elanous 0.2.42 → 0.2.43

package/src/msg/msg-store.ts

@@ -3,6 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { debug } from '../debug/log.js';
 
 export interface MessageEnvelope {
   from: string;
@@ -37,13 +38,33 @@ export function canonicalSeatId(value: string): string {
   return Object.hasOwn(SEAT_ALIASES, seat) ? SEAT_ALIASES[seat]! : seat;
 }
 
+/** Normalize the public message address syntax while keeping seat IDs backward compatible. */
+export function canonicalMessageAddress(value: string): string {
+  if (typeof value !== 'string') throw new TypeError('message address must be a string');
+  const address = value.trim();
+  if (/^seat:/i.test(address)) return canonicalSeatId(address.slice(address.indexOf(':') + 1));
+  if (/^group:/i.test(address)) {
+    const name = address.slice(address.indexOf(':') + 1).trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(name)) throw new Error('invalid group name');
+    return name === 'all' ? 'ALL' : `group:${name}`;
+  }
+  return canonicalSeatId(address);
+}
+
+function canonicalGroupAddress(value: string): string {
+  const address = canonicalMessageAddress(/^group:/i.test(value.trim()) ? value : `group:${value}`);
+  if (!address.startsWith('group:')) throw new Error('group address must be group:<name>');
+  return address;
+}
+
 /** Check untrusted input before opening the DB or executing a write. */
 export function validateMessageEnvelope(input: unknown): MessageEnvelope {
   if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('message must be an object');
   const record = input as Record<string, unknown>;
-  const from = canonicalSeatId(record.from as string);
-  const to = canonicalSeatId(record.to as string);
+  const from = canonicalMessageAddress(record.from as string);
+  const to = canonicalMessageAddress(record.to as string);
   if (from === 'ALL') throw new Error('ALL cannot send messages');
+  if (from.startsWith('group:')) throw new Error('sender must be a seat');
   if (typeof record.body !== 'string' || !record.body.trim()) throw new Error('message body must be nonempty');
   if (record.kind !== undefined && (typeof record.kind !== 'string' || !/^[a-z][a-z0-9_-]{0,63}$/.test(record.kind))) {
     throw new Error('invalid message kind');
@@ -65,20 +86,35 @@ function validCursor(cursor: number): number {
   return cursor;
 }
 
+function hasGroupMembershipTable(db: Database): boolean {
+  return (db.query("SELECT COUNT(*) AS count FROM sqlite_master WHERE type = 'table' AND name = 'msg_group_memberships'")
+    .get() as { count: number }).count > 0;
+}
+
 /** Unread count ⊕ newest unread ID for one recipient (same predicate as `unreadCountOn`). */
 function unreadSummaryOn(db: Database, to: string): { count: number; maxId: number | null } {
+  const groupClause = hasGroupMembershipTable(db) ? ` OR EXISTS (
+        SELECT 1 FROM msg_group_memberships gm WHERE gm.address = m.recipient AND gm.seat = ?
+          AND m.id > gm.joined_after_id AND (gm.left_after_id IS NULL OR m.id <= gm.left_after_id)
+      )` : '';
+  const params = hasGroupMembershipTable(db) ? [to, to, to, to] : [to, to, to];
   const row = db.query(`SELECT COUNT(*) AS count, MAX(m.id) AS max_id FROM msg_messages m
     WHERE m.id > COALESCE((SELECT last_id FROM msg_cursors WHERE recipient = ?), 0)
-      AND (m.recipient = ? OR (m.recipient = 'ALL' AND m.sender <> ?))`)
-    .get(to, to, to) as { count: number; max_id: number | null };
+      AND (m.recipient = ? OR (m.recipient = 'ALL' AND m.sender <> ?)${groupClause})`)
+    .get(...params) as { count: number; max_id: number | null };
   return { count: row.count, maxId: row.max_id ?? null };
 }
 
 function unreadCountOn(db: Database, to: string): number {
+  const groupClause = hasGroupMembershipTable(db) ? ` OR EXISTS (
+        SELECT 1 FROM msg_group_memberships gm WHERE gm.address = m.recipient AND gm.seat = ?
+          AND m.id > gm.joined_after_id AND (gm.left_after_id IS NULL OR m.id <= gm.left_after_id)
+      )` : '';
+  const params = hasGroupMembershipTable(db) ? [to, to, to, to] : [to, to, to];
   return (db.query(`SELECT COUNT(*) AS count FROM msg_messages m
     WHERE m.id > COALESCE((SELECT last_id FROM msg_cursors WHERE recipient = ?), 0)
-      AND (m.recipient = ? OR (m.recipient = 'ALL' AND m.sender <> ?))`)
-    .get(to, to, to) as { count: number }).count;
+      AND (m.recipient = ? OR (m.recipient = 'ALL' AND m.sender <> ?)${groupClause})`)
+    .get(...params) as { count: number }).count;
 }
 
 interface MessageRow {
@@ -101,6 +137,7 @@ function fromRow(row: MessageRow): Message {
 /** SQLite owns both append order and per-recipient acknowledgement progress. */
 export class MsgStore {
   readonly db: Database;
+  private readonly clock: () => Date;
 
