elanous 0.2.25 → 0.2.28

package/src/rfc-registry/registry.ts

@@ -0,0 +1,88 @@
+import { chmodSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { Database } from 'bun:sqlite';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+import { assertNotTestWritingOps } from '../instance/test-write-guard.js';
+
+/** The RFC ledger is independent of the release checklist ledger. Callers own and close the handle. */
+export function openRfcRegistry(root = releaseLedgerRoot()): Database {
+  const path = join(root, 'rfc', 'registry.sqlite');
+  assertNotTestWritingOps(path, 'open the RFC registry');
+  mkdirSync(dirname(path), { recursive: true });
+  const db = new Database(path, { create: true, strict: true });
+  try {
+    chmodSync(path, 0o600);
+    db.exec('PRAGMA busy_timeout = 10000; PRAGMA foreign_keys = ON');
+    db.exec(`CREATE TABLE IF NOT EXISTS rfc (
+      id TEXT PRIMARY KEY CHECK(length(id) = 8 AND id GLOB 'RFC-[0-9][0-9][0-9][0-9]'),
+      title TEXT NOT NULL CHECK(length(trim(title)) > 0),
+      status TEXT NOT NULL,
+      doc_path TEXT,
+      created_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS rfc_item (
+      id TEXT PRIMARY KEY CHECK(length(id) = 12 AND id GLOB 'RFC-[0-9][0-9][0-9][0-9].I[0-9][0-9]'),
+      rfc_id TEXT NOT NULL REFERENCES rfc(id),
+      title TEXT NOT NULL CHECK(length(trim(title)) > 0),
+      status TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      CHECK(substr(id, 1, 8) = rfc_id)
+    );
+    CREATE TABLE IF NOT EXISTS rfc_item_link (
+      item_id TEXT NOT NULL REFERENCES rfc_item(id),
+      target_item_id TEXT NOT NULL REFERENCES rfc_item(id),
+      PRIMARY KEY(item_id, target_item_id),
+      CHECK(item_id <> target_item_id)
+    );
+    CREATE TABLE IF NOT EXISTS rfc_event (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      rfc_id TEXT NOT NULL REFERENCES rfc(id),
+      item_id TEXT REFERENCES rfc_item(id),
+      at TEXT NOT NULL,
+      actor TEXT NOT NULL,
+      event TEXT NOT NULL,
+      payload TEXT
+    );
+    CREATE TRIGGER IF NOT EXISTS rfc_id_immutable BEFORE UPDATE OF id ON rfc
+      BEGIN SELECT RAISE(ABORT, 'RFC identifier is immutable'); END;
+    CREATE TRIGGER IF NOT EXISTS rfc_no_delete BEFORE DELETE ON rfc
+      BEGIN SELECT RAISE(ABORT, 'RFC identifier is immutable'); END;
+    CREATE TRIGGER IF NOT EXISTS rfc_item_id_immutable BEFORE UPDATE OF id, rfc_id ON rfc_item
+      BEGIN SELECT RAISE(ABORT, 'RFC item identifier is immutable'); END;
+    CREATE TRIGGER IF NOT EXISTS rfc_item_no_delete BEFORE DELETE ON rfc_item
+      BEGIN SELECT RAISE(ABORT, 'RFC item identifier is immutable'); END;
+    CREATE TRIGGER IF NOT EXISTS rfc_event_item_parent BEFORE INSERT ON rfc_event
+      WHEN NEW.item_id IS NOT NULL AND NOT EXISTS
+        (SELECT 1 FROM rfc_item WHERE id = NEW.item_id AND rfc_id = NEW.rfc_id)
+      BEGIN SELECT RAISE(ABORT, 'RFC event item belongs to another RFC'); END;
+    CREATE TRIGGER IF NOT EXISTS rfc_event_no_update BEFORE UPDATE ON rfc_event
+      BEGIN SELECT RAISE(ABORT, 'RFC event history is append-only'); END;
+    CREATE TRIGGER IF NOT EXISTS rfc_event_no_delete BEFORE DELETE ON rfc_event
+      BEGIN SELECT RAISE(ABORT, 'RFC event history is append-only'); END;`);
+    return db;
+  } catch (error) { db.close(); throw error; }
+}
+
+export interface RfcRow { id: string; title: string; status: string; doc_path: string | null; created_at: string }
+export interface RfcItemRow { id: string; rfc_id: string; title: string; status: string; created_at: string }
+export interface RfcItemLinkRow { item_id: string; target_item_id: string }
+export interface RfcDetail extends RfcRow { items: Array<RfcItemRow & { links: RfcItemLinkRow[] }> }
+
+export function listRfcs(root?: string): RfcRow[] {
+  const db = openRfcRegistry(root);
+  try { return db.query('SELECT id, title, status, doc_path, created_at FROM rfc ORDER BY id').all() as RfcRow[]; }
+  finally { db.close(); }
+}
+
+export function showRfc(id: string, root?: string): RfcDetail | null {
+  const db = openRfcRegistry(root);
+  try {
+    const read = db.transaction(() => {
+      const row = db.query('SELECT id, title, status, doc_path, created_at FROM rfc WHERE id = ?').get(id) as RfcRow | null;
+      if (!row) return null;
+      const items = db.query('SELECT id, rfc_id, title, status, created_at FROM rfc_item WHERE rfc_id = ? ORDER BY id').all(id) as RfcItemRow[];
+      return { ...row, items: items.map((item) => ({ ...item, links: db.query('SELECT item_id, target_item_id FROM rfc_item_link WHERE item_id = ? ORDER BY target_item_id').all(item.id) as RfcItemLinkRow[] })) };
+    });
+    return read();
+  } finally { db.close(); }
+}

