the watched page reports. */
+  after: number;
+}
+
+const PRICE_FIELDS: readonly PriceField[] = ['inputPerMtok', 'outputPerMtok'];
+
+/** Price differences between the catalog and the watched pages. The merge
+ *  only fills undefined fields, so a repriced model shows up in
+ *  `proposal.updated` with no trace of the new price — this reports it.
+ *  A catalog price of 0 means "not priced yet" and is not a change. */
+export function detectPriceChanges(result: Pick<WatchIntakeResult, 'candidates' | 'proposal'>): PriceChange[] {
+  const current = new Map(result.proposal.catalog.models.map((model) => [model.id, model]));
+  const updated = new Set(result.proposal.updated);
+  const changes: PriceChange[] = [];
+  for (const candidate of result.candidates) {
+    const entry = current.get(candidate.id);
+    if (!entry || !updated.has(candidate.id)) continue;
+    for (const field of PRICE_FIELDS) {
+      const before = entry[field];
+      const after = candidate[field];
+      if (typeof after !== 'number' || !Number.isFinite(after) || after < 0) continue;
+      if (typeof before !== 'number' || before <= 0 || before === after) continue;
+      changes.push({ id: candidate.id, field, before, after });
+    }
+  }
+  return changes;
+}
+
+export function formatPriceChange(change: PriceChange): string {
+  const label = change.field === 'inputPerMtok' ? 'input' : 'output';
+  return `${change.id} ${label} $${change.before}→$${change.after} /Mtok`;
+}
+
 function errorMessage(error: unknown): string {
   try {
     const message = error instanceof Error ? error.message : String(error);

package/src/intelligence-map/model-watch-mission.ts

@@ -21,7 +21,13 @@ import { lookupLlmTierSpec } from '../model-tier/index.js';
 import type { LlmRunner } from '../model-tier/preset-suggest-llm.js';
 import type { LLMProviderName } from '../user-config.js';
 import { getUserConfig } from '../user-config.js';
-import { runModelWatchIntake, type WatchIntakeResult, type WatchPage } from './model-watch-intake.js';
+import {
+  detectPriceChanges,
+  formatPriceChange,
+  runModelWatchIntake,
+  type WatchIntakeResult,
+  type WatchPage,
+} from './model-watch-intake.js';
 
 export function getModelWatchProposalPath(home: string = homedir()): string {
   return join(home, '.elanous', 'model-watch-proposals.jsonl');
@@ -93,6 +99,13 @@ export async function runModelIntelligenceWatch(
       line: `Classification incomplete for zero-candidate sources: ${abnormalEmptySources.join(', ')}`,
     });
   }
+  const priceChanges = detectPriceChanges(result);
+  if (priceChanges.length > 0) {
+    await safeLog(log, 'intelligence-map.model-watch', 'price-changes', {
+      changes: priceChanges,
+      line: `Price changes vs catalog: ${priceChanges.map(formatPriceChange).join('; ')}`,
+    });
+  }
   await safeLog(log, 'intelligence-map.model-watch', 'pass', {
     pages: pages.length,
     candidates: result.candidates.length,