   // A read-only SSE connection may outlive another process's in-place migration.
   private get hasReplyTo(): boolean {
@@ -108,13 +145,19 @@ export class MsgStore {
       .get() as { count: number }).count > 0;
   }
 
-  private readWithSchema<T>(read: (hasReplyTo: boolean) => T): T {
+  private get hasGroupMemberships(): boolean {
+    return (this.db.query("SELECT COUNT(*) AS count FROM sqlite_master WHERE type = 'table' AND name = 'msg_group_memberships'")
+      .get() as { count: number }).count > 0;
+  }
+
+  private readWithSchema<T>(read: (hasReplyTo: boolean, hasGroupMemberships: boolean) => T): T {
     // The schema projection and rows must share one SQLite snapshot. Otherwise a writer can
     // migrate between them and a reader could advance past a reply with its link erased.
-    return this.db.transaction(() => read(this.hasReplyTo)).deferred();
+    return this.db.transaction(() => read(this.hasReplyTo, this.hasGroupMemberships)).deferred();
   }
 
-  constructor(path: string = defaultMsgStorePath(), options: { readOnly?: boolean } = {}) {
+  constructor(path: string = defaultMsgStorePath(), options: { readOnly?: boolean; now?: () => Date } = {}) {
+    this.clock = options.now ?? (() => new Date());
     if (options.readOnly && (path === ':memory:' || !existsSync(path))) throw new Error('message ledger unavailable for read-only SSE service');
     if (!options.readOnly && path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     this.db = options.readOnly ? new Database(path, { readonly: true }) : new Database(path);
@@ -142,9 +185,27 @@ export class MsgStore {
       request_id INTEGER PRIMARY KEY REFERENCES msg_messages(id),
       status TEXT NOT NULL CHECK(status IN ('pending', 'delivered'))
     );
-    CREATE TABLE IF NOT EXISTS msg_ta_claim (
+      CREATE TABLE IF NOT EXISTS msg_ta_claim (
       request_id INTEGER PRIMARY KEY REFERENCES msg_messages(id),
       token TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS msg_groups (
+      address TEXT PRIMARY KEY
+    );
+    CREATE TABLE IF NOT EXISTS msg_group_memberships (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      address TEXT NOT NULL REFERENCES msg_groups(address),
+      seat TEXT NOT NULL,
+      joined_after_id INTEGER NOT NULL DEFAULT 0 CHECK(joined_after_id >= 0),
+      left_after_id INTEGER CHECK(left_after_id IS NULL OR left_after_id >= joined_after_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_msg_group_memberships_seat_interval ON msg_group_memberships(seat, joined_after_id, left_after_id);`);
+    if (!options.readOnly) this.db.exec(`CREATE TABLE IF NOT EXISTS msg_group_all_budget (
+      sender TEXT NOT NULL,
+      hour_start TEXT NOT NULL,
+      broadcast_count INTEGER NOT NULL CHECK(broadcast_count BETWEEN 1 AND 2),
+      summary_id INTEGER REFERENCES msg_messages(id),
+      PRIMARY KEY(sender, hour_start)
     );`);
     // Serialize the schema check and ALTER across processes opening an old ledger at once.
     if (!options.readOnly) this.db.transaction(() => {
@@ -155,9 +216,7 @@ export class MsgStore {
     }).immediate();
   }
 
-  append(input: MessageEnvelope): Message {
-    return this.insertMessage(input);
-  }
+  append(input: MessageEnvelope): Message { return this.post(input); }
 
   /** Append once for a coordination comment, task failure, or decided notification. */
   appendWithProvenance(input: MessageEnvelope, provenanceKey: string): Message {
@@ -171,9 +230,16 @@ export class MsgStore {
         FROM msg_provenance p JOIN msg_messages m ON m.id = p.message_id WHERE p.provenance_key = ?`)
         .get(provenanceKey) as MessageRow | null;
       if (existing) return fromRow(existing);
+      if (msg.to.startsWith('group:') && !this.db.query('SELECT 1 FROM msg_groups WHERE address = ?').get(msg.to)) {
+        throw new Error(`group not found: ${msg.to}`);
+      }
       const message = this.insertMessage(msg);
       this.db.query('INSERT INTO msg_provenance(provenance_key, message_id) VALUES (?, ?)')
         .run(provenanceKey, message.id);
+      if (msg.to === 'ALL') {
+        try { debug.log('msg.broadcast-budget', 'provenance-exempt', { recipient: msg.to, count: 1, messageId: message.id, provenanceKey }); }
+        catch { /* observability is fail-open; preserve the idempotent event */ }
+      }
       return message;
     }).immediate();
   }
@@ -189,7 +255,85 @@ export class MsgStore {
     return { id: Number(result.lastInsertRowid), ...msg, createdAt };
   }
 
