elanous 0.2.37 → 0.2.40

package/src/loops/orchestrator/inbox-once.ts

@@ -0,0 +1,28 @@
+import { join } from 'node:path';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { resolveConfiguredAgentRoleLlm } from '../../user-config.js';
+import type { RoleLlmSpec } from '../../user-config.js';
+import { loadAgentRolePack } from '../agent-reply.js';
+import type { MsgStore } from '../../msg/msg-store.js';
+import { runAskOpContextInbox, runCoordinatorAgentInbox, type CoordinatorInboxResult } from './inbox.js';
+import type { AskOpContextBundle } from '../../context-bus/context-now.js';
+
+export interface InboxOnceOptions {
+  root?: string;
+  store?: MsgStore;
+  role?: RoleLlmSpec | null;
+  limit?: number;
+  context?: (question: string, options: { audience?: string; limit?: number }) => Promise<AskOpContextBundle>;
+}
+
+/** One scan of the same durable inbox as the orchestrator tick, without running its graph. */
+export async function runCoordinatorInboxOnce(options: InboxOnceOptions = {}): Promise<CoordinatorInboxResult> {
+  const root = options.root ?? effectiveInstanceRoot();
+  const path = join(root, 'msg', 'messages.db');
+  const role = options.role === undefined ? resolveConfiguredAgentRoleLlm('coordinator') : options.role;
+  if (role) return runCoordinatorAgentInbox({ role, pack: loadAgentRolePack('coordinator'), root, path,
+    limit: options.limit ?? 100, ...(options.store ? { store: options.store } : {}) });
+  return runAskOpContextInbox({ path, limit: options.limit ?? 100,
+    ...(options.store ? { store: options.store } : {}),
+    ...(options.context ? { context: options.context } : {}) });
+}

package/src/loops/orchestrator/inbox.ts

@@ -1,15 +1,90 @@
+import { ASK_OP_COMMAND } from '../../session/channel-ask-op-envelope.js';
 import { openMsgStore, type Message, type MsgStore } from '../../msg/msg-store.js';
 import { classifySeatTrafficProposal } from '../../seat-loop/traffic-signal.js';
-import { debug } from '../../debug/log.js';
+import { debug, redactSecretText } from '../../debug/log.js';
 import { LOOP_MESSAGE_ROUTES } from '../msg-address.js';
 import { replyWithAgent, type AgentReplyInput } from '../agent-reply.js';
 import { knowhowAdvice, type KnowhowAdvice, type KnowhowOptions } from './knowhow-pack.js';
 import type { RoleLlmSpec } from '../../user-config.js';
 import type { LLMProvider } from '../../llm.js';
+import { askOpContextBundle, type AskOpContextBundle } from '../../context-bus/context-now.js';
 
 const RECIPIENT = LOOP_MESSAGE_ROUTES.orchestrator.msgAddress;
 