package/src/llm/open-weight-discipline.ts

@@ -0,0 +1,21 @@
+/** OpenRouter(`openrouter/…`) GLM·Kimi·Qwen 전용 도구 호출 규율 — 다른 군 상수와 합성하지 않는 독립 상수.
+ *
+ *  2026-10-11 GLM-PROMPT-TUNE 첫 조각: `llm.ts` 동결(RFC #25983)을 위해 상수를 이 파일로 옮겼다.
+ *  줄 둘을 추가했다 — 실측 약점 둘을 겨냥한다:
+ *    ⑴ 그라운딩 비교 8회 중 GLM 3회 전부 «Grep 으로만 확인하고 Read 는 안 했다»고 스스로 적고
+ *       그 경로를 증거로 써 grounding-evidence 기각
+ *    ⑵ 상 칸에서 PR 없이 라운드만 도는 no-progress(부검반 ×26)
+ *  다른 군(codex·grok·local·claude·gemini·gpt·other)의 요청 바이트는 불변 — 이 상수는
+ *  open-weight 계열에만 주입된다(`TOOL_DISCIPLINE_BY_FAMILY`).
+ *
+ *  ⛔ `llm.ts` 의 `selectIntentClassificationMessages` 가 이 상수와 «정확 일치»로 분류기를
+ *     걸러 내므로, 주입부는 상수를 그대로 싣는다(합성 금지). */
+export const OPEN_WEIGHT_TOOL_DISCIPLINE = [
+  '[open-weight tool-use discipline]',
+  '- 도구로 할 수 있는 일은 이번 응답에서 바로 도구를 호출하라. "먼저 읽겠다" 또는 "확인하겠다" 같은 계획만 말하고 응답을 끝내지 마라.',
+  '- 작업을 시작하는 첫 응답에는 도구 호출이 하나 이상 있어야 한다.',
+  '- 도구 호출 인자는 해당 도구의 스키마에 맞는 JSON 으로 내라.',
+  '- 충분한 근거가 모이면 도구 호출 없이 최종 답을 평문으로 써서 끝내라.',
+  '- 증거·근거로 적는 파일은 이번 작업에서 Read 로 연 파일만 — Grep·Glob 결과만으로 내용을 단정하지 마라.',
+  '- 구현을 끝냈다고 말하기 전에 바꾼 파일과 돌린 시험 명령·결과를 적어라.',
+].join('\n');

package/src/llm.ts

@@ -42,6 +42,7 @@ import {
 } from './session-runtime/retry-policy.js';
 import { fetchApiWithRetry, OverloadFailoverError, type FetchApiWithRetryOpts } from './session-runtime/retry-api.js';
 import { BedrockProvider, isBedrockCompatibleModel, makeBedrockProvider } from './llm/bedrock-provider.js';
+import { OPEN_WEIGHT_TOOL_DISCIPLINE } from './llm/open-weight-discipline.js';
 import { makeZaiCodingPlanProvider, zaiCodingPlanAvailable } from './llm/zai-coding-plan.js';
 import { isOpenRouterDeepSeekWireModel, nonEmptyReasoningDetails, openRouterDeepSeekCatalogEffort, openRouterDeepSeekEffort, openRouterDeepSeekRequestExtras, openRouterNeedsKimiToolSchema } from './llm/openrouter-deepseek.js';
 import { resolveModelAlias } from './intelligence-map/model-alias.js';
@@ -5165,14 +5166,9 @@ const LOCAL_TOOL_DISCIPLINE = [
   '- 범위 읽기만으로 판단할 수 없을 때에만 전체 읽기를 선택하고, 읽은 뒤에는 다음 행동을 계속 결정하라.',
 ].join('\n');
 
-/** OpenRouter(`openrouter/…`) GLM·Kimi·Qwen 전용 도구 호출 규율 — 다른 군 상수와 합성하지 않는 독립 상수. */
-export const OPEN_WEIGHT_TOOL_DISCIPLINE = [
-  '[open-weight tool-use discipline]',
-  '- 도구로 할 수 있는 일은 이번 응답에서 바로 도구를 호출하라. "먼저 읽겠다" 또는 "확인하겠다" 같은 계획만 말하고 응답을 끝내지 마라.',
-  '- 작업을 시작하는 첫 응답에는 도구 호출이 하나 이상 있어야 한다.',
-  '- 도구 호출 인자는 해당 도구의 스키마에 맞는 JSON 으로 내라.',
-  '- 충분한 근거가 모이면 도구 호출 없이 최종 답을 평문으로 써서 끝내라.',
-].join('\n');
+// ⭐ 2026-10-11 GLM-PROMPT-TUNE: 상수 정의는 `src/llm/open-weight-discipline.ts` 로 옮겼다(llm.ts 동결 RFC #25983).
+//    llm.ts 는 이 재수출만 남긴다 — 기존 임포트 경로(`./llm.js`)를 그대로 지킨다.
+export { OPEN_WEIGHT_TOOL_DISCIPLINE };
 