-  post(input: MessageEnvelope): Message { return this.append(input); }
+  post(input: MessageEnvelope): Message {
+    const message = validateMessageEnvelope(input);
+    if (message.to.startsWith('group:')) return this.db.transaction(() => {
+      if (!this.db.query('SELECT 1 FROM msg_groups WHERE address = ?').get(message.to)) throw new Error(`group not found: ${message.to}`);
+      return this.insertMessage(message);
+    }).immediate();
+    if (message.to !== 'ALL') return this.insertMessage(message);
+    const now = this.clock();
+    const hourStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), now.getUTCHours())).toISOString();
+    return this.db.transaction(() => {
+      const row = this.db.query(`SELECT broadcast_count, summary_id FROM msg_group_all_budget
+        WHERE sender = ? AND hour_start = ?`).get(message.from, hourStart) as { broadcast_count: number; summary_id: number | null } | null;
+      if (row && row.broadcast_count >= 2) {
+        if (row.summary_id !== null) {
+          return this.getMessage(row.summary_id)!;
+        }
+        const summary = this.insertMessage({ from: message.from, to: 'ALL', kind: 'summary',
+          body: 'group:all 시간당 상한(2건)을 초과한 방송은 이 요약 한 건으로 접었습니다.' });
+        this.db.query('UPDATE msg_group_all_budget SET summary_id = ? WHERE sender = ? AND hour_start = ?')
+          .run(summary.id, message.from, hourStart);
+        return summary;
+      }
+      const posted = this.insertMessage(message);
+      this.db.query(`INSERT INTO msg_group_all_budget(sender, hour_start, broadcast_count, summary_id)
+        VALUES (?, ?, 1, NULL) ON CONFLICT(sender, hour_start)
+        DO UPDATE SET broadcast_count = msg_group_all_budget.broadcast_count + 1`)
+        .run(message.from, hourStart);
+      return posted;
+    }).immediate();
+  }
+
+  createGroup(name: string, owner: string): string {
+    const address = canonicalGroupAddress(name.startsWith('group:') ? name : `group:${name}`);
+    const seat = canonicalSeatId(owner);
+    return this.db.transaction(() => {
+      this.db.query('INSERT INTO msg_groups(address) VALUES (?)').run(address);
+      this.db.query('INSERT INTO msg_group_memberships(address, seat, joined_after_id) VALUES (?, ?, ?)')
+        .run(address, seat, this.latestId());
+      return address;
+    }).immediate();
+  }
+
+  joinGroup(group: string, member: string): boolean {
+    const address = canonicalGroupAddress(group);
+    const seat = canonicalSeatId(member);
+    return this.db.transaction(() => {
+      if (!this.db.query('SELECT 1 FROM msg_groups WHERE address = ?').get(address)) throw new Error(`group not found: ${address}`);
+      const existing = this.db.query('SELECT 1 FROM msg_group_memberships WHERE address = ? AND seat = ? AND left_after_id IS NULL')
+        .get(address, seat);
+      if (existing) return false;
+      this.db.query('INSERT INTO msg_group_memberships(address, seat, joined_after_id) VALUES (?, ?, ?)')
+        .run(address, seat, this.latestId());
+      return true;
+    }).immediate();
+  }
+
+  leaveGroup(group: string, member: string): boolean {
+    const address = canonicalGroupAddress(group);
+    const seat = canonicalSeatId(member);
+    return this.db.transaction(() => {
+      const result = this.db.query(`UPDATE msg_group_memberships SET left_after_id = ?
+        WHERE id = (SELECT id FROM msg_group_memberships WHERE address = ? AND seat = ? AND left_after_id IS NULL ORDER BY id DESC LIMIT 1)`)
+        .run(this.latestId(), address, seat);
+      return result.changes > 0;
+    }).immediate();
+  }
+
+  listGroups(member: string): string[] {
+    const seat = canonicalSeatId(member);
+    return (this.db.query('SELECT DISTINCT address FROM msg_group_memberships WHERE seat = ? AND left_after_id IS NULL ORDER BY address')
+      .all(seat) as Array<{ address: string }>).map(row => row.address);
+  }
+
+  isGroupDelivery(message: Message, recipient: string): boolean {
+    const seat = canonicalSeatId(recipient);
+    return message.to.startsWith('group:') && Boolean(this.db.query(`SELECT 1 FROM msg_group_memberships
+      WHERE address = ? AND seat = ? AND ? > joined_after_id AND (left_after_id IS NULL OR ? <= left_after_id)`)
+      .get(message.to, seat, message.id, message.id));
+  }
 
