elanous 0.2.27 → 0.2.29

package/src/msg/msg-store.ts

@@ -8,6 +8,7 @@ export interface MessageEnvelope {
   to: string;
   body: string;
   kind?: string;
+  replyTo?: number;
 }
 
 export interface Message extends MessageEnvelope {
@@ -46,8 +47,16 @@ export function validateMessageEnvelope(input: unknown): MessageEnvelope {
   if (record.kind !== undefined && (typeof record.kind !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(record.kind))) {
     throw new Error('invalid message kind');
   }
-  if (Object.keys(record).some(key => !['from', 'to', 'body', 'kind'].includes(key))) throw new Error('unknown message field');
-  return record.kind === undefined ? { from, to, body: record.body } : { from, to, body: record.body, kind: record.kind as string };
+  const replyTo = record.replyTo;
+  if (replyTo !== undefined && (typeof replyTo !== 'number' || !Number.isSafeInteger(replyTo) || replyTo < 1)) {
+    throw new Error('replyTo must be a positive integer message ID');
+  }
+  if (Object.keys(record).some(key => !['from', 'to', 'body', 'kind', 'replyTo'].includes(key))) throw new Error('unknown message field');
+  return {
+    from, to, body: record.body,
+    ...(record.kind === undefined ? {} : { kind: record.kind as string }),
+    ...(replyTo === undefined ? {} : { replyTo }),
+  };
 }
 
 function validCursor(cursor: number): number {
@@ -68,28 +77,45 @@ interface MessageRow {
   recipient: string;
   body: string;
   kind: string | null;
+  reply_to: number | null;
   created_at: string;
 }
 
 function fromRow(row: MessageRow): Message {
   return { id: row.id, from: row.sender, to: row.recipient, body: row.body,
-    ...(row.kind === null ? {} : { kind: row.kind }), createdAt: row.created_at };
+    ...(row.kind === null ? {} : { kind: row.kind }),
+    ...(row.reply_to == null ? {} : { replyTo: row.reply_to }),
+    createdAt: row.created_at };
 }
 
 /** SQLite owns both append order and per-recipient acknowledgement progress. */
 export class MsgStore {
   readonly db: Database;
 
-  constructor(path: string = defaultMsgStorePath()) {
-    if (path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    this.db = new Database(path);
+  // A read-only SSE connection may outlive another process's in-place migration.
+  private get hasReplyTo(): boolean {
+    return (this.db.query(`SELECT COUNT(*) AS count FROM pragma_table_info('msg_messages') WHERE name = 'reply_to'`)
+      .get() as { count: number }).count > 0;
+  }
+
+  private readWithSchema<T>(read: (hasReplyTo: boolean) => T): T {
+    // The schema projection and rows must share one SQLite snapshot. Otherwise a writer can
+    // migrate between them and a reader could advance past a reply with its link erased.
+    return this.db.transaction(() => read(this.hasReplyTo)).deferred();
+  }
+
+  constructor(path: string = defaultMsgStorePath(), options: { readOnly?: boolean } = {}) {
+    if (options.readOnly && (path === ':memory:' || !existsSync(path))) throw new Error('message ledger unavailable for read-only SSE service');
+    if (!options.readOnly && path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    this.db = options.readOnly ? new Database(path, { readonly: true }) : new Database(path);
     this.db.exec('PRAGMA busy_timeout = 5000');
-    this.db.exec(`CREATE TABLE IF NOT EXISTS msg_messages (
+    if (!options.readOnly) this.db.exec(`CREATE TABLE IF NOT EXISTS msg_messages (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       sender TEXT NOT NULL,
       recipient TEXT NOT NULL,
       body TEXT NOT NULL,
       kind TEXT,
+      reply_to INTEGER,
       created_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS idx_msg_messages_recipient_id ON msg_messages(recipient, id);
@@ -101,21 +127,28 @@ export class MsgStore {
       provenance_key TEXT PRIMARY KEY,
       message_id INTEGER NOT NULL REFERENCES msg_messages(id)
     );`);
+    // Serialize the schema check and ALTER across processes opening an old ledger at once.
+    if (!options.readOnly) this.db.transaction(() => {
+      const replyToColumn = (this.db.query(`SELECT COUNT(*) AS count FROM pragma_table_info('msg_messages') WHERE name = 'reply_to'`)
+        .get() as { count: number }).count;
+      if (replyToColumn === 0) this.db.exec('ALTER TABLE msg_messages ADD COLUMN reply_to INTEGER');
+      this.db.exec('CREATE INDEX IF NOT EXISTS idx_msg_messages_reply_to ON msg_messages(reply_to, id)');
+    }).immediate();
   }
 
   append(input: MessageEnvelope): Message {
     return this.insertMessage(input);
   }
 
