elanous 0.2.43 → 0.2.44

package/graphs/release/release-loop.yaml

@@ -21,6 +21,7 @@ nodes:
   # Public export is checked before expensive prefetch/gate work; a leak stops the release immediately.
   - { node_id: export-check, kind: gate, recipe: 'cmd:export-check', max_visits: 1 }
   - { node_id: prefetch, kind: agent, recipe: 'cmd:docs', max_visits: 1 }
+  - { node_id: pre-gate-join, kind: gate, recipe: none, max_visits: 1 }
   - { node_id: gate, kind: gate, recipe: 'cmd:gate', max_visits: 1, notify: { on: [fail] } }
   # Deterministic, best-effort traffic transition; it never changes the release verdict.
   - { node_id: traffic-gate-passed, kind: gate, recipe: 'cmd:traffic-gate-passed', max_visits: 1 }
@@ -28,6 +29,7 @@ nodes:
   - { node_id: gate-triage, kind: judge, recipe: 'cmd:gate-triage', max_visits: 1 }
   - { node_id: mac-smoke, kind: gate, recipe: 'cmd:mac-smoke', max_visits: 1 }
   - { node_id: pwa, kind: gate, recipe: 'cmd:pwa', max_visits: 1, notify: { on: [fail] } }
+  - { node_id: pre-prepare-join, kind: gate, recipe: none, max_visits: 1 }
   - { node_id: prepare, kind: agent, recipe: 'cmd:prepare', max_visits: 1, notify: { on: [fail] } }
   - { node_id: upgrade, kind: gate, recipe: 'cmd:upgrade', max_visits: 1 }
   - { node_id: tui, kind: gate, recipe: 'cmd:docs', max_visits: 1 }
@@ -44,13 +46,13 @@ nodes:
   - { node_id: npm-publish, kind: git, recipe: 'cmd:npm-publish', max_visits: 1 }
   - { node_id: traffic-npm-published, kind: gate, recipe: 'cmd:traffic-npm-published', max_visits: 1 }
   - { node_id: docs-land, kind: git, recipe: 'cmd:docs-land', max_visits: 1 }
+  - { node_id: release-post-publish-join, kind: gate, recipe: none, max_visits: 1 }
   - { node_id: verify, kind: gate, recipe: 'cmd:verify', max_visits: 1, notify: { on: [ok, fail] } }
   - { node_id: traffic-verify-complete, kind: gate, recipe: 'cmd:traffic-verify-complete', max_visits: 1 }
   - { node_id: vault-note, kind: gate, recipe: 'cmd:vault-note', max_visits: 1 }
   - { node_id: release-story, kind: gate, recipe: 'cmd:release-story', max_visits: 1 }
   - { node_id: ops-upgrade, kind: agent, recipe: 'cmd:ops-upgrade', max_visits: 1 }
   - { node_id: version-dev-bump, kind: git, recipe: 'cmd:version-dev-bump', max_visits: 1 }
-  - { node_id: version-dev-bump-after-failure, kind: git, recipe: 'cmd:version-dev-bump', max_visits: 1 }
   - { node_id: traffic-failed-restore, kind: gate, recipe: 'cmd:traffic-failed-restore', max_visits: 1 }
   - { node_id: done, kind: gate, max_visits: 1 }
   - { node_id: failed, kind: gate, max_visits: 1 }
@@ -58,18 +60,29 @@ edges:
   - { from: version-release, on: outcome, map: { ok: traffic-cut-start, fail: failed, error: failed } }
   # Advisory traffic writes report failure to OP; release steps still proceed on fail/error.
   - { from: traffic-cut-start, on: outcome, map: { ok: cutoff, fail: cutoff, error: cutoff } }
-  - { from: cutoff, on: outcome, map: { ok: checklist-gate, fail: traffic-failed-restore, error: traffic-failed-restore } }
-  - { from: checklist-gate, on: outcome, map: { ok: export-check, fail: traffic-failed-restore, error: traffic-failed-restore } }
-  - { from: export-check, on: outcome, map: { ok: prefetch, fail: traffic-failed-restore, error: traffic-failed-restore } }
-  # Prefetch never gates: even a crashed prefetch node is a cache miss — the late nodes take their original paths.