   /** Delivery state is separate from the single linked reply; an uncertain send keeps its claim. */
   taDeliveryStatus(requestId: number): 'pending' | 'delivered' | null {
@@ -253,9 +397,16 @@ export class MsgStore {
     if (to === 'ALL') throw new Error('ALL is a topic, not a recipient');
     validCursor(after);
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000) throw new Error('limit must be between 1 and 1000');
-    return this.readWithSchema(hasReplyTo => (this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
-      WHERE id > ? AND (recipient = ? OR (recipient = 'ALL' AND sender <> ?))
-      ORDER BY id ASC LIMIT ?`).all(after, to, to, limit) as MessageRow[]).map(fromRow));
+    return this.readWithSchema((hasReplyTo, hasGroupMemberships) => {
+      const groupClause = hasGroupMemberships ? ` OR EXISTS (
+        SELECT 1 FROM msg_group_memberships gm WHERE gm.address = msg_messages.recipient AND gm.seat = ?
+          AND msg_messages.id > gm.joined_after_id AND (gm.left_after_id IS NULL OR msg_messages.id <= gm.left_after_id)
+      )` : '';
+      const params = hasGroupMemberships ? [after, to, to, to, limit] : [after, to, to, limit];
+      return (this.db.query(`SELECT id, sender, recipient, body, kind, ${hasReplyTo ? 'reply_to' : 'NULL AS reply_to'}, created_at FROM msg_messages
+        WHERE id > ? AND (recipient = ? OR (recipient = 'ALL' AND sender <> ?)${groupClause}) ORDER BY id ASC LIMIT ?`)
+        .all(...params) as MessageRow[]).map(fromRow);
+    });
   }
 
   /** One message by durable ID, or null when absent. */
@@ -350,16 +501,23 @@ export class MsgStore {
   }
 
   unreadRecipients(): UnreadRecipient[] {
+    const hasGroups = this.hasGroupMemberships;
+    const membershipRecipients = hasGroups ? ' UNION SELECT seat FROM msg_group_memberships' : '';
+    const groupClause = hasGroups ? ` OR EXISTS (
+          SELECT 1 FROM msg_group_memberships gm WHERE gm.address = m.recipient AND gm.seat = r.recipient
+            AND m.id > gm.joined_after_id AND (gm.left_after_id IS NULL OR m.id <= gm.left_after_id)
+        )` : '';
     return this.db.query(`WITH recipients(recipient) AS (
         SELECT 'OP' UNION SELECT 'MK' UNION SELECT 'TC' UNION SELECT 'UX'
-        UNION SELECT recipient FROM msg_messages WHERE recipient <> 'ALL'
+        UNION SELECT recipient FROM msg_messages WHERE recipient <> 'ALL' AND recipient NOT LIKE 'group:%'
         UNION SELECT recipient FROM msg_cursors WHERE recipient <> 'ALL'
+        ${membershipRecipients}
       )
       SELECT r.recipient AS recipient, COUNT(m.id) AS count
       FROM recipients r
       LEFT JOIN msg_cursors c ON c.recipient = r.recipient
       JOIN msg_messages m ON m.id > COALESCE(c.last_id, 0)
-        AND (m.recipient = r.recipient OR (m.recipient = 'ALL' AND m.sender <> r.recipient))
+        AND (m.recipient = r.recipient OR (m.recipient = 'ALL' AND m.sender <> r.recipient)${groupClause})
       GROUP BY r.recipient ORDER BY r.recipient ASC`).all() as UnreadRecipient[];
   }
 