-  /** Append once for a provenance key such as coord:<commentId>:<recipient>. */
+  /** Append once for a coordination comment or a task failure incident. */
   appendWithProvenance(input: MessageEnvelope, provenanceKey: string): Message {
-    if (typeof provenanceKey !== 'string' || !/^coord:[^:]+:[^:]+$/.test(provenanceKey)) {
+    if (typeof provenanceKey !== 'string' || !/^(?:coord|ta-failure):[^:]+:[^:]+$/.test(provenanceKey)) {
       throw new Error('invalid message provenance key');
     }
     const msg = validateMessageEnvelope(input);
     if (provenanceKey.split(':')[2] !== msg.to) throw new Error('provenance recipient does not match message recipient');
     return this.db.transaction(() => {
-      const existing = this.db.query(`SELECT m.id, m.sender, m.recipient, m.body, m.kind, m.created_at
+      const existing = this.db.query(`SELECT m.id, m.sender, m.recipient, m.body, m.kind, m.reply_to, m.created_at
         FROM msg_provenance p JOIN msg_messages m ON m.id = p.message_id WHERE p.provenance_key = ?`)
         .get(provenanceKey) as MessageRow | null;
       if (existing) return fromRow(existing);
@@ -128,9 +161,12 @@ export class MsgStore {
 
   private insertMessage(input: MessageEnvelope): Message {
     const msg = validateMessageEnvelope(input);
+    if (msg.replyTo !== undefined && this.db.query('SELECT 1 FROM msg_messages WHERE id = ?').get(msg.replyTo) === null) {
+      throw new Error(`reply target not found: #${msg.replyTo}`);
+    }
     const createdAt = new Date().toISOString();
-    const result = this.db.query(`INSERT INTO msg_messages(sender, recipient, body, kind, created_at)
-      VALUES (?, ?, ?, ?, ?)`).run(msg.from, msg.to, msg.body, msg.kind ?? null, createdAt);
+    const result = this.db.query(`INSERT INTO msg_messages(sender, recipient, body, kind, reply_to, created_at)
+      VALUES (?, ?, ?, ?, ?, ?)`).run(msg.from, msg.to, msg.body, msg.kind ?? null, msg.replyTo ?? null, createdAt);
     return { id: Number(result.lastInsertRowid), ...msg, createdAt };
   }
 
@@ -142,15 +178,48 @@ export class MsgStore {
     if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     validCursor(after);
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
-    return (this.db.query(`SELECT id, sender, recipient, body, kind, created_at FROM msg_messages
+    return this.readWithSchema(hasReplyTo => (this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
       WHERE id > ? AND (recipient = ? OR (recipient = 'ALL' AND sender <> ?))
-      ORDER BY id ASC LIMIT ?`).all(after, to, to, limit) as MessageRow[]).map(fromRow);
+      ORDER BY id ASC LIMIT ?`).all(after, to, to, limit) as MessageRow[]).map(fromRow));
+  }
+
+  /** One message by durable ID, or null when absent. */
+  getMessage(messageId: number): Message | null {
+    if (!Number.isSafeInteger(messageId) || messageId < 1) throw new Error('message ID must be a positive integer');
+    return this.readWithSchema(hasReplyTo => {
+      const row = this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+        WHERE id = ?`).get(messageId) as MessageRow | null;
+      return row === null ? null : fromRow(row);
+    });
+  }
+
+  /** Replies pointing at the supplied message, ordered by durable insertion ID. */
+  listReplies(messageId: number, limit: number = 100, afterId: number = 0): Message[] {
+    if (!Number.isSafeInteger(messageId) || messageId < 1) throw new Error('message ID must be a positive integer');
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
+    validCursor(afterId);
+    return this.readWithSchema(hasReplyTo => hasReplyTo
+      ? (this.db.query(`SELECT id, sender, recipient, body, kind, reply_to, created_at FROM msg_messages
+        WHERE reply_to = ? AND id > ? ORDER BY id ASC LIMIT ?`).all(messageId, afterId, limit) as MessageRow[]).map(fromRow)
+      : []);
   }
 
   list(recipient: string, after: number = 0, limit: number = 100): Message[] {
     return this.listByRecipient(recipient, after, limit);
   }
 