-  - { from: prefetch, on: outcome, map: { ok: gate, fail: gate, error: gate } }
+  - { from: cutoff, on: outcome, map: { ok: export-check, fail: traffic-failed-restore, error: traffic-failed-restore } }
+  - from: export-check
+    on: outcome
+    map: { fail: traffic-failed-restore, error: traffic-failed-restore }
+    # This single edge launches checklist-gate and prefetch concurrently; the join routes checklist failures to restore.
+    branches: { ok: [checklist-gate, prefetch] }
+    warning_branches: [prefetch]
+    join: pre-gate-join
+  # Export is required before fanout; checklist and prefetch then run together, with prefetch warning-only.
+  - { from: pre-gate-join, on: outcome, map: { ok: gate, fail: traffic-failed-restore, error: traffic-failed-restore } }
   - { from: gate, on: outcome, map: { ok: traffic-gate-passed, fail: gate-triage, error: gate-triage } }
   # Warning-only: the transition result stays truthful; every outcome continues to the next release node.
-  - { from: traffic-gate-passed, on: outcome, map: { ok: mac-smoke, fail: mac-smoke, error: mac-smoke } }
+  - from: traffic-gate-passed
+    on: outcome
+    branches:
+      ok: [mac-smoke, pwa]
+      fail: [mac-smoke, pwa]
+      error: [mac-smoke, pwa]
+    warning_branches: [mac-smoke]
+    join: pre-prepare-join
   - { from: gate-triage, on: outcome, map: { ok: traffic-failed-restore, fail: traffic-failed-restore, error: traffic-failed-restore } }
   # Warning-only: a macOS failure or unmeasured run never blocks publishing — auto-approve shows it as a warning row.
-  - { from: mac-smoke, on: outcome, map: { ok: pwa, fail: pwa, error: pwa } }
-  - { from: pwa, on: outcome, map: { ok: prepare, fail: traffic-failed-restore, error: traffic-failed-restore } }
+  - { from: pre-prepare-join, on: outcome, map: { ok: prepare, fail: traffic-failed-restore, error: traffic-failed-restore } }
   - { from: prepare, on: outcome, map: { ok: upgrade, fail: traffic-failed-restore, error: traffic-failed-restore } }
   - { from: upgrade, on: outcome, map: { ok: tui, fail: traffic-failed-restore, error: traffic-failed-restore } }
   - { from: tui, on: outcome, map: { ok: docs, fail: traffic-failed-restore, error: traffic-failed-restore } }
@@ -84,16 +97,19 @@ edges:
   - { from: publish, on: outcome, map: { ok: npm-publish, fail: traffic-failed-restore, error: traffic-failed-restore } }
   - { from: npm-publish, on: outcome, map: { ok: traffic-npm-published, fail: traffic-failed-restore, error: traffic-failed-restore } }
   # Publication already happened; a traffic write failure must not skip docs-land.
-  - { from: traffic-npm-published, on: outcome, map: { ok: docs-land, fail: docs-land, error: docs-land } }
-  # RELEASE-DEVBUMP-ALWAYS: after a successful publish every fail/error routes through version-dev-bump —
-  # a published release always hands main to its own next -dev, then still finishes failed.
-  - { from: docs-land, on: outcome, map: { ok: verify, fail: version-dev-bump-after-failure, error: version-dev-bump-after-failure } }
-  - { from: verify, on: outcome, map: { ok: traffic-verify-complete, fail: version-dev-bump-after-failure, error: version-dev-bump-after-failure } }
+  # After npm publish these writes have independent ledgers and run together; the join keeps either result and gates verify.