 /** 모델군 → 그 군에 주입할 툴 규율(없으면 `null`). **능력 술어 판** — 2026-08-14.
  *

package/src/maturity/feature-maturity.ts

@@ -64,7 +64,7 @@ export const FEATURE_MATURITY = {
     pod: 'beta', browser: 'beta', questions: 'beta', usage: 'stable', live: 'beta',
     research: 'beta', release: 'beta', know: 'beta', freeze: 'beta', flow: 'beta', seat: 'beta', hq: 'beta', steward: 'beta', coord: 'beta', context: 'beta', 'model-watch': 'beta', doctor: 'stable',
     control: 'beta', resources: 'beta', hooks: 'beta', setup: 'stable', start: 'stable',
-    grounding: 'beta', graph: 'beta', loop: 'stable', card: 'stable', 'launch-head': 'beta',
+    grounding: 'beta', graph: 'beta', loop: 'stable', resource: 'beta', card: 'stable', 'launch-head': 'beta',
     a2a: 'beta', plugin: 'stable', make: 'beta', skills: 'beta', connect: 'beta', import: 'beta',
     persona: 'beta', team: 'beta', 'team-set': 'beta', market: 'beta', directive: 'stable', connector: 'beta', storyboard: 'beta',
     python: 'beta', 'self-update': 'stable', 'measure-fabric-arc-ab': 'beta', mcp: 'beta',

package/src/nexus/api/http-server.ts

@@ -505,6 +505,8 @@ export interface NexusHttpServerOpts {
   draftMetrics?: DraftMetricsSource;
   decisions?: Pick<DecisionsRouteDeps, 'ledger'>;
   opsBoard?: Pick<OpsBoardDeps, 'openStore'>;
+  /** `GET /api/task-agent/board` 의 원장 경로 — 생략하면 인스턴스의 task-agent-actions.json. */
+  taskAgentStatePath?: string;
   cardFollowup?: CardFollowupJobs;
   skillExec?: SkillExecJobs;
   execRequests?: ExecRequestRunner;
@@ -943,6 +945,8 @@ function defaultCardFollowupJobs(): CardFollowupJobs {
   return cardFollowupJobs ??= createCardFollowupJobs();
 }
 
+const TASK_AGENT_BOARD_PATH = '/api/task-agent/board';
+
 let skillExecJobs: SkillExecJobs | undefined;
 function defaultSkillExecJobs(): SkillExecJobs {
   return skillExecJobs ??= createSkillExecJobs();
@@ -1521,6 +1525,24 @@ export async function routeRequest(
       ...opts.opsBoard,
     });
   }
+  // TASKS-ON-TA-LEDGER — 읽기 전용 · 이 경로는 `/v1/` 밖이라 default-deny 관문이 못 덮는다 → 여기서 owner 인증을 직접 건다.
+  if (pathname === TASK_AGENT_BOARD_PATH) {
+    if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
+    if (!checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed', method }, 405);
+    // 동적 import — 다른 무거운 라우트(skill-exec · card-followup)와 같은 꼴: task-agent 모듈 트리를 데몬 기동 경로에 싣지 않는다.
+    const [{ taskAgentBoard }, { taskAgentStatePath }] = await Promise.all([import('../../task-agent/board.js'), import('../../task-agent/task-hand.js')]);
+    try {
+      // progress 관측은 동기 수 초라 요청이 명시할 때만(`?progress=1`) — 기본 응답은 progress=null(UX 수확 리뷰 should-fix).
+      const withProgress = new URL(req.url, 'http://local').searchParams.get('progress') === '1';
+      const response = taskAgentBoard(opts.taskAgentStatePath ?? taskAgentStatePath(), { withProgress });
+      debug.log('task-agent', 'board-served', { projects: response.board.length });
+      return jsonResponse(response);
+    } catch (error) {
+      debug.log('task-agent', 'board-read-failed', { error: error instanceof Error ? error.message : String(error) });
+      return jsonResponse({ error: 'task-agent-ledger-unreadable' }, 503);
+    }
+  }
   if (method === 'GET' && pathname === DECISIONS_PATH) {
     return handleDecisions(req, {
       authorize: request => !!opts.metaApi && checkAuth(request, opts.metaApi),