+  /** One ordered scan for every SSE subscriber; recipient filtering happens in the server. */
+  listAfter(after: number, limit: number = 1000): Message[] {
+    validCursor(after);
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
+    return this.readWithSchema(hasReplyTo => (this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+      WHERE id > ? ORDER BY id ASC LIMIT ?`).all(after, limit) as MessageRow[]).map(fromRow));
+  }
+
+  latestId(): number {
+    return (this.db.query('SELECT COALESCE(MAX(id), 0) AS id FROM msg_messages').get() as { id: number }).id;
+  }
+
   getCursor(recipient: string): number {
     const to = canonicalSeatId(recipient);
     if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
@@ -199,6 +268,7 @@ export class MsgStore {
 
 export function defaultMsgStorePath(): string { return join(elanousStateRoot(), 'msg', 'messages.db'); }
 export function openMsgStore(path?: string): MsgStore { return new MsgStore(path); }
+export function openMsgStoreReadOnly(path?: string): MsgStore { return new MsgStore(path, { readOnly: true }); }
 
 /** Observe one recipient without creating a store or advancing its acknowledgement. */
 export function readUnreadCount(recipient: string, path: string = defaultMsgStorePath()): number | null {

package/src/native-tool-catalog.ts

@@ -388,6 +388,131 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
     alwaysLoad: false,
     shouldDefer: true,
   },
+  // ── Ops-ledger native tools (우편 msg · 판 release checklist) ──────────────
+  // OP TUI turns drove msg list/post/ack and release checklist
+  // list/move/set/add through `eln` RunShell calls — 1.3–2s of CLI
+  // startup each, 30+ spawns per turn, shell stdout amplifying screen
+  // defects. These eight tools reuse the SAME durable services
+  // in-process (msg-store SQLite ledger · release-loop checklist
+  // ledger), preserving the structured results, the seat/OP permission
+  // boundaries (ELANOUS_TRACK actor routing, seatMove rules, the HQ
+  // lease fence) and the claim-history audit. Every call is a local
+  // ledger read/write — no process spawn, no network, no running-runs
+  // sweep — so a TUI OP turn needs zero RunShell round-trips (RunShell
+  // steers these exact CLI shapes to the native tools; see
+  // src/skills/tools/shell.ts). Dispatchers: src/skills/tools/ops-ledger.ts.
+  {
+    id: 'msg_list',
+    kind: 'other',
+    aliases: ['MsgList', 'msg_list'],
+    displayName: 'MsgList',
+    description: 'List durable seat-addressed messages for one recipient WITHOUT acknowledging them. Same SQLite ledger as `elanous msg list`, in-process — no CLI startup. Reading never advances the acknowledgement cursor; `after` pages beyond it.',
+    promptSummary: '`MsgList(to, after?, limit?)` (durable seat mailbox listing · read never acks · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['read-only'],
+    supportsParallel: true,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'msg_post',
+    kind: 'other',
+    aliases: ['MsgPost', 'msg_post'],
+    displayName: 'MsgPost',
+    description: 'Post a durable seat-addressed message. Same SQLite ledger as `elanous msg post`, in-process — no CLI startup. ALL may receive but never send; `kind` tags the message; `replyTo` points a reply at a question message ID.',
+    promptSummary: '`MsgPost(from, to, body, kind?, replyTo?)` (post durable seat message · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'msg_ack',
+    kind: 'other',
+    aliases: ['MsgAck', 'msg_ack'],
+    displayName: 'MsgAck',
+    description: 'Acknowledge durable messages for one recipient through an ID, advancing their cursor so later MsgList calls start after them. Same SQLite ledger as `elanous msg ack`, in-process.',
+    promptSummary: '`MsgAck(to, id)` (advance a seat’s ack cursor through id · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_list',
+    kind: 'other',
+    aliases: ['ChecklistList', 'checklist_list'],
+    displayName: 'ChecklistList',
+    description: 'List the release-checklist cells for one version with per-status summary, blocked cells, per-owner counts and screen-parity warnings. Same ledger as `elanous release checklist list --json`, in-process. Read-only.',
+    promptSummary: '`ChecklistList(version?, owner?)` (판 checklist snapshot + summary + parity · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['read-only'],
+    supportsParallel: true,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_add',
+    kind: 'other',
+    aliases: ['ChecklistAdd', 'checklist_add'],
+    displayName: 'ChecklistAdd',
+    description: 'Add one cell to a release checklist (owner · priority · deadlineVersion · predecessors · refs; kind/dispatchKind/CEO load/accelerator afterwards via ChecklistEdit). Same ledger, HQ lease fence and claim-history audit as `elanous release checklist add`, in-process.',
+    promptSummary: '`ChecklistAdd(id, title, version?, owner?, kind?, …)` (add a release checklist cell · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_set',
+    kind: 'other',
+    aliases: ['ChecklistSet', 'checklist_set'],
+    displayName: 'ChecklistSet',
+    description: 'Set one release-checklist cell’s status and/or evidence line (⊕ additive refs). Same ledger, HQ lease fence, actor audit and screen-parity warning as `elanous release checklist set`, in-process. Other metadata goes through ChecklistEdit.',
+    promptSummary: '`ChecklistSet(id, version?, status?, evidence?, refs?)` (cell status/evidence · seat-audited · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_edit',
+    kind: 'other',
+    aliases: ['ChecklistEdit', 'checklist_edit'],
+    displayName: 'ChecklistEdit',
+    description: 'Change exactly one metadata field of a release-checklist cell (owner · priority · disposition · kind · dispatchKind · deadlineVersion · predecessors · ceoMinutes · ceoDate · accelerator) — one field per call so a model that fills every property cannot clobber the rest. Same ledger, HQ lease fence and actor audit as `elanous release checklist set`, in-process.',
+    promptSummary: '`ChecklistEdit(id, field, value, version?)` (one cell metadata field · seat-audited · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
+  {
+    id: 'checklist_move',
+    kind: 'other',
+    aliases: ['ChecklistMove', 'checklist_move'],
+    displayName: 'ChecklistMove',
+    description: 'Move one checklist cell to another release version in a single transaction. Permission routing preserved: a seat moves only its own cell into the next version (capacity-checked), OP moves unrestricted, no ELANOUS_TRACK runs unchecked as anonymous. Same ledger and history audit as `elanous release checklist move`, in-process.',
+    promptSummary: '`ChecklistMove(id, from, to, reason)` (move a cell across versions · seat/OP rules preserved · in-process)',
+    host: ['skill', 'tui'],
+    safety: ['mutating'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+    cleanerFitThanShell: true,
+  },
   // Input-policy tools — Phase 6 of the unified-input plan.
   // SetInputMode is mutating but side-effect is tiny (context tag +
   // onEnter/onExit). GetInputPolicy is read-only. SetInputBinding is