+  - from: traffic-npm-published
+    on: outcome
+    branches:
+      ok: [docs-land, version-dev-bump]
+      fail: [docs-land, version-dev-bump]
+      error: [docs-land, version-dev-bump]
+    join: release-post-publish-join
+  - { from: release-post-publish-join, on: outcome, map: { ok: verify, fail: traffic-failed-restore, error: traffic-failed-restore } }
+  - { from: verify, on: outcome, map: { ok: traffic-verify-complete, fail: traffic-failed-restore, error: traffic-failed-restore } }
   - { from: traffic-verify-complete, on: outcome, map: { ok: vault-note, fail: vault-note, error: vault-note } }
   # Warning-only: vault note and release story failures after publication never block operational upgrades.
   - { from: vault-note, on: outcome, map: { ok: release-story, fail: release-story, error: release-story } }
   - { from: release-story, on: outcome, map: { ok: ops-upgrade, fail: ops-upgrade, error: ops-upgrade } }
-  - { from: ops-upgrade, on: outcome, map: { ok: version-dev-bump, fail: version-dev-bump, error: version-dev-bump } }
-  - { from: version-dev-bump, on: outcome, map: { ok: done, fail: traffic-failed-restore, error: traffic-failed-restore } }
-  - { from: version-dev-bump-after-failure, on: outcome, map: { ok: traffic-failed-restore, fail: traffic-failed-restore, error: traffic-failed-restore } }
+  - { from: ops-upgrade, on: outcome, map: { ok: done, fail: done, error: done } }
   - { from: traffic-failed-restore, on: outcome, map: { ok: failed, fail: failed, error: failed } }

package/graphs/units/verbs/make-doc.yaml

@@ -32,3 +32,4 @@ edges:
   - from: document-draft
     on: outcome
     map: { done: done, rework: rework, needs-human: needs-human, failed: failed }
+    fallback: [{ node: failed, requires: [] }]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "elanous",
   "mcpName": "io.github.ElanvitalAI/elanous",
-  "version": "0.2.43",
+  "version": "0.2.44",
   "description": "Self-healing coding harness where eyes, hands, and memory all turn on one sentence — it authors its own goals, implements them in isolated worktrees, and reviews its own work.",
   "license": "Apache-2.0",
   "author": "Elanvital AI",

package/scripts/bench-metering-plan.ts

@@ -0,0 +1,229 @@
+#!/usr/bin/env bun
+/** Validate that a paired benchmark has measurement sources and private sinks planned.
+ * This checks the plan only: it never launches arms, reads credentials, or claims measurements. */
+import { readFile } from 'node:fs/promises';
+
+export type BenchProvider = 'openrouter' | 'bedrock' | 'elanous' | 'claude-code';
+
+export interface BenchMetricSource {
+  readonly collector: string;
+  readonly evidenceRef: string;
+  readonly region?: string;
+  readonly windowStartUtc?: string;
+  readonly windowEndUtc?: string;
+}
+
+export interface BenchArmMeteringPlan {
+  readonly armId: string;
+  readonly provider: BenchProvider;
+  /** Product/agent identity is separate from the provider that supplies billing. */
+  readonly agent?: 'elanous' | 'claude-code' | 'provider-arm';
+  readonly billingProvider: string;
+  readonly noAutoMerge: boolean;
+  readonly metrics: Readonly<Record<string, BenchMetricSource | BenchMetricDisposition>>;
+}
+
+export interface BenchMetricDisposition {
+  readonly status: 'not-applicable' | 'estimated' | 'unmeasured';
+  readonly reason: string;
+  readonly evidenceRef: string;
+}
+
+export interface BenchMeteringPlan {
+  readonly schemaVersion: 1;
+  readonly runId: string;
+  readonly promptSha256: string;
+  readonly baseSha: string;
+  readonly installedPin: string;
+  readonly arms: readonly BenchArmMeteringPlan[];
+  readonly sealed: {
+    readonly directory: string;