package/src/native-tool-catalog.ts

@@ -731,6 +731,27 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
     host: ['mcp'], safety: ['read-only', 'network'], supportsParallel: true, defaultEnabled: true,
     intentScope: 'ops-fleet',
   },
+  {
+    id: 'elanous_linear_secretary',
+    kind: 'other', aliases: ['ElanousLinearSecretary'], displayName: 'ElanousLinearSecretary',
+    description: 'Ground a request in repository evidence and create a Linear parent issue with 3–5 assigned subtasks. Requires an explicit due date and verified evidence. Uses the configured project unless the request contains `projectless=true` and exactly one explicit `teamKey=<KEY>` token; never guesses a destination, date or citation.',
+    promptSummary: '`elanous_linear_secretary` (ground and create a parent with 3–5 evidence-backed subtasks; team-only needs projectless=true plus one explicit teamKey=<KEY>)',
+    host: ['tui', 'mcp'], safety: ['mutating', 'network'], supportsParallel: false, defaultEnabled: true,
+    intentScope: 'ops-fleet',
+  },
+  {
+    id: 'elanous_linear_issue',
+    kind: 'other',
+    aliases: ['ElanousLinearIssue'],
+    displayName: 'ElanousLinearIssue',
+    description: 'Perform one explicitly requested Linear issue action: create directly in a team without a project, add a comment, or mark an issue complete. Requires connector.linear.apiKey.',
+    promptSummary: '`elanous_linear_issue` (create a team issue without a project, comment, or complete an issue when explicitly requested)',
+    host: ['tui', 'mcp'],
+    safety: ['mutating', 'network'],
+    supportsParallel: false,
+    defaultEnabled: true,
+    intentScope: 'ops-fleet',
+  },
   {
     id: 'elanous_asana_list_tasks',
     kind: 'other', aliases: ['ElanousAsanaListTasks'], displayName: 'ElanousAsanaListTasks',
@@ -818,6 +839,19 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
     defaultEnabled: true,
     intentScope: 'coding',
   },
+  ...(['graph_compose', 'graph_run_status', 'graph_run_start', 'graph_node_op'] as const).map((id) => ({
+    id,
+    kind: 'other' as const,
+    aliases: [],
+    displayName: id,
+    description: `MCP graph tool: ${id}`,
+    promptSummary: `\`${id}\` (MCP graph control)`,
+    host: ['mcp'] as NativeToolHost[],
+    safety: (id === 'graph_compose' || id === 'graph_run_status' ? ['read-only'] : ['mutating']) as ('read-only' | 'mutating')[],
+    supportsParallel: id === 'graph_compose' || id === 'graph_run_status',
+    defaultEnabled: true,
+    intentScope: 'coding' as const,
+  })),
   {
     id: 'elanous_autopilot_launch',
     kind: 'other',
@@ -1282,8 +1316,8 @@ export const nativeToolCatalog: NativeToolCatalogEntry[] = [
     kind: 'web',
     aliases: ['WebSearch', 'web_search'],
     displayName: 'WebSearch',
-    description: 'Search the public web via a configured provider (Grok live-search / Firecrawl / MCP / custom); when no key is available, fall back to keyless DuckDuckGo.',
-    promptSummary: '`WebSearch` (provider-backed web search — Grok live-search by default; when no key is available, fall back to keyless DuckDuckGo; pair with WebFetch for full bodies)',
+    description: 'Search the public web via Exa then Firecrawl; explicit X/Twitter intent may use Grok.',
+    promptSummary: '`WebSearch` (general web search via Exa then Firecrawl; explicit X/Twitter intent may use Grok; pair with WebFetch for full bodies)',
     host: ['skill'],
     safety: ['network', 'read-only'],
     supportsParallel: true,

package/src/nexus/api/http-server.ts

@@ -32,8 +32,10 @@ import { CARD_FOLLOWUP_PATH, createCardFollowupJobs, type CardFollowupJobs } fro
 import { SKILL_EXEC_PATH, createSkillExecJobs, type SkillExecJobs } from './skill-exec-route.js';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
 import { ensureAuthToken } from '../../auth/acp-token.js';
-import type { NexusState } from '../state/state.js';
+import { pushEvent, type NexusState } from '../state/state.js';
 import { DEFAULT_NEXUS_HTTP_PORT } from '../default-port.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { handleMissionLineRequest, MissionLineHttpError } from '../../agent-mission/mission-line.js';
 