package/src/nexus/api/http-server.ts

@@ -176,6 +176,7 @@ import { dispatchPersonaRoute } from './personas.js';
 import { handleMe, operatorSignal } from './operator.js';
 import { handleGraphRunRoute } from '../../graph-runner/graph-run-api.js';
 import { handleOpsApi } from './ops-api.js';
+import { handleProjectAutopsy } from './project-autopsy.js';
 import { handleRoleJudge } from './role-judge.js';
 import { handleAudioStt } from './audio-stt.js';
 import { handleLlmModels } from './llm-models.js';
@@ -1499,6 +1500,10 @@ export async function routeRequest(
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return method === 'GET' ? handleProjectsGet() : handleProjectsPost(req);
   }
+  if (pathname.startsWith('/v1/projects/') && pathname.endsWith('/autopsy') && method === 'GET') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    return handleProjectAutopsy(req, pathname.slice('/v1/projects/'.length, pathname.length - '/autopsy'.length));
+  }
 
   // Polling must remain outside the non-GET dispatch below.
   if (method === 'GET' && pathname.startsWith(`${SKILL_EXEC_PATH}/`) && !pathname.slice(SKILL_EXEC_PATH.length + 1).includes('/')) {

package/src/nexus/api/ops-api.ts

@@ -131,6 +131,8 @@ export function releaseNodeFacts(output: unknown): ReleaseNodeFacts {
 }
 export interface ReleaseRunView {
   runId: string; status: string; startedAt: string; version: string | null; path: string[]; nodes: ReleaseRunNodeView[];
+  /** Explicit project ownership. The release ledger does not currently populate this field. */
+  projectId?: string;
   /** GATE-LIVE-OBS — 지금 gate 노드에 있는 런에만 싣는다(발행 원장 `gate-logs/cut/shards.json`). 파일이 없으면 생략. */
   gateShards?: GateShardsFile & { summary: GateShardsSummary };
 }

package/src/nexus/api/project-autopsy.ts

@@ -0,0 +1,127 @@
+import { jsonResponse } from './json-response.js';
+import { readReleaseRuns, type ReleaseRunView } from './ops-api.js';
+import { listPendingApprovals, type PendingApprovalSummary } from './workflow-approvals.js';
+import { getProject, type Project } from '../../project/project-store.js';
+import { classifyMergeFailure, type MergeFailureKind } from '../../self-implement/regate-detail.js';
+
+/** One failed node of a release run explicitly assigned to the project. */
+export interface ProjectAutopsyFailure {
+  runId: string;
+  nodeId: string;
+  summary: string;
+  kind: MergeFailureKind;
+  status: string;
+  startedAt?: string;
+  endedAt?: string;
+  verdict?: string;
+}
+
+/** Failure-kind rollup across the project's failed rows (desc by count, kind asc). */
+export interface ProjectAutopsyCause {
+  kind: MergeFailureKind;
+  count: number;
+  runs: string[];
+}
+
+/** A project's autopsy: failed rows + causes + pending proposals, read-only over the existing ledgers. */
+export interface ProjectAutopsyReport {
+  project: { id: string; name: string; primaryFolder?: string };
+  attribution: { status: 'measured' | 'partial' | 'unavailable'; reason?: 'ledger-project-id-missing' };
+  coverage: { failuresTruncated: boolean; proposalsTruncated: boolean; causeCounts: 'returned-failures' };
+  failures: ProjectAutopsyFailure[];
+  causes: ProjectAutopsyCause[];
+  proposals: PendingApprovalSummary[];
+  pendingApprovals: number;
+}
+
+export interface ProjectAutopsyDeps {
+  getProject?: (id: string) => Project | null;
+  readRuns?: (version: string | null) => ReleaseRunView[] | 'unavailable';
+  listApprovals?: () => PendingApprovalSummary[];
+}
+
+const FAILURE_LIMIT = 50;
+const PROPOSAL_LIMIT = 20;
+const PROJECT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+const defaultReadRuns = (version: string | null): ReleaseRunView[] | 'unavailable' =>
+  readReleaseRuns(version, undefined, { facts: true });
+
+function projectViewOf(project: Project): ProjectAutopsyReport['project'] {
+  return {