package/src/seat-dispatch/seat-request-ledger.ts

@@ -11,6 +11,10 @@ export type SeatRequestRow = {
   text: string;
   queuedAt: string;
   reason?: string;
+  /** One-line explanation of the automated action recorded on this row. */
+  why?: string;
+  /** Pointer to the evidence supporting the action (log line, run id, ledger path, …). */
+  evidenceRef?: string;
   closedAt?: string;
   [field: string]: unknown;
 };

package/src/seat-loop/knowhow-lint.ts

@@ -0,0 +1,233 @@
+import { seatPackLeakPatterns } from './seat-pack.js';
+
+/** 필수 칸 — 형식 v2 선언(각 자리 KNOWHOW 머리글)의 공통 아홉. 괄호 수식어(신호(관측) 등)는 정규화해서 비교한다. */
+const REQUIRED_FIELDS = ['상황', '신호', '원인', '처방', '재는 명령', '기대', '유효 조건', '검증', '출처'] as const;
+
+/** Only commands whose executable and subcommand are known to be observational are accepted. */
+const READ_COMMANDS: Record<string, ReadonlySet<string> | null> = {
+  cat: null, echo: null, rg: null, grep: null, head: null, tail: null,
+  wc: null, sort: null, uniq: null, cut: null, jq: null, ls: null, stat: null,
+  readlink: null, pwd: null, test: null,
+  git: new Set(['rev-parse', 'status', 'log', 'show', 'merge-base']),
+  eln: new Set(['logs', 'where', 'tasks', 'config', 'release']),
+  'bun bin/elanous.mjs': new Set(['logs', 'where', 'release']),
+};
+
+/** Git's options are commands too: e.g. show --textconv runs a configured external driver. */
+const READ_GIT_OPTIONS: Record<string, ReadonlySet<string>> = {
+  'rev-parse': new Set(['--git-dir', '--show-toplevel', '--is-inside-work-tree', '--verify', '--short', '--abbrev-ref', '--show-prefix']),
+  status: new Set(['--short', '--porcelain', '--branch', '--untracked-files=all', '--untracked-files=no']),
+  log: new Set(['--oneline', '--no-patch', '--stat', '--name-only', '--name-status', '--all', '--decorate']),
+  show: new Set(['--no-patch', '--stat', '--name-only', '--name-status', '--oneline']),
+  'merge-base': new Set(['--is-ancestor', '--fork-point', '--all']),
+};
+
+/** `logs level <value>` changes daemon state. Accept only the top-level query options. */
+const LOGS_QUERY_FLAGS = new Set([
+  '--follow', '-f', '--list-categories', '--list-events', '--explain', '--top-failures',
+  '--json', '--json-data', '--test', '--all', '--include-test', '-r', '--help', '-h',
+]);
+const LOGS_QUERY_VALUES = new Set([
+  '--level', '--surface', '--space', '--category', '--exact-category', '--axis', '--event',
+  '--grep', '--rework-recurrence-disagreement', '--since', '--until', '--before',
+  '--session', '--limit', '--threshold', '--instance', '--remote',
+]);
+
+function readOnlyLogs(args: string[]): boolean {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (LOGS_QUERY_FLAGS.has(arg)) continue;
+    if (LOGS_QUERY_VALUES.has(arg) && args[i + 1] && !args[i + 1]!.startsWith('-')) { i++; continue; }
+    return false;
+  }
+  return true;
+}
+
+function readOnlyGit(rest: string[]): boolean {
+  const [subcommand, ...args] = rest;
+  const options = READ_GIT_OPTIONS[subcommand ?? ''];
+  if (!options) return false;
+  return args.every((arg) => !arg.startsWith('-') || options.has(arg)
+    || ((subcommand === 'log' || subcommand === 'show')
+      && (/^--(?:format|pretty|grep|since|until|max-count)=.+$/u.test(arg) || /^-[1-9][0-9]*$/u.test(arg))));
+}
+
+/** Do not execute the measurement here: parse only a small, fail-closed shell subset. */
+function readOnlyMeasure(command: string): boolean {
+  const source = command.trim().replace(/^`|`$/gu, '');
+  const tokens: string[] = [];
+  let word = '';
+  let quote: '"' | "'" | null = null;
+  for (let i = 0; i < source.length; i++) {
+    const char = source[i]!;
+    if (char === '\\' || char === '`' || char === '$' || char === '\n') return false;
+    if (quote) {
+      if (char === quote) quote = null;
+      else word += char;
+    } else if (char === '"' || char === "'") {
+      quote = char;
+    } else if (/\s/u.test(char)) {