 export interface CoordinatorInboxResult { replied: number; acknowledged: number }
+export interface AskOpTestHarness {
+  /** A test-only sink; this never defaults to a real surface transport. */
+  replySink: (reply: { from: string; to: string; body: string; kind: 'reply'; replyTo: number }) => Message;
+  /** Capture both clocks without writing to the production log store in tests. */
+  eventSink?: (event: { requestId: number; requestToReplyMs: number | null; processingMs: number }) => void;
+}
+export interface AskOpContextInboxOptions {
+  store?: MsgStore;
+  path?: string;
+  limit?: number;
+  context?: typeof askOpContextBundle;
+  knowhow?: KnowhowOptions | false;
+  /** Only the ordered tick scan may advance the durable cursor. */
+  acknowledge?: boolean;
+  /** SSE delivery handles exactly its message; the ordered tick scans the cursor. */
+  request?: Message;
+  /** Explicit opt-in for synthetic TEST ASK-OP questions only. Production callers must omit this. */
+  testHarness?: AskOpTestHarness;
+}
+
+const ASK_OP_SENDERS = new Set(['TELEGRAM', 'DISCORD']);
+const REFUSE = '모름 — 확인된 근거가 없어 답할 수 없습니다.';
+
+function isAskOpRequest(request: Message, allowTestSource = false): boolean {
+  const testSource = allowTestSource && request.from === 'TEST'
+    && /^Test \/(?:askop|ask-op)(?:\r?\n|$)/.test(request.body);
+  return request.kind === 'question' && (ASK_OP_SENDERS.has(request.from) || testSource)
+    && (testSource || new RegExp(`^(?:Telegram|Discord) \/(?:${ASK_OP_COMMAND}|ask-op)(?:\\r?\\n|$)`).test(request.body));
+}
+
+function askOpLatencyMs(request: Message, repliedAt: number): number | null {
+  const createdAt = Date.parse(request.createdAt);
+  const latencyMs = repliedAt - createdAt;
+  return Number.isFinite(createdAt) && latencyMs >= 0 ? latencyMs : null;
+}
+
+function writeAskOpReply(store: MsgStore, request: Message, replyText: string, options: AskOpContextInboxOptions) {
+  if (options.testHarness && request.from === 'TEST') {
+    const marker = `re #${request.id}\n`;
+    const body = replyText.startsWith(marker) ? replyText.slice(marker.length) : replyText;
+    const reply = options.testHarness.replySink({ from: RECIPIENT, to: request.from,
+      body, kind: 'reply', replyTo: request.id });
+    return { id: reply.id, posted: true };
+  }
+  return writeCoordinatorReply(store, request, replyText);
+}
+
+function askOpQuestion(request: Message): string {
+  const match = /^question: (.*)$/m.exec(request.body);
+  return match?.[1]?.trim() ?? '';
+}
+
+function unsafeAskOp(question: string): boolean {
+  // Reject explicit commands, not descriptive questions such as "What changed since the release?".
+  return /^(?:(?:please|can you|could you|would you)\s+)?(?:run|execute|deploy|publish|push|merge|delete|drop|write|edit|change|set)\b|(?:실행해|발행해|배포해|푸시해|병합해|삭제해|수정해|바꿔|설정해)(?:줘|주세요)?|\b(?:show|reveal|give|tell|display|print|read|open|what is|what's)\b.{0,80}\b(?:secret|token|password|credential|api[ -]?key|private[ -]?key)\b|(?:비밀|토큰|암호|패스워드|인증키|API\s*키).{0,80}(?:보여|알려|공개|읽어)/i.test(question);
+}
+
+async function askOpAnswer(request: Message, options: AskOpContextInboxOptions): Promise<string> {
+  const question = askOpQuestion(request);
+  if (!question) return `제안: ${REFUSE}\n근거: 질문이 비었습니다.`;
+  if (unsafeAskOp(question)) return '제안: 요청한 권한 실행·비밀 조회·traffic/칸 변경은 실행할 수 없습니다.\n근거: OP 질문 답변은 읽기 전용입니다.';
+  let bundle: AskOpContextBundle;
+  // These replies are delivered to an external channel, not the private operator console.
+  try { bundle = await (options.context ?? askOpContextBundle)(question, { audience: 'public-demo', limit: 8 }); }
+  catch { return `제안: ${REFUSE}\n근거: 맥락 조회 실패.`; }
+  const facts = bundle.facts.filter(fact => fact.source?.trim() && fact.summary?.trim()).slice(0, 8);
+  if (!facts.length) {
+    const gaps = bundle.gaps.slice(0, 3).map(gap => `${redactSecretText(gap.kind)}: ${redactSecretText(gap.reason)}`).join('; ');
+    return `제안: ${REFUSE}\n근거: ${gaps || '미관측'}.`;
+  }
+  const evidence = facts.map(fact => `- ${redactSecretText(fact.summary)} — ${redactSecretText(fact.source)} (관측 ${redactSecretText(fact.observedAt)})`).join('\n');
+  return `제안: 다음은 관측된 OP 맥락입니다 (${redactSecretText(bundle.topic)}; 조회 ${redactSecretText(bundle.queriedAt)}).\n근거:\n${evidence}\n판단·승인·실행은 하지 않았습니다.`;
+}
 export interface CoordinatorAgentInboxOptions {
   role: RoleLlmSpec;
   pack: string;
@@ -95,6 +170,57 @@ function writeCoordinatorReply(store: MsgStore, request: Message, replyText: str
   return { id: reply.id, posted: true };
 }
 