+    id: project.id,
+    name: project.name,
+    ...(project.primaryFolder !== undefined ? { primaryFolder: project.primaryFolder } : {}),
+  };
+}
+
+/** GET /v1/projects/:id/autopsy — 실패·원인·제안 rows for one project, fail-soft per the ops-route pattern. */
+export function handleProjectAutopsy(req: Request, rawId: string, deps: ProjectAutopsyDeps = {}): Response {
+  if (req.method !== 'GET') return jsonResponse({ error: 'method-not-allowed' }, 405);
+  let projectId: string;
+  try {
+    projectId = decodeURIComponent(rawId);
+  } catch {
+    return jsonResponse({ error: 'bad_request', reason: 'invalid project id' }, 400);
+  }
+  if (!PROJECT_ID.test(projectId)) return jsonResponse({ error: 'bad_request', reason: 'invalid project id' }, 400);
+  const project = (deps.getProject ?? getProject)(projectId);
+  if (!project) return jsonResponse({ error: 'not-found' }, 404);
+  const pending = deps.listApprovals ? deps.listApprovals() : listPendingApprovals();
+  const runs = (deps.readRuns ?? defaultReadRuns)(null);
+  if (runs === 'unavailable') return jsonResponse({ error: 'runs-unavailable' }, 500);
+  if (!runs.some((run) => Boolean(run.projectId))) {
+    return jsonResponse({ project: projectViewOf(project),
+      attribution: { status: 'unavailable', reason: 'ledger-project-id-missing' },
+      coverage: { failuresTruncated: false, proposalsTruncated: false, causeCounts: 'returned-failures' },
+      failures: [], causes: [], proposals: [], pendingApprovals: 0 });
+  }
+  const unattributed = runs.some((run) => !run.projectId) || pending.some((approval) => !approval.projectId);
+  const attributed = runs.some((run) => Boolean(run.projectId)) || pending.some((approval) => Boolean(approval.projectId));
+  const attribution: ProjectAutopsyReport['attribution'] = unattributed || !attributed
+    ? { status: attributed ? 'partial' : 'unavailable', reason: 'ledger-project-id-missing' }
+    : { status: 'measured' };
+  const failures: ProjectAutopsyFailure[] = [];
+  for (const run of runs) {
+    if (run.projectId !== project.id) continue;
+    for (const node of run.nodes) {
+      if (node.ok !== false) continue;
+      failures.push({
+        runId: run.runId,
+        nodeId: node.nodeId,
+        summary: node.summary,
+        kind: classifyMergeFailure(node.summary),
+        status: run.status,
+        ...(node.startedAt !== undefined ? { startedAt: node.startedAt } : {}),
+        ...(node.endedAt !== undefined ? { endedAt: node.endedAt } : {}),
+        ...(node.facts?.verdict !== undefined ? { verdict: node.facts.verdict } : {}),
+      });
+      if (failures.length > FAILURE_LIMIT) break;
+    }
+    if (failures.length > FAILURE_LIMIT) break;
+  }
+  const failuresTruncated = failures.length > FAILURE_LIMIT;
+  if (failuresTruncated) failures.length = FAILURE_LIMIT;
+  const counts = new Map<MergeFailureKind, { count: number; runs: Set<string> }>();
+  for (const failure of failures) {
+    const entry = counts.get(failure.kind) ?? { count: 0, runs: new Set<string>() };
+    entry.count += 1;
+    entry.runs.add(failure.runId);
+    counts.set(failure.kind, entry);
+  }
+  const causes: ProjectAutopsyCause[] = [...counts.entries()]
+    .map(([kind, entry]) => ({ kind, count: entry.count, runs: [...entry.runs].sort() }))
+    .sort((a, b) => b.count - a.count || (a.kind < b.kind ? -1 : 1));
+  const projectApprovals = pending.filter((summary) => summary.projectId === project.id);
+  const proposals = projectApprovals.slice(0, PROPOSAL_LIMIT);
+  return jsonResponse({
+    project: projectViewOf(project),
+    attribution,
+    coverage: { failuresTruncated, proposalsTruncated: projectApprovals.length > PROPOSAL_LIMIT,
+      causeCounts: 'returned-failures' },
+    failures,
+    causes,
+    proposals,
+    pendingApprovals: projectApprovals.length,
+  });
+}