 export { DEFAULT_NEXUS_HTTP_PORT } from '../default-port.js';
 import type { TabRegistry } from '../state/tab-registry.js';
@@ -497,6 +499,8 @@ export interface NexusHttpServerOpts {
   projectFolderRoots?: string[];
   /** Optional installer state root for isolated API consumers and tests. */
   pluginStateRoot?: string;
+  /** Mission-addressed hand line storage; production uses the current instance state root. */
+  missionLineRoot?: string;
   outputs?: OutputsDeps;
   /** Read-only grid measurement seam; omitted in production for live HQ and Pod pool reads. */
   grid?: GridDeps;
@@ -1008,6 +1012,38 @@ export async function routeRequest(
   registerAuthPeerAddress(req, (server as BunServerLike & {
     requestIP?: (request: Request) => { address: string } | null;
   }).requestIP?.(req)?.address);
+  // Mission lines use a scoped per-mission bearer issued by the mission
+  // parent, not the owner/API bearer checked by the general scope guard.
+  if (new URL(req.url).pathname.startsWith('/v1/missions/')) {
+    // MissionOutStore uses effectiveInstanceRoot too; share the resolver
+    // directly so custom ELANOUS_STATE_DIR/config-dir cannot split the token
+    // authority from the reply ledger.
+    const root = opts.missionLineRoot ?? effectiveInstanceRoot();
+    const response = await handleMissionLineRequest(req, root, async (input, authority) => {
+      const { createMissionOutStore, MissionReplyStateError } = await import('../../agent-mission/mission-out.js');
+      const reply = await createMissionOutStore(root).reply(input.missionId, input.text, input.type === 'final', {
+          lineId: input.lineId,
+          ...(input.runId ? { runId: input.runId } : {}), ...(input.ptyId ? { ptyId: input.ptyId } : {}),
+          ...(input.replyTo ? { replyTo: input.replyTo } : {}),
+          attemptId: input.attemptId, agent: input.agent, lineType: input.type, source: input.source,
+          ...(input.kind ? { kind: input.kind } : {}),
+          ...(input.defaults ? { defaults: input.defaults } : {}),
+          ...(input.deadline ? { deadline: input.deadline } : {}),
+          ...(input.scope ? { scope: input.scope } : {}),
+          ...(input.stop !== undefined ? { stop: input.stop } : {}),
+          ...(input.priority ? { priority: input.priority } : {}),
+          ...(input.state ? { state: input.state } : {}), who: authority.who, what: authority.what,
+          ...(input.type === 'ask' || input.type === 'answer' || input.type === 'correct' ? { kind: input.type } : {}),
+        }).catch((error: unknown) => {
+        if (error instanceof MissionReplyStateError) throw new MissionLineHttpError(error.status);
+        throw error;
+      });
+      return { ...input, sequence: reply.sequence, createdAt: reply.createdAt, done: reply.done, ...(reply.deadline ? { deadline: reply.deadline } : {}), ...(reply.replyTo ? { replyTo: reply.replyTo } : {}), ...(reply.graphEvents ? { graphEvents: reply.graphEvents } : {}) };
+    }, (event) => {
+      pushEvent(opts.state, { kind: 'mission.line', detail: event as unknown as Record<string, unknown> });
+    });
+    if (response) return response;
+  }
   if (opts.metaApi && setupBearerScopeDenied(req, opts.metaApi)) {
     return jsonResponse({ error: 'forbidden' }, 403);
   }

package/src/nexus/api/mcp-public-allowlist.ts

@@ -14,6 +14,8 @@ export const MCP_PUBLIC_TOOLS = new Set([
   'elanous_obsidian_search',
   'agent_list',
   'agent_output',
+  'graph_compose',
+  'graph_run_status',
 ]);
 
 function catalogId(name: string): string | undefined {

package/src/nexus/index.ts

@@ -252,7 +252,7 @@ import type { HealthProbeBackend } from './supervisor/health.js';
 import { gracefulExit, cleanExit } from './supervisor/graceful-exit.js';
 import { restoreFromPending } from './supervisor/restore-state.js';
 import { resolveHeadlessMode } from './headless-mode.js';
-import { checkSetupStatus, readNexusSetupMode, renderSetupStatus, setupBootMode, setupModeBootPlan } from './setup-status.js';
+import { checkSetupStatus, readNexusSetupMode, renderSetupStatus, setupBootMode, setupModeBootPlan, shouldCheckHeadlessSetup } from './setup-status.js';
 import { probeTailscale } from './onboarding/tailscale-probe.js';
 import {
   runPwaSharePrompt,
@@ -859,7 +859,12 @@ export async function runNexus(opts: RunNexusOptions = {}): Promise<RunNexusHand
   }
 
   const headless = resolveHeadlessMode({ ...(opts.headless !== undefined ? { headless: opts.headless } : {}) });
-  if (headless && !opts.detachForTesting && !opts.skipHeadlessSetupCheckForTesting) {
+  if (shouldCheckHeadlessSetup({
+    headless,
+    detachedForTesting: opts.detachForTesting === true,
+    skipForTesting: opts.skipHeadlessSetupCheckForTesting === true,
+    testInstance: resolveCurrentInstance().kind === 'test',
+  })) {
     const setup = checkSetupStatus({ argvBin: process.argv[1] ?? '' });
     const boot = setupBootMode(setup);
     if (boot.mode === 'refuse') {

package/src/nexus/outbound/format.ts

@@ -14,6 +14,15 @@ export interface OutboundMsg {
   kind: string;
   /** Optional routing role; absent preserves per-kind fan-out. */
   role?: string;
+  /** Optional transport metadata. A router must not send these fields to a connector that does not declare support. */
+  threadId?: string;
+  topicId?: string;
+  persona?: { name: string; avatarUrl?: string };
+  attachments?: readonly { url: string; name?: string }[];
+  buttons?: readonly { label: string; value: string }[];
+  choices?: readonly { label: string; value: string }[];
+  /** Requested channel-side authorization; delivery fails closed when unsupported or denied. */
+  permissionAction?: string;
 }
 
 export interface FormattedMessage {

package/src/nexus/outbound/router.ts

@@ -61,6 +61,23 @@ export interface ChannelCapabilities {
   rateLimit: boolean;
 }
 