+    readonly directoryMode: string;
+    readonly unblindKey: string;
+    readonly meteringReceipt: string;
+    readonly fileMode: string;
+  };
+  readonly publicFields: readonly string[];
+}
+
+export interface BenchMeteringPlanCheck {
+  readonly readyToMeasure: boolean;
+  readonly metricsMeasured: false;
+  readonly armsLaunched: 0;
+  readonly issues: readonly string[];
+}
+
+const SHA256 = /^[0-9a-f]{64}$/i;
+const COMMIT = /^[0-9a-f]{40}$/i;
+const PROVIDER_PAIR_METRICS = [
+  'actualProvider',
+  'actualModel',
+  'rounds',
+  'inputTokens',
+  'outputTokens',
+  'elapsedMs',
+  'humanInterventions',
+  'actualChargeUsd',
+  'creditDelta',
+] as const;
+const COMPARISON_METRICS = [
+  'actualProvider', 'actualModel', 'rounds', 'inputTokens', 'outputTokens',
+  'toolCalls', 'elapsedMs', 'humanInterventions',
+] as const;
+const BEDROCK_METRICS = ['awsInvocationCount'] as const;
+const PRIVATE_PUBLIC_FIELDS = /^(armId|provider|billingProvider|model|actualProvider|actualModel|elapsedMs|durationMs|humanInterventions|toolCalls|actualChargeUsd|estimatedChargeUsd|creditDelta|awsInvocationCount|accountId|region)$/i;
+const SECRET_PROPERTY = /^(api[_-]?key|(?:secret|access)[_-]?(?:access)?key(?:id)?|authorization|password|credential|token)$/i;
+
+function record(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function scanSecretPropertyNames(value: unknown, path = '$'): string[] {
+  if (Array.isArray(value)) return value.flatMap((entry, index) => scanSecretPropertyNames(entry, `${path}[${index}]`));
+  if (!record(value)) return [];
+  return Object.entries(value).flatMap(([key, nested]) => [
+    ...(SECRET_PROPERTY.test(key) ? [`${path}.${key}: credentials are not allowed in a measurement plan`] : []),
+    ...scanSecretPropertyNames(nested, `${path}.${key}`),
+  ]);
+}
+
+function validSource(value: unknown): value is BenchMetricSource {
+  const usableRef = (candidate: unknown): candidate is string => typeof candidate === 'string'
+    && candidate.trim().length > 0
+    && !/^(pending|tbd|unknown|n\/a)$/i.test(candidate.trim());
+  return record(value) && usableRef(value.collector) && usableRef(value.evidenceRef);
+}
+
+function isDisposition(value: unknown): value is BenchMetricDisposition {
+  return record(value) && ['not-applicable', 'estimated', 'unmeasured'].includes(String(value.status));
+}
+
+function validDisposition(value: unknown): value is BenchMetricDisposition {
+  return isDisposition(value) && typeof value.reason === 'string' && value.reason.trim().length > 0
+    && validSource({ collector: 'disposition', evidenceRef: value.evidenceRef });
+}
+
+function validAwsSource(value: unknown): value is BenchMetricSource {
+  if (!validSource(value) || typeof value.region !== 'string' || value.region.trim().length === 0) return false;
+  if (typeof value.windowStartUtc !== 'string' || typeof value.windowEndUtc !== 'string') return false;
+  const start = Date.parse(value.windowStartUtc);
+  const end = Date.parse(value.windowEndUtc);
+  return Number.isFinite(start) && Number.isFinite(end) && start < end
+    && value.windowStartUtc.endsWith('Z') && value.windowEndUtc.endsWith('Z');
+}
+
+/** The output is deliberately plan-ready, never measurement-ready. */
+export function checkBenchMeteringPlan(input: unknown): BenchMeteringPlanCheck {
+  const issues = scanSecretPropertyNames(input);
+  const issue = (message: string): void => { issues.push(message); };
+  if (!record(input)) {
+    issue('plan must be a JSON object');
+    return { readyToMeasure: false, metricsMeasured: false, armsLaunched: 0, issues };
+  }
+  if (input.schemaVersion !== 1) issue('schemaVersion must be 1');