package/src/nexus/api/terminals.ts

@@ -74,6 +74,7 @@ export interface TerminalSummary {
   cmd: string;
   workdir?: string;
   nickname?: string;
+  purpose?: string;
   treeName: string;
   worktreeName: string;
   parentPtyId: string;
@@ -278,6 +279,7 @@ function summarize(
     cmd: handle.cmd,
     ...(handle.workdir ? { workdir: handle.workdir } : {}),
     ...(manifest?.nickname ? { nickname: manifest.nickname } : {}),
+    ...(manifest?.purpose ? { purpose: manifest.purpose } : {}),
     ...names,
     parentPtyId: manifest?.parentPtyId ?? '',
     parentPid: manifest?.parentPid ?? 0,
@@ -322,6 +324,7 @@ function summarizeManifest(
     id: row.id, cmd: row.cmd,
     ...(row.workdir ? { workdir: row.workdir } : {}),
     ...(row.nickname ? { nickname: row.nickname } : {}),
+    ...(row.purpose ? { purpose: row.purpose } : {}),
     ...terminalTreeNames(row.workdir),
     parentPtyId: row.parentPtyId, parentPid: row.parentPid, parentKind: row.parentKind, runId: row.runId,
     ...(row.chainOrigin === undefined ? {} : { chainOrigin: row.chainOrigin }),

package/src/nexus/api/workflow-approvals.ts

@@ -21,6 +21,8 @@ export interface PendingApprovalSummary {
   runId: string;
   message: string;
   requestedAt: number;
+  /** Explicit project ownership. The approval registry does not currently populate this field. */
+  projectId?: string;
 }
 