+const CHANNEL_CAPABILITY_KEYS = {
+  send: true,
+  receive: true,
+  thread: true,
+  topic: true,
+  persona: true,
+  channelLifecycle: true,
+  permissions: true,
+  commands: true,
+  attachments: true,
+  buttons: true,
+  choices: true,
+  deliveryConfirmation: true,
+  rateLimit: true,
+} satisfies Record<keyof ChannelCapabilities, true>;
+const CHANNEL_CAPABILITY_KEY_LIST = Object.keys(CHANNEL_CAPABILITY_KEYS) as (keyof ChannelCapabilities)[];
+
 export interface ChannelEnvelope {
   text: string;
   kind: string;
@@ -98,7 +115,34 @@ export interface ChannelAdapter {
 export function receiveChannelEvent(type: string, payload: unknown): ChannelEnvelope | null | Promise<ChannelEnvelope | null> {
   const adapter = outboundAdapters.get(type) ?? installedAdapters.get(type);
   if (!adapter?.capabilities.receive || !adapter.receive) return null;
-  return adapter.receive(payload);
+  const recordOutcome = (outcome: 'accepted' | 'rejected' | 'error'): void => {
+    try {
+      const runId = process.env.ELANOUS_RUN_ID;
+      debug.log('nexus.outbound', 'receive-conformance', {
+        ...(runId ? { runId } : {}),
+        provider: type,
+        outcome,
+      });
+    } catch { /* observation must not change channel receive behavior */ }
+  };
+  const recordResult = (envelope: ChannelEnvelope | null): ChannelEnvelope | null => {
+    recordOutcome(envelope ? 'accepted' : 'rejected');
+    return envelope;
+  };
+
+  try {
+    const result = adapter.receive(payload);
+    if (result && typeof (result as Promise<ChannelEnvelope | null>).then === 'function') {
+      return Promise.resolve(result).then(recordResult, error => {
+        recordOutcome('error');
+        throw error;
+      });
+    }
+    return recordResult(result as ChannelEnvelope | null);
+  } catch (error) {
+    recordOutcome('error');
+    throw error;
+  }
 }
 
 export interface OutboundChannelConfig {
@@ -113,21 +157,43 @@ export interface OutboundChannelConfig {
 }
 
 /** Connector providers register while the host is running; unregister on plugin
- * deactivation. Built-ins cannot be replaced by a plugin or removed. */
+ * deactivation. Invalid contracts throw so the plugin host can fail activation
+ * closed. Built-ins cannot be replaced by a plugin or removed. */
 const installedAdapters = new Map<string, ChannelAdapter>();
 export function registerOutboundAdapter(adapter: ChannelAdapter): () => void {
-  if (!/^[a-z][a-z0-9-]*$/.test(adapter.type) || outboundAdapters.has(adapter.type) || installedAdapters.has(adapter.type)
-    || !adapter.capabilities.send || typeof adapter.send !== 'function' || typeof adapter.parseConfig !== 'function'
-    || (adapter.capabilities.receive && typeof adapter.receive !== 'function')
-    || (adapter.capabilities.channelLifecycle && (typeof adapter.createChannel !== 'function' || typeof adapter.archiveChannel !== 'function'))
-    || (adapter.capabilities.permissions && typeof adapter.checkPermission !== 'function')
-    || (adapter.capabilities.commands && typeof adapter.registerCommands !== 'function')
-    || (adapter.capabilities.deliveryConfirmation && typeof adapter.confirmDelivery !== 'function')
-    || (adapter.capabilities.rateLimit && typeof adapter.retryAfterMs !== 'function')) {
-    throw new Error(`invalid or duplicate outbound connector: ${adapter.type}`);
+  let adapterType = '';
+  let validContract = false;
+  try {
+    adapterType = adapter?.type ?? '';
+    const capabilities = adapter?.capabilities;
+    let completeCapabilities = false;
+    if (capabilities && typeof capabilities === 'object') {
+      const ownKeys = Reflect.ownKeys(capabilities);
+      completeCapabilities = ownKeys.length === CHANNEL_CAPABILITY_KEY_LIST.length
+        && ownKeys.every((key) => typeof key === 'string' && CHANNEL_CAPABILITY_KEY_LIST.includes(key as keyof ChannelCapabilities))
+        && CHANNEL_CAPABILITY_KEY_LIST.every((key) => {
+          const descriptor = Object.getOwnPropertyDescriptor(capabilities, key);
+          return !!descriptor && Object.hasOwn(descriptor, 'value') && typeof descriptor.value === 'boolean';
+        });
+    }
+    validContract = /^[a-z][a-z0-9-]*$/.test(adapterType)
+      && !outboundAdapters.has(adapterType) && !installedAdapters.has(adapterType)
+      && completeCapabilities && !!capabilities?.send
+      && typeof adapter.send === 'function' && typeof adapter.parseConfig === 'function'
+      && (!capabilities.receive || typeof adapter.receive === 'function')
+      && (!capabilities.channelLifecycle || (typeof adapter.createChannel === 'function' && typeof adapter.archiveChannel === 'function'))
+      && (!capabilities.permissions || typeof adapter.checkPermission === 'function')
+      && (!capabilities.commands || typeof adapter.registerCommands === 'function')
+      && (!capabilities.deliveryConfirmation || typeof adapter.confirmDelivery === 'function')
+      && (!capabilities.rateLimit || typeof adapter.retryAfterMs === 'function');
+  } catch {
+    // Capability objects with throwing reflection traps fail closed at the plugin boundary.
   }
-  installedAdapters.set(adapter.type, adapter);
-  return () => { if (installedAdapters.get(adapter.type) === adapter) installedAdapters.delete(adapter.type); };
+  if (!validContract) {
+    throw new Error(`invalid or duplicate outbound connector: ${adapterType || '[unknown]'}`);
+  }
+  installedAdapters.set(adapterType, adapter);
+  return () => { if (installedAdapters.get(adapterType) === adapter) installedAdapters.delete(adapterType); };
 }
 