package/src/oauth/codex-account-rotation.ts

@@ -74,6 +74,9 @@ interface RotationDecision {
   readonly resetCreditAccount?: string;
   /** SUBSCRIPTION-EXHAUST-REROUTE — 크레딧 예비분에 닿아 `no-candidate` 로 넘겼을 때만 있다(잔액은 «알려진» 값). */
   readonly creditReserveHit?: { readonly balance: number; readonly reserve: number };
+  /** CREDIT-SPEND-ORDER — 구독·리셋권이 다 없어 «다른 계정의 선불 크레딧»으로 옮긴 `rotated` 일 때만 true.
+   *  이 이동도 크레딧 진입이다 — 호출부가 💳 알림 ⊕ `credit-spend-start` 를 낸다(10-12 S2: 이 갈래만 알림 0). */
+  readonly creditEntry?: true;
 }
 
 /** ⛔ 비공개 — 호출자는 객체 리터럴로 준다(구조적 타이핑). */
@@ -261,7 +264,7 @@ export function decideCodexRotation(input: RotationInput): RotationDecision {
       const curHas = input.currentHasCredits ?? self?.hasCredits;
       const currentDry = curHas === false || (typeof cur === 'number' && cur <= floor);
       if (richest && (currentDry || (typeof cur === 'number' && richest.creditBalance! > cur * 1.2))) {
-        return { reason: 'rotated', candidateCount, accountThresholds, to: richest };
+        return { reason: 'rotated', candidateCount, accountThresholds, to: richest, creditEntry: true };
       }
       // 🩸 10-11: 크레딧이 0 이 돼도 여기 머물러 codex 로 계속 쐈다. 잔액이 «알려져 있고» 예비분 이하이며
       //   예비분을 넘는 다른 계정도 없으면 «갈 곳 없음» — 폴백 체인이 다음 칸을 정한다. 모르면 종전대로 머문다.

package/src/oauth/codex-account-store.ts

@@ -24,7 +24,7 @@ import {
   codexAccountThresholdPercent,
   type RotationCandidate,
 } from './codex-account-rotation.js';
-import { codexPolicyAllowsCredits, codexPolicyAllowsFallback, resolveCodexQuotaPolicy, type CodexQuotaPolicy, type ResolvedCodexQuotaPolicy } from './codex-quota-policy.js';
+import { codexPolicyAllowsCredits, codexPolicyAllowsFallback, resolveCodexQuotaPolicy, type CodexQuotaPolicy, type CodexQuotaPolicyFileValue, type ResolvedCodexQuotaPolicy } from './codex-quota-policy.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { debug } from '../debug/log.js';
 import {
@@ -238,11 +238,21 @@ function pinnedAccountExhausted(home: string, accountName: string): boolean {
 
 /** codex 한도 정책(`llm.codexQuotaPolicy` · 옛 `codexCreditsAllowed`) — 못 읽으면 `fallback`(크레딧은 돈이라 fail-closed). */
 export function codexQuotaPolicyFromConfig(): CodexQuotaPolicy {
-  try { return resolveCodexQuotaPolicy(configReader().llm).policy; } catch { return 'fallback'; }
+  try { return resolveCodexQuotaPolicy(configReader().llm, codexQuotaPolicyFileValue()).policy; } catch { return 'fallback'; }
+}
+
+/** `policy/llm.yaml` 의 `credits.codex` — 파일 출처일 때만 값을 낸다(없거나 다른 출처면 undefined). 파일이 깨졌거나 못 읽으면 `unreadable`. */
+function codexQuotaPolicyFileValue(): CodexQuotaPolicyFileValue | undefined {
+  try {
+    const loaded = loadLlmPolicy({ legacyConfig: {} });
+    if (!loaded.filePresent) return undefined;
+    if (!loaded.valid) return 'unreadable';
+    return loaded.sources['credits.codex'] === 'file' ? loaded.policy.credits.codex : undefined;
+  } catch { return 'unreadable'; }
 }
 
 function inspectedQuotaPolicy(): ResolvedCodexQuotaPolicy {
-  try { return resolveCodexQuotaPolicy(configReader().llm); } catch { return { policy: 'fallback', source: 'default' }; }
+  try { return resolveCodexQuotaPolicy(configReader().llm, codexQuotaPolicyFileValue()); } catch { return { policy: 'fallback', source: 'default' }; }
 }
 