+      if (word) { tokens.push(word); word = ''; }
+    } else if ('|&;<>()[{}]'.includes(char)) {
+      if (word) { tokens.push(word); word = ''; }
+      if (char === '|' || char === '&') {
+        if (source[i + 1] === char) { tokens.push(char + char); i++; }
+        else if (char === '|') tokens.push('|');
+        else return false;
+      } else if (char === '>') {
+        if (source[i + 1] === '>') return false;
+        if (source.slice(i + 1, i + 3) === '&1') { tokens.push('>&1'); i += 2; }
+        else tokens.push('>');
+      } else return false;
+    } else word += char;
+  }
+  if (quote) return false;
+  if (word) tokens.push(word);
+  if (!tokens.length) return false;
+  const segments: string[][] = [[]];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]!;
+    if (token === '>' && tokens[i + 1] === '/dev/null') { i++; continue; }
+    if (token === '2' && tokens[i + 1] === '>&1') { i++; continue; }
+    if (token === '&&' || token === '||' || token === '|') {
+      if (!segments.at(-1)!.length) return false;
+      segments.push([]);
+    } else if (token === '>' || token === '>&1') return false;
+    else segments.at(-1)!.push(token);
+  }
+  return segments.every((args) => {
+    if (!args.length || args.some((arg) => /^(?:--pre|--output|--ext-diff|--exec|--config|--config-env|--write)(?:=|$)/u.test(arg))) return false;
+    if (args.some((arg) => /^(?:--output(?:=\S*)?|--replace|--in-place)$/u.test(arg))) return false;
+    if (args[0] === 'sort' && args.some((arg) => /^-o\S*|^--compress-program(?:=|$)/u.test(arg))) return false;
+    let executable = args[0]!;
+    let rest = args.slice(1);
+    if (executable === 'bun' && rest[0] === 'bin/elanous.mjs') { executable = 'bun bin/elanous.mjs'; rest = rest.slice(1); }
+    if (!Object.hasOwn(READ_COMMANDS, executable)) return false;
+    const allowed = READ_COMMANDS[executable]!;
+    if (allowed === null) return true;
+    if (executable === 'bun bin/elanous.mjs' && rest[0] === '--test') rest = rest.slice(1);
+    if (!allowed.has(rest[0] ?? '')) return false;
+    if (executable === 'git') return readOnlyGit(rest);
+    if ((executable === 'eln' || executable === 'bun bin/elanous.mjs') && rest[0] === 'logs') return readOnlyLogs(rest.slice(1));
+    if ((executable === 'eln' || executable === 'bun bin/elanous.mjs') && rest[0] === 'tasks') return rest[1] === 'close' && rest[2] === '--help';
+    if ((executable === 'eln' || executable === 'bun bin/elanous.mjs') && rest[0] === 'config') return rest[1] === 'get';
+    if ((executable === 'eln' || executable === 'bun bin/elanous.mjs') && rest[0] === 'release') return rest[1] === 'checklist' && rest[2] === 'status';
+    return true;
+  });
+}
+
+/** 비밀 표식 — 팩 스캔 표식(seatPackLeakPatterns)에 실제 자격 모양을 더한 집합. */
+const SECRET_SHAPE_PATTERNS: Array<[string, RegExp]> = [
+  ['api key', /\b(?:sk|rk)-(?:proj-)?[A-Za-z0-9_-]{16,}\b/u],
+  ['github token', /\b(?:gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{16,})\b/u],
+  ['slack token', /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/u],
+  ['aws key id', /\bAKIA[0-9A-Z]{12,}\b/u],
+  ['private key block', /-----BEGIN [A-Z ]*PRIVATE KEY-----/u],
+  ['credential assignment', /\b(?:api[_-]?key|secret|token|password)\s*[:=]\s*["']?[A-Za-z0-9][A-Za-z0-9._/+~-]{11,}/iu],
+];
+
+export class KnowhowLintError extends Error {
+  constructor(file: string, card: string, reason: string) {
+    super(`knowhow lint: ${file} ${card} — ${reason}`);
+    this.name = 'KnowhowLintError';
+  }
+}
+
+interface KnowhowCard {
+  id: string;
+  lines: Array<[number, string]>;
+}
+
+/** 카드 제목 — `## K-<자리>-<번호>` 뒤에는 줄 끝·공백·콜론·em 대시만 온다. */
+const CARD_HEADING = /^[ \t]{0,3}##\s+(K-[A-Za-z]+-\d+)(?=$|\s|:|—)/u;
+/** 카드처럼 보이는 `##` 제목(예: `## K-OP-7a`) — CARD_HEADING 을 벗어나면 인식 실패로 명시 거부한다. */
+const CARD_HEADING_LIKE = /^[ \t]{0,3}##\s*(K-[^\s:]*)/iu;
+
+function parseCards(body: string, file: string): KnowhowCard[] {