+/** Surface ask-op questions use the same linked reply and durable acknowledgement as the resident inbox. */
+export async function runAskOpContextInbox(options: AskOpContextInboxOptions = {}): Promise<CoordinatorInboxResult> {
+  const store = options.store ?? openMsgStore(options.path);
+  const ownStore = options.store === undefined;
+  const result = { replied: 0, acknowledged: 0 };
+  const acknowledge = options.acknowledge !== false;
+  try {
+    const requests = options.request ? [options.request]
+      : store.listByRecipient(RECIPIENT, store.getCursor(RECIPIENT), options.limit ?? 100);
+    for (const request of requests) {
+      if (request.to !== RECIPIENT || request.from === RECIPIENT ||
+        (request.kind !== undefined && request.kind !== 'request' && request.kind !== 'question')) {
+        if (acknowledge) { store.ack(RECIPIENT, request.id); result.acknowledged++; }
+        continue;
+      }
+      const testAskOp = request.from === 'TEST' && isAskOpRequest(request, true);
+      if (testAskOp && !options.testHarness) continue;
+      const key = `coord-inbox:${request.id}:${request.from}`;
+      const existing = store.db.query('SELECT message_id FROM msg_provenance WHERE provenance_key = ?')
+        .get(key) as { message_id: number } | null;
+      // Legacy seat traffic and knowhow requests preserve the existing answer path.
+      const startedAt = Date.now();
+      const replyText = existing ? '' : (isAskOpRequest(request, options.testHarness !== undefined)
+        ? `re #${request.id}\n${await askOpAnswer(request, options)}` : coordinatorReply(request, options.knowhow ?? {}));
+      const one = store.db.transaction(() => {
+        const receipt = store.db.query('SELECT message_id FROM msg_provenance WHERE provenance_key = ?')
+          .get(key) as { message_id: number } | null;
+        const reply = receipt ? { id: receipt.message_id, posted: false } : writeAskOpReply(store, request, replyText, options);
+        if (!receipt) store.db.query('INSERT INTO msg_provenance(provenance_key, message_id) VALUES (?, ?)').run(key, reply.id);
+        if (acknowledge) store.ack(RECIPIENT, request.id);
+        return reply.posted;
+      }).immediate();
+      if (one) result.replied++;
+      if (acknowledge) result.acknowledged++;
+      debug.log('loop.coordinator-inbox', 'reply', { requestId: request.id, recipient: request.from, duplicate: !one });
+      if (one && isAskOpRequest(request, options.testHarness !== undefined)) {
+        const repliedAt = Date.now();
+        const latencyMs = askOpLatencyMs(request, repliedAt);
+        const processingMs = Math.max(0, repliedAt - startedAt);
+        if (options.testHarness && request.from === 'TEST') {
+          options.testHarness.eventSink?.({ requestId: request.id, requestToReplyMs: latencyMs, processingMs });
+        } else {
+          debug.log('ask-op.inbox', 'replied', { requestId: request.id, requestToReplyMs: latencyMs,
+            processingMs, clockSkew: latencyMs === null });
+        }
+      }
+    }
+    return result;
+  } finally { if (ownStore) store.close(); }
+}
+
 /** One transaction ties a reply to its acknowledgement. A retry finds the durable receipt. */
 export function runCoordinatorInbox(inputStore?: MsgStore, limit = 100, path?: string,
   options: CoordinatorInboxOptions = {}): CoordinatorInboxResult {
@@ -144,6 +270,9 @@ export async function handleCoordinatorAgentMessage(
   const ownStore = input.store === undefined;
   const acknowledge = input.acknowledge === true;
   try {
+    if (isAskOpRequest(request) && request.to === RECIPIENT) {
+      return await runAskOpContextInbox({ store, request, acknowledge });
+    }
     if (request.to !== RECIPIENT || request.from === RECIPIENT ||
       (request.kind !== undefined && request.kind !== 'request' && request.kind !== 'question')) {
       if (acknowledge) store.ack(RECIPIENT, request.id);

package/src/loops/orchestrator/tick.ts

@@ -6,6 +6,7 @@ import { Database } from 'bun:sqlite';
 import { checklistDevVersion, listChecklist, type ChecklistItem } from '../../release-loop/checklist.js';
 import { readTrafficSignal } from '../../seat-loop/traffic-signal.js';
 import { runHoldHygiene, type HygieneCell, type HygieneDeps } from '../../steward/hold-hygiene.js';
+import { runDirectiveAudit, type DirectiveAuditDeps } from '../../steward/directive-audit.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { getUserConfig, ORCHESTRATOR_DEFAULTS, resolveConfiguredAgentRoleLlm, type OrchestratorLoopConfig } from '../../user-config.js';
 import { rubricPriority } from '../../release-loop/rubric.js';
@@ -25,7 +26,7 @@ import * as testGuard from '../../instance/test-write-guard.js';
 import { seatCapDetails } from '../budget.js';
 export { isLaunchEligible } from './traffic.js';
 import { readTaskAgentState, TASK_SEATS, type HandTaskOptions, type TaskCard as TaskAgentCard, type HandTaskResult, type TaskLauncher, type TaskSeat } from '../../task-agent/task-hand.js';
-import { runCoordinatorAgentInbox, runCoordinatorInbox, type CoordinatorInboxResult } from './inbox.js';
+import { runAskOpContextInbox, runCoordinatorAgentInbox, type CoordinatorInboxResult } from './inbox.js';
 import type { KnowhowOptions } from './knowhow-pack.js';
 import { loadAgentRolePack, type AgentReplyInput } from '../agent-reply.js';
 import type { LLMProvider } from '../../llm.js';
@@ -70,6 +71,7 @@ export interface TickDeps {
   heartbeatIntervalMs?: number;
   hygieneCells?: () => HygieneCell[];
   hygienePaths?: Pick<HygieneDeps, 'trafficPath' | 'metaPath' | 'dispatcherDir'>;
+  directiveAudit?: DirectiveAuditDeps;
   cards?: () => TaskCard[]; split?: SplitAdapter; placeCell?: PlaceAdapter;
   degradation?: () => { llm: boolean; board: boolean };
   gridHosts?: readonly GridHost[];
@@ -97,6 +99,8 @@ export interface TickDeps {
   coordinatorAgentProvider?: LLMProvider;
   /** Resident knowhow pack seam; the real intake reads 내부 문서 `KNOWHOW` every tick. */
   coordinatorKnowhow?: KnowhowOptions | false;
+  /** Deterministic read-only ask-op context seam for isolated tick tests. */
+  coordinatorContext?: typeof import('../../context-bus/context-now.js').askOpContextBundle;
 }
 