 /** 지금 계정의 크레딧 신호 — 판정 입력 두 칸. 신호를 이 계정에 귀속할 수 없으면 비운다(모른다). */
@@ -491,7 +501,7 @@ function acquireCreditSpendAlertLock(path: string, account: string): boolean {
 /** UTC 일자별 성공한 계정 알림만 기록한다. 잠근 채 발송하여 동시 런도 중복 발송하지 않는다. */
 function notifyCreditSpendStart(
   account: string,
-  reason: 'credits-allowed' | 'credit-pace',
+  reason: 'credits-allowed' | 'credit-pace' | 'credits-rotated',
   usage: readonly RotationCandidate[],
   now: number,
   counterPath: string,
@@ -793,11 +803,14 @@ export function resolveCodexAccountForRun(
   });
   observeRotation(decision, current.name);
   // 발송 의무는 이 실행 경로에서 잠금 해제까지 기다린 뒤 하루 카운터에 기록한다.
-  if ((decision.reason === 'credits-allowed' || decision.reason === 'credit-pace') && !deps.counterPath && isUnderTestRunner(process.env)) {
+  // CREDIT-SPEND-ORDER(10-12) — «다른 계정의 선불 크레딧으로 옮김»(`rotated` ⊕ creditEntry)도 크레딧 진입이다.
+  const creditSpendReason = decision.reason === 'credits-allowed' || decision.reason === 'credit-pace' ? decision.reason
+    : decision.reason === 'rotated' && decision.creditEntry ? 'credits-rotated' as const : undefined;
+  if (creditSpendReason && !deps.counterPath && isUnderTestRunner(process.env)) {
     // 시험 러너 가드(autoConsume 의 test-runtime-guard 와 같은 관용구) — 카운터를 주입 안 한 시험이 실제 카운터·송신기에 닿지 않는다.
     debug.log('oauth.codex-account', 'credit-spend-alert-skipped', { account: decision.to?.name ?? current.name, reason: 'test-runtime-guard' });
-  } else if (decision.reason === 'credits-allowed' || decision.reason === 'credit-pace') {
-    notifyCreditSpendStart(decision.to?.name ?? current.name, decision.reason, candidates, now,
+  } else if (creditSpendReason) {
+    notifyCreditSpendStart(decision.to?.name ?? current.name, creditSpendReason, candidates, now,
       deps.counterPath ?? join(codexCredentialRoot(), 'budget', 'codex-credit-spend-alert.json'));
   }
   // 순서 ② — 구독 남은 계정이 없고 리셋권이 있으면 «스스로 1개» 쓴다(일일 상한 · 비동기 · 이번 호출은 종전대로 머문다).

package/src/oauth/codex-quota-policy.ts

@@ -9,15 +9,20 @@
 //   credits      — 한도 안 ⊕ 크레딧(찬 계정을 선불 크레딧으로 계속). 크레딧도 떨어져 요청이 한도 오류를 내면 폴백 체인.
 //
 // ⛔ 옛 키 `llm.codexCreditsAllowed: true` 는 `credits` 로 읽는다(새 키가 있으면 새 키가 이긴다).
+// ⭐ 새 자리 = `policy/llm.yaml` 의 `credits.codex`(use→credits · fallback→fallback · never→within-quota).
+//   풀이 순서: env → 정책 파일(파일 출처일 때만) → 옛 `llm.codexQuotaPolicy` → 옛 `llm.codexCreditsAllowed` → fallback.
+//   옛 키는 지우지 않고 읽기만 한다(적용·가려짐은 `codex.policy` 관측으로 남는다).
 // ⛔ 못 읽거나 모르는 값이면 `fallback` — 크레딧은 돈이라 fail-closed(종전 기본과 같다).
 