+  const cards: KnowhowCard[] = [];
+  let current: KnowhowCard | null = null;
+  let fence: { marker: string; length: number } | null = null;
+  for (const [index, line] of body.split(/\r?\n/u).entries()) {
+    const fenceLine = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/u);
+    if (fence) {
+      if (fenceLine && fenceLine[1]![0] === fence.marker && fenceLine[1]!.length >= fence.length
+        && /^[ \t]*$/u.test(fenceLine[2]!)) fence = null;
+      continue;
+    }
+    if (fenceLine) {
+      fence = { marker: fenceLine[1]![0]!, length: fenceLine[1]!.length };
+      continue;
+    }
+    const heading = line.match(CARD_HEADING);
+    if (heading) {
+      current = { id: heading[1]!, lines: [] };
+      cards.push(current);
+      continue;
+    }
+    if (/^[ \t]{0,3}#/u.test(line)) {
+      const like = line.match(CARD_HEADING_LIKE);
+      if (like) throw new KnowhowLintError(file, like[1]!, '카드 제목 형식이 K-<자리>-<번호>를 벗어남');
+      current = null;
+    } else if (current) current.lines.push([index + 1, line]);
+  }
+  return cards;
+}
+
+function parseField(line: string): { label: string; value: string } | null {
+  const match = line.match(/^-\s*([^:—]+?)\s*[—:]\s*(.*)$/u);
+  if (!match) return null;
+  return { label: match[1]!.replace(/\s*\([^)]*\)/gu, '').trim(), value: match[2]!.trim() };
+}
+
+/** 자리 KNOWHOW.md 카드를 내보내기 전에 검증한다 — 카드 제목 형식 · 필수 칸 · 읽기 전용 재는 명령(이어 적은 여러 줄 포함) · 비밀 표식. */
+export function lintKnowhow(body: string, file: string): void {
+  const secrets = [...seatPackLeakPatterns(), ...SECRET_SHAPE_PATTERNS];
+  for (const [index, line] of body.split(/\r?\n/u).entries()) {
+    for (const [label, pattern] of secrets) {
+      if (pattern.test(line)) throw new KnowhowLintError(file, 'file', `비밀 표식 (${label}) — ${file}:${index + 1}`);
+    }
+  }
+  const cards = parseCards(body, file);
+  if (!cards.length) throw new KnowhowLintError(file, 'file', '카드가 0개 — 최소 한 개의 K-<자리>-<번호> 카드가 필요함');
+  for (const card of cards) {
+    const fields = new Map<string, string>();
+    const fieldEntries: Array<{ label: string; value: string }> = [];
+    let current: { label: string; value: string } | null = null;
+    for (const [, line] of card.lines) {
+      const field = parseField(line);
+      if (field) {
+        if (current) fieldEntries.push(current);
+        current = { label: field.label, value: field.value };
+      } else if (current && /^\s+\S/u.test(line)) {
+        current.value += `\n${line.trim()}`;
+      } else if (current) {
+        fieldEntries.push(current);
+        current = null;
+      }
+    }
+    if (current) fieldEntries.push(current);
+    for (const field of fieldEntries) {
+      if (fields.has(field.label)) throw new KnowhowLintError(file, card.id, `중복 칸: ${field.label}`);
+      if ((REQUIRED_FIELDS as readonly string[]).includes(field.label) || field.label === '상태') {
+        if (!field.value) throw new KnowhowLintError(file, card.id, `필수 칸 누락: ${field.label}`);
+      }
+      if (field.label === '재는 명령'
+        && !field.value.split('\n').every((command) => readOnlyMeasure(command))) {
+        throw new KnowhowLintError(file, card.id, '재는 명령이 읽기 전용이 아님');
+      }
+      fields.set(field.label, field.value);
+    }
+    for (const required of REQUIRED_FIELDS) {
+      if (!fields.get(required)) throw new KnowhowLintError(file, card.id, `필수 칸 누락: ${required}`);
+    }
+    const source = fields.get('출처') ?? '';
+    const statusInSource = source.match(/(?:^|[· \t])상태[ \t]*[:—][ \t]*([^·\n]*)/u);
+    if (!source.slice(0, statusInSource?.index ?? source.length).replace(/[·\s]+$/u, '').trim()) {
+      throw new KnowhowLintError(file, card.id, '필수 칸 누락: 출처');
+    }
+    const combinedStatus = statusInSource?.[1]?.trim();
+    if (!fields.get('상태') && !combinedStatus) {
+      throw new KnowhowLintError(file, card.id, '필수 칸 누락: 상태');
+    }
+  }
+}