 /** ORCH-TA-HAND ledger — one row per handed `orch:<card>:<cell>` key so a cell is handed once across ticks and processes. */
@@ -521,8 +525,9 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
         ? runCoordinatorAgentInbox({ role, pack: loadAgentRolePack('coordinator'), path: inboxPath, root,
             ...(deps.coordinatorAgentRun ? { runAgent: deps.coordinatorAgentRun } : {}),
             ...(deps.coordinatorAgentProvider ? { provider: deps.coordinatorAgentProvider } : {}) })
-        : runCoordinatorInbox(undefined, 100, inboxPath,
-          deps.coordinatorKnowhow === undefined ? {} : { knowhow: deps.coordinatorKnowhow });
+        : runAskOpContextInbox({ path: inboxPath, limit: 100,
+            ...(deps.coordinatorKnowhow === undefined ? {} : { knowhow: deps.coordinatorKnowhow }),
+            ...(deps.coordinatorContext ? { context: deps.coordinatorContext } : {}) });
     }))();
     if (inbox.replied || inbox.acknowledged) {
       observe('exchange', 'coordinator-inbox-replied', inbox.replied);
@@ -957,6 +962,12 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
           const sent = runHoldHygiene({ root, now, cells, ...deps.hygienePaths });
           for (const notice of sent) observe('exchange', `hold-hygiene:${notice.key}`, 1, SEAT_LOOP_IDS[notice.to]);
         } catch (error) { observe('hold-hygiene-failed', String(error).slice(0, 160), 0); }
+        // COORD-DIRECTIVE-AUDIT — 지시 원장 행마다 로직 점검(원장·로그·config)을 실제로 돌린다.
+        try {
+          const audit = runDirectiveAudit({ root, now: currentTime, ...deps.directiveAudit });
+          if (audit.alerts.length > 0) observe('directive-audit', `alerts:${audit.alerts.length}`, audit.alerts.length);
+          for (const proposal of audit.proposals) observe('directive-audit', `repair-proposal:${proposal.id}`, 1);
+        } catch (error) { observe('directive-audit-failed', String(error).slice(0, 160), 0); }
       }
       (deps.print ?? console.log)(reportLine(state));
     }

package/src/maturity/feature-maturity.ts

@@ -137,6 +137,7 @@ export const FEATURE_MATURITY = {
     tablet: 'ops',
     surface: 'ops',
     term: 'tool',
+    side: 'tool',
     claude: 'tool',
     codex: 'tool',
     gemini: 'tool',