+import { debug } from '../debug/log.js';
+
 export const CODEX_QUOTA_POLICIES = ['within-quota', 'fallback', 'credits'] as const;
 export type CodexQuotaPolicy = (typeof CODEX_QUOTA_POLICIES)[number];
 
 export interface ResolvedCodexQuotaPolicy {
   readonly policy: CodexQuotaPolicy;
-  /** 어디서 정해졌나 — `config`(새 키) · `legacy-credits`(옛 `codexCreditsAllowed`) · `default` · `invalid`(모르는 값 → 기본). */
-  readonly source: 'env' | 'config' | 'legacy-credits' | 'default' | 'invalid';
+  /** 어디서 정해졌나 — `policy-file`(policy/llm.yaml credits.codex) · `config`(옛 `codexQuotaPolicy`) · `legacy-credits`(옛 `codexCreditsAllowed`) · `default` · `invalid`(모르는 값 → 기본). */
+  readonly source: 'env' | 'policy-file' | 'config' | 'legacy-credits' | 'default' | 'invalid';
 }
 
 export const CODEX_QUOTA_POLICY_LABEL: Readonly<Record<CodexQuotaPolicy, string>> = {
@@ -30,16 +35,40 @@ export function isCodexQuotaPolicy(value: unknown): value is CodexQuotaPolicy {
   return typeof value === 'string' && (CODEX_QUOTA_POLICIES as readonly string[]).includes(value);
 }
 
+/** `policy/llm.yaml` 의 `credits.codex` 값. `unreadable` = 파일이 있는데 깨졌거나 못 읽음(fail-closed 로 fallback). */
+export type CodexQuotaPolicyFileValue = 'use' | 'fallback' | 'never' | 'unreadable';
+
+const FILE_VALUE_TO_POLICY: Readonly<Record<Exclude<CodexQuotaPolicyFileValue, 'unreadable'>, CodexQuotaPolicy>> = {
+  use: 'credits',
+  fallback: 'fallback',
+  never: 'within-quota',
+};
+
 export function resolveCodexQuotaPolicy(
   llm: { readonly codexQuotaPolicy?: unknown; readonly codexCreditsAllowed?: unknown } | undefined,
+  file?: CodexQuotaPolicyFileValue,
 ): ResolvedCodexQuotaPolicy {
   // A Pod has no copy of the host config; the launcher hands the host's policy down in this variable
   // (09-29: without it every Pod child fell back to grok while all three accounts still had credits).
   const fromEnv = process.env.ELANOUS_CODEX_QUOTA_POLICY?.trim();
   if (fromEnv && isCodexQuotaPolicy(fromEnv)) return { policy: fromEnv, source: 'env' };
+  // 정책 파일이 깨졌으면 옛 키가 credits 라 해도 따르지 않는다 — 크레딧은 돈이라 닫는다.
+  if (file === 'unreadable') return { policy: 'fallback', source: 'invalid' };
   const raw = llm?.codexQuotaPolicy;
-  if (isCodexQuotaPolicy(raw)) return { policy: raw, source: 'config' };
-  if (llm?.codexCreditsAllowed === true) return { policy: 'credits', source: 'legacy-credits' };
+  const legacy: { key: string; value: unknown; policy: CodexQuotaPolicy } | undefined = isCodexQuotaPolicy(raw)
+    ? { key: 'llm.codexQuotaPolicy', value: raw, policy: raw }
+    : llm?.codexCreditsAllowed === true ? { key: 'llm.codexCreditsAllowed', value: true, policy: 'credits' } : undefined;
+  if (file !== undefined) {
+    const policy = FILE_VALUE_TO_POLICY[file];
+    if (legacy && legacy.policy !== policy) debug.log('codex.policy', 'legacy-key-shadowed', { key: legacy.key, legacy: legacy.value, file });
+    return { policy, source: 'policy-file' };
+  }
+  if (legacy) {
+    debug.log('codex.policy', 'legacy-key-applied', { key: legacy.key, value: legacy.value });
+    return legacy.key === 'llm.codexQuotaPolicy'
+      ? { policy: legacy.policy, source: 'config' }
+      : { policy: 'credits', source: 'legacy-credits' };
+  }
   if (raw !== undefined) return { policy: 'fallback', source: 'invalid' };
   return { policy: 'fallback', source: 'default' };
 }