package/src/seat-loop/seat-loop.ts

@@ -85,7 +85,7 @@ export type SeatDeps = {
   /** Release schedules (version · cutAt) — a version is open while its cut is still ahead. Default reads the release ledger; unreadable ⇒ no checklist candidates (fail closed). */
   schedules?: () => Array<{ version: string; cutAt: string; landBy?: string | null }>;
   /** Checklist items of one version — default reads the release ledger DB (checklist.json is only a legacy import source since REL5b). */
-  checklistItems?: (version: string) => Array<{ id: string; title: string; status: string; owner?: string | null; disposition?: string; evidence?: string }>;
+  checklistItems?: (version: string) => Array<{ id: string; title: string; status: string; owner?: string | null; disposition?: string; evidence?: string; dispatchKind?: string }>;
   /** Optional injected traffic/handoff snapshots; defaults read the OP files. */
   trafficSignal?: TrafficSignalRead;
   handedCells?: ReadonlySet<string>;
@@ -588,6 +588,10 @@ export async function gatherSeatInputs(seat: string, deps: SeatDeps = {}, ledger
     }
     for (const item of items) {
       if (item.owner === seat && (item.status === 'yellow' || item.status === 'red')) {
+        if (item.dispatchKind && item.dispatchKind !== 'code') {
+          debug.log('seat.loop', 'skip-non-code-cell', { id: item.id, version, dispatchKind: item.dispatchKind });
+          continue;
+        }
         if (signal?.hold?.includes(item.id)) {
           debug.log('seat.loop', 'skip-signal-cell', { id: item.id, why: 'hold' });
           continue;

package/src/seat-loop/seat-pack.ts

@@ -1,8 +1,9 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { userInfo } from 'node:os';
 import { DEFAULT_CONCURRENT_PODS, DEFAULT_DAILY_GOALS } from '../org/seat-budget.js';
+import { lintKnowhow } from './knowhow-lint.js';
 
 export interface SeatPackManifest {
   name: string;
@@ -31,13 +32,20 @@ function walk(directory: string, root: string): string[] {
     });
 }
 
+/** Static leak markers shared by the pack scan and the KNOWHOW lint. Account-name patterns stay in `scan` — they depend on the exporting host's user. */
+export function seatPackLeakPatterns(): Array<[string, RegExp]> {
+  return [
+    ['royal marker', /\u{1F451}/u],
+    ['track marker', /(?:🅞|🅣|🅢|🅕|\*\*\[(?:OP|TC|MK|UX|S|T|O|F)\]\*\*|\[(?:OP|TC|MK|UX|S|T|O|F)\])/u],
+    ['absolute user path', /\/Users\/[A-Za-z0-9._-]+/u],
+  ];
+}
+
 function scan(file: string, body: string): void {
   const usernames = new Set([userInfo().username, process.env.ELANOUS_LEAK_HOME_USER].filter((name): name is string => Boolean(name)));
   const accountPatterns = [...usernames].map((name) => new RegExp(`(?<![A-Za-z0-9._-])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9._-])`, 'iu'));
   const patterns: Array<[string, RegExp]> = [
-    ['royal marker', /\u{1F451}/u],
-    ['track marker', /(?:🅞|🅣|🅢|🅕|\*\*\[(?:OP|TC|MK|UX|S|T|O|F)\]\*\*|\[(?:OP|TC|MK|UX|S|T|O|F)\])/u],
-    ['absolute user path', /\/Users\/[A-Za-z0-9._-]+/u],
+    ...seatPackLeakPatterns(),
     ...accountPatterns.map((pattern): [string, RegExp] => ['account name', pattern]),
   ];
   for (const [index, line] of body.split(/\r?\n/u).entries()) {
@@ -61,6 +69,10 @@ export function exportSeatPack(seat: string, out: string, root = resolve(import.
   for (const file of roleFiles) {
     const body = readFileSync(join(repo, file));
     contents.set(file, body);
+    // Public leak markers take precedence over formatting errors: callers need
+    // the file:line and exit 2 before an export directory can be created.
+    scan(file, body.toString('utf8'));
+    if (basename(file) === 'KNOWHOW.md') lintKnowhow(body.toString('utf8'), file);
     for (const match of body.toString('utf8').matchAll(/graphs\/([A-Za-z0-9_./-]+(?:\.ya?ml|\/\*\*))/gu)) {
       const ref = `graphs/${match[1]!}`;
       if (ref.split('/').includes('..')) throw new Error(`invalid seat graph: ${ref}`);

package/src/seat-loop/traffic-signal.ts

@@ -10,6 +10,13 @@ export type TrafficSignal = {
 };
 export type TrafficSignalRead = TrafficSignal | { unreadable: true } | null;
 