package/src/nexus/api/channel-ask-op.ts

@@ -0,0 +1,96 @@
+import type { Message, MessageEnvelope } from '../../msg/msg-store.js';
+import type { TgSlashCommand } from '../../telegram-commands.js';
+import { ASK_OP_COMMAND, formatAskOpQuestionEnvelope } from '../../session/channel-ask-op-envelope.js';
+
+export interface AskOpTelegramOptions {
+  allowedUserIds: readonly number[];
+  append: (message: MessageEnvelope, provenanceKey: string) => Message;
+}
+
+export interface AskOpDiscordOptions {
+  allowedUserIds: readonly string[];
+  allowedChannelIds: readonly string[];
+  resolveBotId: () => Promise<string>;
+  append: (message: MessageEnvelope, provenanceKey: string) => Message;
+}
+
+export interface AskOpDiscordContext {
+  userId: string;
+  channelId: string;
+  messageId: string;
+  text: string;
+}
+
+function appendAskOpQuestion(
+  options: { append: AskOpTelegramOptions['append'] },
+  input: { from: 'TELEGRAM' | 'DISCORD'; surface: string; correlation: string[]; question: string; provenanceKey: string },
+): Message {
+  return options.append({
+    from: input.from,
+    to: 'COORDINATOR',
+    kind: 'question',
+    body: [`${input.surface} /${ASK_OP_COMMAND}`, ...input.correlation, `question: ${input.question}`].join('\n'),
+  }, input.provenanceKey);
+}
+
+function extractQuestion(text: string): string | null {
+  const match = new RegExp(`^/(?:${ASK_OP_COMMAND}|ask-op)(?:@[-_a-z0-9]+)?(?:\\s+([\\s\\S]*))?$`, 'i').exec(text.trim());
+  const question = match?.[1]?.trim();
+  return question || null;
+}
+
+export function createAskOpTelegramSlashCommand(options: AskOpTelegramOptions): TgSlashCommand {
+  return {
+    name: ASK_OP_COMMAND,
+    description: '운영 책임자에게 질문을 보냅니다',
+    handler: async (_args, ctx) => {
+      if (!options.allowedUserIds.includes(ctx.userId)) return '허용된 사용자만 OP에게 질문할 수 있습니다.';
+      const question = extractQuestion(ctx.text);
+      if (!question) return `사용법: /${ASK_OP_COMMAND} <질문>`;
+      if (!Number.isSafeInteger(ctx.updateId) || ctx.updateId < 0) return 'Telegram update 식별값을 확인할 수 없어 질문을 저장하지 못했습니다.';
+
+      const botId = (ctx.botId ?? 'unknown').replace(/[^a-zA-Z0-9_-]/g, '_');
+      const message = options.append({
+        from: 'TELEGRAM',
+        to: 'COORDINATOR',
+        kind: 'question',
+        body: formatAskOpQuestionEnvelope({
+          surface: 'telegram', botId, chatId: ctx.chatId, threadId: ctx.threadId,
+          messageId: ctx.messageId, updateId: ctx.updateId, question,
+        }),
+      }, `coord:tg-${botId}-${ctx.updateId}:COORDINATOR`);
+
+      return `OP에게 질문 #${message.id}로 접수했습니다.`;
+    },
+  };
+}
+
+/** Handle a Discord text command from an already-routed message. Returning
+ * undefined leaves every non-/askop message on its existing chat path. */
+export function createAskOpDiscordIngress(options: AskOpDiscordOptions) {
+  return async (ctx: AskOpDiscordContext): Promise<string | undefined> => {
+    const match = new RegExp(`^/${ASK_OP_COMMAND}(?:\\s+([\\s\\S]*))?$`, 'i').exec(ctx.text.trim());
+    if (!match) return undefined;
+    if (!options.allowedUserIds.includes(ctx.userId)) return '허용된 사용자만 OP에게 질문할 수 있습니다.';
+    if (!options.allowedChannelIds.includes(ctx.channelId)) return '허용된 Discord 채널에서만 OP에게 질문할 수 있습니다.';
+    const question = match[1]?.trim();
+    if (!question) return `사용법: /${ASK_OP_COMMAND} <질문>`;
+    if (!/^\d+$/.test(ctx.messageId)) return 'Discord 메시지 식별값을 확인할 수 없어 질문을 저장하지 못했습니다.';
+
+    let botId: string;
+    try { botId = await options.resolveBotId(); }
+    catch { return 'Discord 봇 식별값을 확인할 수 없어 질문을 저장하지 못했습니다.'; }
+    if (!/^[A-Za-z0-9_-]+$/.test(botId)) return 'Discord 봇 식별값이 올바르지 않아 질문을 저장하지 못했습니다.';
+
+    const message = appendAskOpQuestion(options, {
+      from: 'DISCORD', surface: 'Discord',
+      correlation: [
+        `botId=${botId}`, `channelId=${ctx.channelId}`,
+        `messageId=${ctx.messageId}`, `updateId=${ctx.messageId}`,
+      ],
+      question,
+      provenanceKey: `coord:dc-${botId}-${ctx.messageId}:COORDINATOR`,
+    });
+    return `OP에게 질문 #${message.id}로 접수했습니다.`;
+  };
+}

package/src/nexus/api/discord-trigger-bot.ts

@@ -37,6 +37,8 @@ import { createDiscordStreamSink } from '../../session/streaming/discord-stream-
 import { splitForDiscord } from '../../discord.js';
 import { formatForDiscord } from '../../discord-markdown.js';
 import { receiveChannelEvent } from '../outbound/router.js';
+import { openMsgStore } from '../../msg/msg-store.js';
+import { createAskOpDiscordIngress } from './channel-ask-op.js';
 
 export interface NexusDiscordTriggerBotOpts {
   /** Bot token (without `Bot ` prefix). Production reads
@@ -156,6 +158,30 @@ export function createNexusDiscordTriggerBot(
   // LF2 — 콘솔 하트비트 유지 + debug.log 병행(telegram-trigger 동형).
   const log = opts.log ?? createDiscordTriggerLogger();
   const onTriggerTap = buildDiscordTriggerTap(opts.dispatch, log);
+  let botRef: DiscordBot | undefined;
+  let botIdPromise: Promise<string> | undefined;
+  const askOpIngress = createAskOpDiscordIngress({
+    allowedUserIds: opts.allowedUsers,
+    allowedChannelIds: opts.guildTextChannels ?? [],
+    resolveBotId: () => {
+      if (!botRef) return Promise.reject(new Error('Discord bot is not ready'));
+      botIdPromise ??= botRef.getMe().then(({ id }) => id).catch((error: unknown) => {
+        botIdPromise = undefined;
+        throw error;
+      });
+      return botIdPromise;
+    },
+    append: (message, provenanceKey) => {
+      const store = openMsgStore();
+      try { return store.appendWithProvenance(message, provenanceKey); }
+      finally { store.close(); }
+    },
+  });
+  const onMessage: DcMessageHandler = async (ctx, streamer) => {
+    const askReply = await askOpIngress(ctx);
+    if (askReply !== undefined) return askReply;
+    return opts.onMessage?.(ctx, streamer);
+  };
 
   const botWasInjected = opts.bot !== undefined;
   const bot = opts.bot ?? new DiscordBot({
@@ -165,7 +191,7 @@ export function createNexusDiscordTriggerBot(
     // Chat path: the injected self-turn handler (M4b nexus wire) or the
     // legacy trigger-only no-op. Workflows wanting a chat reply can
     // still declare a `chatTrigger` (routes via `/v1/workflows/chat/*`).
-    onMessage: opts.onMessage ?? (async () => undefined),
+    onMessage,
     log,
     onTriggerTap,
     ...(opts.voiceTap ? { voiceTap: opts.voiceTap } : {}),
@@ -173,6 +199,7 @@ export function createNexusDiscordTriggerBot(
     ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}),
     ...(opts.wsImpl ? { wsImpl: opts.wsImpl } : {}),
   });
+  botRef = bot;
 