 interface PendingApprovalEntry extends PendingApprovalSummary {

package/src/nexus/onboarding/first-boot-wizard.ts

@@ -1,6 +1,7 @@
 import type { WizardIO } from '../../onboarding.js';
 import type { SetupCheckResult } from '../setup-status.js';
 import type { TailscaleProbe } from './tailscale-probe.js';
+import { createManagementStarterContract } from '../../persona/presets.js';
 
 export interface FirstBootWizardDeps {
   io: WizardIO;
@@ -18,14 +19,32 @@ export interface FirstBootWizardDeps {
   pwaBuilt?: boolean;
   /** Tailscale probe 결과 (alive 시 magicDNS / IP 도 banner 에 노출). */
   tailscale?: TailscaleProbe;
+  /** 0.2.29 PERSONA-STARTER — «경영» 스타터 계약을 쓸 persona 저장소 경로.
+   *  생략하면 기본 상태 저장소(resolveStatePersonaDir) — 운영 첫 실행 경로. */
+  starterContractDir?: string;
 }
 
 export type FirstBootStep = 'llm' | 'tailscale';
 
+/** 0.2.29 PERSONA-STARTER — 직업 질문에서 «경영»을 골랐을 때 만들어진 스타터 계약 한 장. */
+export interface StarterContractSummary {
+  personaId: string;
+  displayName: string;
+  path: string;
+}
+
 export type FirstBootResult =
-  | { action: 'completed'; stepsRun: FirstBootStep[] }
+  | { action: 'completed'; stepsRun: FirstBootStep[]; starterContract?: StarterContractSummary }
   | { action: 'skipped'; reason: 'no-tty' | 'all-set-up' };
 
+/** 직업 질문 답의 정규화 — «1»·«경영»·«management» 는 경영,
+ *  나머지(빈 답 포함)는 일반(현재 첫 실행 동작 유지). */
+export function normalizeOccupationChoice(input: string): 'management' | 'general' {
+  const v = input.trim().toLowerCase();
+  if (v === '1' || v === '경영' || v === 'management') return 'management';
+  return 'general';
+}
+
 function isTty(force?: boolean): boolean {
   if (force === true) return true;
   if (force === false) return false;
@@ -89,6 +108,39 @@ function printPwaSetupBanner(deps: FirstBootWizardDeps): void {
   deps.io.print('');
 }
 
+/** 0.2.29 PERSONA-STARTER — 직업 질문. «경영»이면 경영 스타터 계약 한 장을
+ *  만들고, 일반이면 계약 없이 현재 흐름 그대로. 계약 생성이 실패해도
+ *  wizard 결과는 completed 로 유지한다(fail-soft). */
+async function askOccupationAndCreateStarter(
+  deps: FirstBootWizardDeps,
+  out: { log: (s: string) => void; error: (s: string) => void },
+): Promise<StarterContractSummary | undefined> {
+  const io = deps.io;
+  if (io.nonInteractive) return undefined;
+  io.print('');
+  io.print('  어떤 일을 하세요? 고르면 스타터 계약 한 장을 만듭니다.');
+  io.print('    1) 경영 — 방향·판단·운영을 함께 세우는 경영 스타터');
+  io.print('    2) 일반 — 지금처럼 계속 (스타터 계약 없이)');
+  let answer: string;
+  try {
+    answer = await io.ask('  선택 (1/2 · Enter=일반): ');
+  } catch (err) {
+    out.error(`first-boot wizard: occupation question failed: ${(err as Error).message}`);
+    return undefined;
+  }
+  if (normalizeOccupationChoice(answer) !== 'management') return undefined;
+  try {
+    const written = createManagementStarterContract(
+      deps.starterContractDir ? { dir: deps.starterContractDir } : {},
+    );
+    io.print(`  ✓ 경영 스타터 계약이 만들어졌습니다: ${written.path}`);
+    return { personaId: written.personaId, displayName: written.displayName, path: written.path };
+  } catch (err) {
+    out.error(`first-boot wizard: starter contract failed: ${(err as Error).message}`);
+    return undefined;
+  }
+}
+
 export async function runFirstBootWizard(
   deps: FirstBootWizardDeps,
 ): Promise<FirstBootResult> {
@@ -127,5 +179,7 @@ export async function runFirstBootWizard(
     }
   }
 
-  return { action: 'completed', stepsRun };
+  const starterContract = await askOccupationAndCreateStarter(deps, out);
+
+  return { action: 'completed', stepsRun, ...(starterContract ? { starterContract } : {}) };
 }