+/** Pure proposal classification; applying a proposal belongs to the downstream seat-message caller. */
+export function classifySeatTrafficProposal(message: string): 'hold' | 'UNHOLD' | null {
+  if (message.includes('첫 줄 확정')) return 'UNHOLD';
+  if (message.includes('손 구현 착수')) return 'hold';
+  return null;
+}
+
 const defaultPath = (name: string): string => join(homedir(), 'elanous-hq', 'seat-state', 'OP', name);
 const missing = (error: unknown): boolean => (error as NodeJS.ErrnoException).code === 'ENOENT';
 

package/src/self-dev/ask-launch-flow.ts

@@ -11,6 +11,8 @@
 // ⛔ 종료(`process.exit`)는 여기가 «안» 한다 — 호출자가 자기 표면에 맞게 끝낸다.
 //   그래서 결과를 «세 값»으로 낸다: 발사 / 저작 전 중단 / 전제 검사 중단.
 import { linesOutsideFencedCode } from '../self-implement/goal-author.js';
+import { existsSync } from 'node:fs';
+import { debug } from '../debug/log.js';
 import { recordAuthoredGoal } from './authored-goal-trace.js';
 import { findAskPathCandidates, type AskPathCandidateOptions } from './ask-path-candidates.js';
 import { retiredEntranceNotice, type EntranceDeclaration } from './entrance-registry.js';
@@ -18,6 +20,7 @@ import {
   classifyConcurrentAuthoring,
   countRepeatedBlocks,
   decideAskPreflight,
+  discardNonFileTracedPathItems,
   parseAskTargetPathHintsResult,
   parseBlockedChoice,
   planBlockedPrompt,
@@ -797,10 +800,10 @@ async function intakeClarifications(
     selfResolveClarifications: selfResolveClarifications.value,
   });
   const parentDocument = document;
-  effectiveGoalFile = reauthored.path;
+  effectiveGoalFile = isAbsolutePath(reauthored.path) ? reauthored.path : resolvePath(deps.cwd(), reauthored.path);
   deps.print(`[ask] ⑴b 재저작됨: ${reauthored.path}`);
   // ⛔ 「재저작이 «났다»」와 「재저작이 «옳았다»」는 다른 물음이다(JDG-T35 3단 ⑶).
-  const childDocument = reauthored.authored?.document ?? deps.readFile(reauthored.path);
+  const childDocument = reauthored.authored?.document ?? deps.readFile(effectiveGoalFile);
   const askFidelity = classifyReauthoredAsk(parentDocument, childDocument);
   if (askFidelity !== 'preserved') {
     deps.print(`[ask] ⑴b ⚠️ 재저작 ask 판정: ${askFidelity} — ⛔ 「preserved」가 아니면 사람의 ask 가 살아남았는지 «확인하라»`);
@@ -939,7 +942,31 @@ export async function runAskLaunchFlow(
     }, markerCounts !== null && markerCounts.missingMarkers > 0 ? 'warn' : 'info');
 