   // §C3 — discord 서피스 sink(config gate·telegram-trigger 동형). shadowFanout OR
   // primary.discord 시 등록. endpoint 완전스코프면 parse→인스턴스 가드 후 channelId 배달,

package/src/nexus/api/harness-api.ts

@@ -9,6 +9,7 @@ import { queryRunScreenKey } from '../../self-implement/run-ledger.js';
 import { logsDbPath } from '../../mss/logging/log-store.js';
 import { redactSecretText } from '../../debug/log.js';
 import { runAskLaunchFlow, type AskLaunchFlowResult } from '../../self-dev/ask-launch-flow.js';
+import { defaultGoalAuthorSelfResolve } from '../../self-implement/goal-author-clarification.js';
 import * as askIo from '../../self-dev/ask-launch-io.js';
 import { DAEMON_HARNESS_ASK_ENTRANCE } from '../../self-dev/entrance-registry.js';
 import { prepareAskLaunch } from '../../self-dev/launch-preflight.js';
@@ -211,12 +212,12 @@ function defaultAskDeps(rows: Awaited<ReturnType<typeof askIo.readAskPreflightLo
     print: () => {},
     log: (event: string, data: Record<string, unknown>, level?: 'info' | 'warn' | 'error') => debug.log('harness-http', event, data, { level }),
     readLine: async () => '',
-    readClarification: async () => '',
     readFile: (file: string) => readFileSync(file, 'utf8'),
     writeFile: (file: string, data: string) => writeFileSync(file, data, 'utf8'),
     cwd: () => process.cwd(),
     now: () => Date.now(),
     isInteractive: () => false,
+    selfResolveClarification: defaultGoalAuthorSelfResolve,
     buildPreflightDeps: askIo.buildAskPreflightDeps,
     priorBlockSamples: () => askIo.priorBlockSamplesFrom(rows),
     recentAuthoringSamples: () => askIo.recentAuthoringSamplesFrom(rows),

package/src/nexus/api/telegram-trigger-bot.ts

@@ -37,6 +37,12 @@ import { createTelegramStreamSink } from '../../session/streaming/telegram-strea
 import { splitMarkdownForTelegram } from '../../telegram-format.js';
 import { formatTablesAndRules } from '../../discord-markdown.js';
 import { receiveChannelEvent } from '../outbound/router.js';
+import { openMsgStore } from '../../msg/msg-store.js';
+import { createAskOpTelegramSlashCommand } from './channel-ask-op.js';
+import { createTelegramChannelOpReplyTransport, startChannelOpReplyRoute } from '../../session/channel-op-reply-route.js';
+import { resolveInstanceName } from '../../instance-identity.js';
+import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { join } from 'node:path';
 
 export interface NexusTelegramTriggerBotOpts {
   /** Bot token (without `Bot ` prefix). Production reads
@@ -167,6 +173,14 @@ export function createNexusTelegramTriggerBot(
   const onTriggerTap = buildTelegramTriggerTap(opts.dispatch, log);
 
   const botWasInjected = opts.bot !== undefined;
+  const askOpCommand = createAskOpTelegramSlashCommand({
+    allowedUserIds: opts.allowedUsers,
+    append: (message, provenanceKey) => {
+      const store = openMsgStore();
+      try { return store.appendWithProvenance(message, provenanceKey); }
+      finally { store.close(); }
+    },
+  });
   const bot = opts.bot ?? (opts.userConfig
     // Unified inbound: botFromConfig gives the full Q&A handler
     // (onMessage → runTurn, sessions, attachments, slash) and we graft
@@ -174,6 +188,7 @@ export function createNexusTelegramTriggerBot(
     ? botFromConfig({
         userConfig: opts.userConfig,
         log,
+        extraSlashCommands: [askOpCommand],
         ...(opts.runTurnImpl ? { runTurnImpl: opts.runTurnImpl } : {}),
         telegramBotOpts: {
           token: opts.token,
@@ -286,6 +301,14 @@ export function createNexusTelegramTriggerBot(
     });
   }
 