 export interface OutboundFanoutConfig {
@@ -394,6 +460,25 @@ export async function routeOutbound(cfg: UserConfig, msg: OutboundMsg, deps: Rou
     try {
       const adapter = deps.adapters?.get(ch.type) ?? outboundAdapters.get(ch.type) ?? installedAdapters.get(ch.type);
       if (!adapter?.capabilities.send) return { type: ch.type, ok: false, error: 'unsupported-channel' };
+      const requirements: Array<[keyof ChannelCapabilities, boolean]> = [
+        ['thread', outMsg.threadId !== undefined],
+        ['topic', outMsg.topicId !== undefined],
+        ['persona', outMsg.persona !== undefined],
+        ['attachments', outMsg.attachments !== undefined],
+        ['buttons', outMsg.buttons !== undefined],
+        ['choices', outMsg.choices !== undefined],
+      ];
+      if (requirements.some(([capability, requested]) => requested && !adapter.capabilities[capability]))
+        return { type: ch.type, ok: false, error: 'unsupported-capability' };
+      if (outMsg.permissionAction !== undefined) {
+        if (!adapter.capabilities.permissions || typeof adapter.checkPermission !== 'function')
+          return { type: ch.type, ok: false, error: 'unsupported-capability' };
+        if (!outMsg.permissionAction.trim()) return { type: ch.type, ok: false, error: 'invalid-permission-action' };
+        let allowed = false;
+        try { allowed = await adapter.checkPermission(outMsg.permissionAction); }
+        catch { return { type: ch.type, ok: false, error: 'permission-check-failed' }; }
+        if (!allowed) return { type: ch.type, ok: false, error: 'permission-denied' };
+      }
       const result = await adapter.send(ch, outMsg, cfg, deps);
       // A connector may not impersonate another channel or echo credentials
       // through the response. Legacy built-in result fields stay unchanged.

package/src/nexus/setup-status.ts

@@ -33,6 +33,15 @@ export interface SetupCheckResult {
 
 export type SetupBootMode = 'normal' | 'setup' | 'refuse';
 
+export function shouldCheckHeadlessSetup(opts: {
+  headless: boolean;
+  detachedForTesting: boolean;
+  skipForTesting: boolean;
+  testInstance: boolean;
+}): boolean {
+  return opts.headless && !opts.detachedForTesting && !opts.skipForTesting && !opts.testInstance;
+}
+
 export interface SetupBootDecision {
   mode: SetupBootMode;
   missing: string[];

package/src/nexus/state/state.ts

@@ -93,6 +93,9 @@ export interface NexusEvent {
     // SSE 로 **내용을 담은** 메시지레벨 갱신을 받는다(content-less `session.updated` 와 달리
     // role/text 포함). 스트리밍(ACP peer broadcast)은 C5 별도. `detail` = { sessionId, role, text }.
     | 'session.output'
+    // Hand mission addressed line. Durable rows live in agent-missions; this event
+    // is only the existing /v1/events SSE notification edge.
+    | 'mission.line'
     // Rich-dev-feedback opportunistic followup §6.2 #3 (2026-05-13) —
     // AgentStatusStore lifecycle fan-out. The bridge in
     // `agent-status-event-bridge.ts` subscribes to the store and