     // ⛔ 되묻기에 답하면 «새 골»이 나온다 — 아래 전제 검사·발사는 그 «최종» 골을 써야 한다.
-    const goalFile = await intakeClarifications(authored, input, deps, selfResolveClarifications);
+    const goalFile = await intakeClarifications({
+      ...authored,
+      path: isAbsolutePath(authored.path) ? authored.path : resolvePath(deps.cwd(), authored.path),
+    }, input, deps, selfResolveClarifications);
+    // The child reads this file again. Filtering only preflight.paths would leave the same bogus
+    // TRACED PATHS prose in the child and repeat its missing-file failure.
+    let sanitizeFailed = false;
+    let sanitizeFailure: unknown;
+    if (existsSync(goalFile)) {
+      try {
+        const original = deps.readFile(goalFile);
+        const sanitized = discardNonFileTracedPathItems(original, deps.cwd());
+        if (sanitized.dropped.length > 0) {
+          // The child reads this same file, so a failed rewrite must stop launch.
+          (deps.writeGoalDocument ?? deps.writeFile)(goalFile, sanitized.document);
+          for (const dropped of sanitized.dropped) {
+            try { debug.log('harness.preflight', 'traced-path-discarded', { goalFile, dropped }); }
+            catch { /* observation must not change launch */ }
+          }
+        }
+      } catch (error) {
+        sanitizeFailed = true;
+        sanitizeFailure = error;
+      }
+    }
     const preflightDeps = await deps.buildPreflightDeps();
     observeLaunchingTree(deps, preflightDeps);
     const askOutsidePathHints = parseAskTargetPathHintsResult(input.askText).paths;
@@ -954,11 +981,11 @@ export async function runAskLaunchFlow(
         ...(machineSuggestedTargetPaths.length > 0 ? { machineSuggestedTargetPaths } : {}),
         declaredPathsRoot: deps.cwd(),
       },
-      preflightDeps,
+      sanitizeFailed ? { ...preflightDeps, readGoalDocument: () => { throw sanitizeFailure; } } : preflightDeps,
       input.forceRequested,
     );
     const preflight = decision.result;
-    deps.print(renderLaunchPreflight(preflight, input.forceRequested && preflight.blockers.length > 0, 'before-launch'));
+    deps.print(renderLaunchPreflight(preflight, input.forceRequested && decision.shouldLaunch && preflight.blockers.length > 0, 'before-launch'));
     observeLaunchPreflight(deps, 'before-launch', decision);
     // ⛔ 자식 격리 worktree를 만들기 전, 이 흐름을 호출한 작업 트리에서만 센다.
     //    이 관측은 발사 판정의 입력이 아니다 — 의도적으로 옛 판에서 쏘는 경우도 있다.
@@ -1001,7 +1028,7 @@ export async function runAskLaunchFlow(
       liveRunWindowMs: preflight.liveRunWindowMs,
       // ⛔ 「플래그를 줬다」와 「실제로 뚫었다」는 다른 값이다(리뷰 should-fix).
       forceRequested: input.forceRequested,
-      bypassed: input.forceRequested && preflight.blockers.length > 0,
+      bypassed: input.forceRequested && decision.shouldLaunch && preflight.blockers.length > 0,
     }, preflight.blockers.length > 0 ? 'warn' : 'info');
     return { goalFile, decision };
   };
@@ -1023,14 +1050,27 @@ export async function runAskLaunchFlow(
       } catch (error) {
         candidates = { tokens: [], paths: [], error: error instanceof Error ? error.message : String(error) };
       }
+      const selectedPath = candidates.selection?.path
+        ?? (!candidates.selection && candidates.paths.length === 1 ? candidates.paths[0] : undefined);
+      const selectionReason = candidates.selection?.reason
+        ?? (candidates.error ? 'search-error' : selectedPath ? 'only-candidate'
+          : candidates.paths.length > 0 ? 'ambiguous-without-evidence' : 'no-candidates');
       deps.log('ask-auto-target-candidates', {
         tokens: candidates.tokens, paths: candidates.paths,
+        evidence: candidates.evidence ?? [],
+        selection: { path: selectedPath ?? null, reason: selectionReason },
         ...(candidates.error === undefined ? {} : { error: candidates.error }),
-      }, candidates.error === undefined ? 'info' : 'warn');
+      }, candidates.error === undefined && selectedPath ? 'info' : 'warn');
     }
-    const selectedPaths = candidates.paths.slice(0, 1);
+    const selectedPaths = candidates.selection?.path
+      ? [candidates.selection.path]
+      : !candidates.selection && candidates.paths.length === 1 ? [candidates.paths[0]!] : [];
     if (selectedPaths.length > 0) {
       deps.print(`[ask] ⑴ 코드에서 후보 경로 ${selectedPaths.length}개를 찾아 넣고 다시 저작한다: ${selectedPaths.join(' · ')}`);
+    } else if (candidates.paths.length > 0) {
+      deps.print(`[ask] ⑴ ⚠️ 후보 경로를 하나로 판정할 근거가 없다. 대상 경로를 확인해야 한다: ${candidates.paths.join(' · ')}`);
+    } else {
+      deps.print('[ask] ⑴ ⚠️ 자동 재저작에 넣을 대상 경로 후보가 없다. 대상 경로를 확인해야 한다');
     }
     authored = await authorAndPreflight(selectedPaths.length > 0
       ? `대상 경로: ${selectedPaths.join(' · ')}\n${input.askText}`

package/src/self-dev/ask-path-candidates.ts

@@ -1,15 +1,31 @@
 import { execFileSync } from 'node:child_process';
 import { statSync } from 'node:fs';
-import { isAbsolute, relative, resolve } from 'node:path';
+import { basename, extname, isAbsolute, relative, resolve } from 'node:path';
 
 export interface AskPathCandidateOptions {
   readonly cwd: string;
   readonly run?: (command: string, args: readonly string[], options: { cwd: string; encoding: 'utf8' }) => string;
 }
 
-export type AskPathCandidates =
-  | { readonly tokens: string[]; readonly paths: string[]; readonly error?: undefined }
-  | { readonly tokens: string[]; readonly paths: string[]; readonly error: string };
+export interface AskPathCandidates {
+  readonly tokens: string[];
+  readonly paths: string[];
+  readonly evidence?: AskPathEvidence[];
+  readonly selection?: AskPathSelection;
+  readonly error?: string;
+}
+
+export interface AskPathEvidence {
+  readonly path: string;
+  readonly pathTokens: string[];
+  readonly strongestPathMatch: 'explicit-file' | 'filename' | 'directory' | null;
+  readonly contentTokens: string[];
+  readonly score: number;
+}
+
+export type AskPathSelection =
+  | { readonly path: string; readonly reason: 'unique-strongest-evidence' }
+  | { readonly path: null; readonly reason: 'tied-strongest-evidence' };
 
 const STOP_WORDS = new Set(['the', 'and', 'test', 'src', 'scripts', 'file', 'path', 'paths', 'code', 'with', 'from', 'this', 'that', 'into', 'for', 'then', 'when', 'have', 'does', 'should', 'will', 'please', 'target', 'change']);
 const WORD = /[-/]?[A-Za-z][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*/g;
@@ -63,7 +79,15 @@ function existingFile(fragment: string, cwd: string): string | null {
 