+  const opReplyInstance = resolveInstanceName();
+  const opReplyRoute = !botWasInjected ? startChannelOpReplyRoute({
+    transport: createTelegramChannelOpReplyTransport({ bot, botId: thisBotId, instance: opReplyInstance }),
+    botId: thisBotId,
+    instance: opReplyInstance,
+    cursorPath: join(elanousStateRoot(), 'msg', 'sse-cursor', `TELEGRAM-channel-op-replies-${thisBotId}.json`),
+  }) : undefined;
+
   // One drain promise for every caller. A second stop (SIGINT then
   // SIGTERM, or a duplicate SIGTERM) must wait for the same bound —
   // returning immediately would let the process exit before the turn
@@ -297,6 +320,7 @@ export function createNexusTelegramTriggerBot(
       if (drainPromise) return drainPromise;
       const timeoutMs = stopOpts?.timeoutMs ?? TELEGRAM_TRIGGER_DRAIN_TIMEOUT_MS;
       drainPromise = (async (): Promise<void> => {
+        try { await opReplyRoute?.stop(); } catch { /* swallow */ }
         try { offTelegramSink?.(); } catch { /* swallow */ }
         try { offTelegramStream?.(); } catch { /* swallow */ }
         try { bot.stop(); } catch { /* swallow */ }

package/src/nexus/api/terminals.ts

@@ -102,6 +102,11 @@ export interface TerminalSummary {
   startedAt: number;
   /** Total bytes currently held in the head/tail buffer (after trim). */
   outputBytes: number;
+  /** Seat copied from the joined lifecycle row for this PTY id; omitted when unknown. */
+  seat?: string;
+  /** Cumulative output from the joined lifecycle row; omitted when unknown (NULL/missing/0 legacy row).
+   *  Only a recorded positive total is a fact — same rule as the lineage endpoint. Distinct from outputBytes (buffer length). */
+  outputBytesTotal?: number;
   /** The owner-process access mode, or null when this row is manifest-only. */
   accessMode: 'read' | 'write' | 'auto' | null;
   /** Why accessMode is unavailable; null when an access mode is present. */
@@ -266,6 +271,18 @@ function terminalOriginFields(row: Pick<PtyManifestRow, 'terminalOriginCategory'
   return { terminalOriginCategory: 'unknown', terminalOriginReason: 'legacy-or-malformed-origin-decision' };
 }
 
+/** `> 0` 만 사실이다 — legacy 행의 NULL/누락(그리고 매니페스트가 0을 «기록값»으로 구분 못 하는 한 0 전부)은
+ *  미상으로 칸을 비운다. 계보 쪽 `lineageRowFromManifest`(`src/cli/pty-takeover-cli.ts`)와 같은 규칙이라
+ *  두 엔드포인트가 같은 행을 같게 판정한다. */
+function lifecycleFieldsFromJoinedRow(row: { seat?: string; outputBytesTotal?: number } | undefined): Pick<TerminalSummary, 'seat' | 'outputBytesTotal'> {
+  return {
+    ...(row?.seat ? { seat: row.seat } : {}),
+    ...(typeof row?.outputBytesTotal === 'number' && Number.isFinite(row.outputBytesTotal) && row.outputBytesTotal > 0
+      ? { outputBytesTotal: row.outputBytesTotal }
+      : {}),
+  };
+}
+
 function summarize(
   handle: PtyHandle,
   manifest: PtyManifestRow | null,
@@ -300,6 +317,7 @@ function summarize(
     exitCode: handle.exitCode,
     startedAt: handle.startedAt,
     outputBytes: snapshot.length,
+    ...lifecycleFieldsFromJoinedRow(manifest ? { seat: manifest.seat, outputBytesTotal: manifest.outputBytesTotal } : undefined),
     accessMode: handle.accessMode,
     accessModeUnavailableReason: accessModeUnavailableReason('process', handle.accessMode),
     ownerRunUsage: ownerRunUsage(manifest?.ownerPid !== undefined ? isOwnerProcessAlive(manifest.ownerPid) : undefined, manifest?.runId ?? '', resolveRunTerminationForRow),
@@ -337,6 +355,7 @@ function summarizeManifest(
     producer: 'process',
     alive: row.alive, exitCode: row.exitCode, startedAt: row.startedAt,
     outputBytes: Buffer.byteLength(row.snapshot, 'utf8'),
+    ...lifecycleFieldsFromJoinedRow({ seat: row.seat, outputBytesTotal: row.outputBytesTotal }),
     // Access mode lives in the owner process, so manifest-only rows cannot know it without IPC.
     accessMode: null,
     accessModeUnavailableReason: accessModeUnavailableReason('process', null),
@@ -1102,12 +1121,15 @@ export function handleTerminalsList(req: Request, opts: MetaApiOpts, deps: Termi
   try { cleanupStale(Date.now()); } catch { /* fail-soft */ }
   const manifestAfterInitialCleanup = readLocalManifest();
   const manifestById = new Map(manifestAfterInitialCleanup.map((row) => [row.id, row]));
-  const local = (deps.listPty ?? listPty)().map((handle) => summarize(
-    handle,
-    manifestById.get(handle.id) ?? null,
-    resolveRunTerminationForRow,
-    deps.isProcessAlive,
-  ));
+  const local = (deps.listPty ?? listPty)().map((handle) => {
+    const manifest = manifestById.get(handle.id) ?? null;
+    return summarize(
+      handle,
+      manifest,
+      resolveRunTerminationForRow,
+      deps.isProcessAlive,
+    );
+  });
   const localIds = new Set(local.map((t) => t.id));
   try { cleanupOrphans(localIds); } catch { /* fail-soft */ }
   const isVisible = (row: PtyManifestRow): boolean => isVisibleManifestRow(row, deps.isProcessAlive);

package/src/patents/ledger.ts

@@ -1,5 +1,5 @@
 import { Database } from 'bun:sqlite';
-import { chmodSync, mkdirSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { debug } from '../debug/log.js';
@@ -80,6 +80,12 @@ export class PatentLedger {
     try { return work(db); } finally { db.close(); }
   }
 
+  private usingExisting<T>(work: (db: Database) => T): T {
+    if (!existsSync(this.path)) throw new Error('patent ledger unavailable');
+    const db = new Database(this.path, { readonly: true, create: false, strict: true });
+    try { return work(db); } finally { db.close(); }
+  }
+
   private transaction<T>(db: Database, work: () => T): T {
     db.exec('BEGIN IMMEDIATE');
     try { const result = work(); db.exec('COMMIT'); return result; }
@@ -125,4 +131,15 @@ export class PatentLedger {
     return this.using(db =>
       db.query(`SELECT id, title, track, status, deadline, created_at, updated_at FROM patent_candidates WHERE status = '공개 허용' ORDER BY created_at, id`).all() as PatentCandidate[]);
   }
+
+  /** Return only line numbers; candidate identifiers and titles remain private. */
+  unapprovedCandidateLineNumbers(text: string): number[] {
+    return this.usingExisting(db => {
+      if (!text.trim()) return [];
+      const rows = db.query(`SELECT title FROM patent_candidates WHERE status != '공개 허용'`).all() as Array<{ title: string }>;
+      const titles = rows.map(({ title }) => title.toLocaleLowerCase()).filter((title) => title.length >= 3);
+      return text.split(/\r?\n/).flatMap((line, index) =>
+        titles.some((title) => line.toLocaleLowerCase().includes(title)) ? [index + 1] : []);
+    });
+  }
 }

package/src/preview/terminal.ts

@@ -67,6 +67,8 @@ export interface PreviewTerminalOpts {
    *  splitting honest). */
   shellArgs?: readonly string[];
   env?: Record<string, string>;
+  /** Remove captured environment keys after env composition (for subscription-only child auth). */
+  unsetEnv?: readonly string[];
   /** Defaults to `xterm-256color` (universal). Override with
    *  `xterm-ghostty` to match a ghostty host, or another terminfo
    *  name for testing. The chosen name lands in $TERM of the child
@@ -343,7 +345,7 @@ export class PreviewTerminal {
       //   PreviewTerminal 자체 에뮬레이터가 렌더 담당이라 무관). 출력 구독/exit 배선은 아래 pump 분기에서.
       this.registryHandle = this.registryDeps.startPty({
         // 합성자 = registry(resolveSpawnShape) — 여기서는 overlay 만 넘긴다.
-        cmd: shell, args, workdir: this.opts.cwd, env: childEnv,
+        cmd: shell, args, workdir: this.opts.cwd, env: childEnv, unsetEnv: this.opts.unsetEnv,
         cols: this.term.cols, rows: this.term.rows,
         kind: this.opts.registryKind ?? 'preview',
         nickname: this.opts.registryNickname,
@@ -360,7 +362,7 @@ export class PreviewTerminal {
         cols: this.term.cols,
         rows: this.term.rows,
         cwd: this.opts.cwd,
-        env: buildPtyEnv(childEnv),
+        env: buildPtyEnv(childEnv, process.env, { unset: this.opts.unsetEnv }),
       });
       const masterFd = this.resolveMasterFd(this.pty);
       if (masterFd === null) throw new Error('PreviewTerminal: could not resolve PTY master fd');

package/src/prompt-cache/anthropic.ts

@@ -20,6 +20,7 @@
 // caching went GA without a version bump.
 
 import type { LLMMessage, LLMToolSpec } from '../llm.js';
+import { assertNoTopLevelToolSchemaCombinators } from '../llm-tool-schema.js';
 import {
   cacheControlFor,
   type CacheControl,
@@ -98,6 +99,7 @@ export function toAnthropicToolsCached(
   opts: CacheOpts,
 ): AnthropicToolBlock[] | undefined {
   if (!tools || tools.length === 0) return undefined;
+  assertNoTopLevelToolSchemaCombinators(tools);
   // ⭐ Anthropic 은 tool name UNIQUE 를 강제(400 "Tool names must be unique.")한다.
   //   OpenAI/codex 는 중복을 조용히 관대 처리 → 하니스가 codex 위주로 개발되며 중복 tool spec
   //   (예: goal-loop 이 카탈로그에 이미 있는 spec 을 append)이 claude 에서만 400 으로 터졌다.