 /** Find existing code paths by lexical evidence from an unmodified ask. */
 export function findAskPathCandidates(askText: string, { cwd, run = execFileSync }: AskPathCandidateOptions): AskPathCandidates {
-  const scores = new Map<string, Set<string>>();
+  const scores = new Map<string, { explicit: Set<string>; filename: Set<string>; directory: Set<string>; content: Set<string> }>();
+  const hitsFor = (path: string) => {
+    let hits = scores.get(path);
+    if (!hits) {
+      hits = { explicit: new Set(), filename: new Set(), directory: new Set(), content: new Set() };
+      scores.set(path, hits);
+    }
+    return hits;
+  };
   const tokens: string[] = [];
   const seen = new Set<string>();
   const body = stripAskWrapper(askText);
@@ -73,11 +97,7 @@ export function findAskPathCandidates(askText: string, { cwd, run = execFileSync
       const raw = match[0];
       const token = raw.replace(/^\//, '');
       const file = existingFile(token, cwd);
-      if (file) {
-        const hits = scores.get(file) ?? new Set<string>();
-        hits.add(token);
-        scores.set(file, hits);
-      }
+      if (file) hitsFor(file).explicit.add(token);
       if (STOP_WORDS.has(token.toLowerCase()) || isGenericToken(token) || seen.has(token)) continue;
       if (!file && !token.includes('/') && !token.includes('.') && !token.includes('-') && !token.includes('_')
         && !/[a-z][A-Z]/.test(token) && token.length < 4) continue;
@@ -85,6 +105,24 @@ export function findAskPathCandidates(askText: string, { cwd, run = execFileSync
       tokens.push(token);
     }
   }
+  if (tokens.length > 0) {
+    let files: string;
+    try {
+      files = run('rg', ['--files', '--glob', '!*.test.ts', 'src', 'scripts'], { cwd, encoding: 'utf8' });
+    } catch (error) {
+      if ((error as { status?: number }).status === 1) files = '';
+      else return { tokens, paths: [], error: error instanceof Error ? error.message : String(error) };
+    }
+    for (const path of files.split(/\r?\n/).filter(Boolean)) {
+      const fileStem = basename(path, extname(path)).toLowerCase();
+      const directories = path.toLowerCase().split('/').slice(0, -1);
+      for (const token of tokens) {
+        const lower = token.toLowerCase();
+        if (fileStem === lower || basename(path).toLowerCase() === lower) hitsFor(path).filename.add(token);
+        else if (directories.includes(lower)) hitsFor(path).directory.add(token);
+      }
+    }
+  }
   for (const token of tokens) {
     let matches: string;
     try {
@@ -94,13 +132,30 @@ export function findAskPathCandidates(askText: string, { cwd, run = execFileSync
       return { tokens, paths: [], error: error instanceof Error ? error.message : String(error) };
     }
     for (const path of matches.split(/\r?\n/).filter(Boolean)) {
-      const hits = scores.get(path) ?? new Set<string>();
-      hits.add(token);
-      scores.set(path, hits);
+      hitsFor(path).content.add(token);
     }
   }
+  const evidence = [...scores].map<AskPathEvidence>(([path, hits]) => {
+    const tier = hits.explicit.size > 0 ? 3 : hits.filename.size > 0 ? 2 : hits.directory.size > 0 ? 1 : 0;
+    return {
+      path,
+      pathTokens: [...new Set([...hits.explicit, ...hits.filename, ...hits.directory])],
+      strongestPathMatch: tier === 3 ? 'explicit-file' : tier === 2 ? 'filename' : tier === 1 ? 'directory' : null,
+      contentTokens: [...hits.content],
+      // Lexicographic tiers: even many directory hits cannot outrank one filename hit.
+      score: tier * 1000 + Math.min(hits.explicit.size + hits.filename.size + hits.directory.size, 9) * 100
+        + Math.min(hits.content.size, 99),
+    };
+  }).sort((a, b) => b.score - a.score || a.path.localeCompare(b.path, 'en'));
+  const top = evidence[0];
   return {
     tokens,
-    paths: [...scores].sort(([a, aHits], [b, bHits]) => bHits.size - aHits.size || a.localeCompare(b, 'en')).slice(0, 5).map(([path]) => path),
+    paths: evidence.slice(0, 5).map(({ path }) => path),
+    ...(top ? {
+      evidence: evidence.slice(0, 5),
+      selection: evidence[1]?.score === top.score
+        ? { path: null, reason: 'tied-strongest-evidence' as const }
+        : { path: top.path, reason: 'unique-strongest-evidence' as const },
+    } : {}),
   };
 }