+  if (typeof input.runId !== 'string' || input.runId.trim().length === 0) issue('runId is required');
+  if (typeof input.promptSha256 !== 'string' || !SHA256.test(input.promptSha256)) issue('promptSha256 must be a full SHA-256');
+  if (typeof input.baseSha !== 'string' || !COMMIT.test(input.baseSha)) issue('baseSha must be a full commit SHA');
+  if (typeof input.installedPin !== 'string' || !COMMIT.test(input.installedPin)) issue('installedPin must be a full commit SHA');
+
+  const arms = Array.isArray(input.arms) ? input.arms : [];
+  if (arms.length !== 2) issue('exactly two paired arms are required');
+  const claudePair = arms.some((arm) => record(arm) && arm.provider === 'elanous')
+    && arms.some((arm) => record(arm) && arm.provider === 'claude-code');
+  const providers = new Set<string>();
+  const armIds = new Set<string>();
+  for (const [index, arm] of arms.entries()) {
+    const prefix = `arms[${index}]`;
+    if (!record(arm)) { issue(`${prefix} must be an object`); continue; }
+    if (typeof arm.armId !== 'string' || arm.armId.trim().length === 0) issue(`${prefix}.armId is required`);
+    else if (armIds.has(arm.armId)) issue(`${prefix}.armId must be unique`);
+    else armIds.add(arm.armId);
+    if (!['openrouter', 'bedrock', 'elanous', 'claude-code'].includes(String(arm.provider))) issue(`${prefix}.provider must be openrouter, bedrock, elanous, or claude-code`);
+    else providers.add(arm.provider as string);
+    if (typeof arm.billingProvider !== 'string' || arm.billingProvider.trim().length === 0) issue(`${prefix}.billingProvider is required`);
+    if (arm.provider === 'bedrock' && arm.billingProvider !== 'bedrock') issue(`${prefix}.billingProvider must match bedrock`);
+    if (arm.provider === 'openrouter' && arm.billingProvider !== 'openrouter') issue(`${prefix}.billingProvider must match openrouter`);
+    if (arm.provider === 'claude-code' && (arm.agent !== 'claude-code' || arm.billingProvider !== 'subscription')) issue(`${prefix} Claude Code arm must identify agent claude-code and subscription billing`);
+    if (arm.provider === 'elanous') {
+      if (arm.agent !== 'elanous') issue(`${prefix} Elanous arm must identify agent elanous`);
+      if (!['openrouter', 'bedrock', 'codex'].includes(String(arm.billingProvider))) issue(`${prefix} Elanous billingProvider must be openrouter, bedrock, or codex`);
+    }
+    if (arm.noAutoMerge !== true) issue(`${prefix}.noAutoMerge must be true`);
+    const metrics = record(arm.metrics) ? arm.metrics : {};
+    const requiredMetrics = claudePair
+      ? COMPARISON_METRICS
+      : PROVIDER_PAIR_METRICS;
+    for (const metric of [...requiredMetrics, ...(arm.provider === 'bedrock' ? BEDROCK_METRICS : [])]) {
+      const value = metrics[metric];
+      if (isDisposition(value)) {
+        if (!validDisposition(value)) issue(`${prefix}.metrics.${metric} disposition needs a reason and evidenceRef`);
+        else if (value.status === 'unmeasured') issue(`${prefix}.metrics.${metric} is explicitly unmeasured; a collector and evidenceRef are required`);
+        else if (value.status === 'estimated') issue(`${prefix}.metrics.${metric} is estimated; a measured source is required`);
+        else if (metric !== 'actualChargeUsd' || arm.provider !== 'claude-code') issue(`${prefix}.metrics.${metric} is not applicable and cannot satisfy a required measurement`);
+      } else {
+        const sourceIsValid = metric === 'awsInvocationCount' ? validAwsSource(value) : validSource(value);
+        if (!sourceIsValid) issue(`${prefix}.metrics.${metric} needs a collector and evidenceRef${metric === 'awsInvocationCount' ? ', region, and an ordered UTC window' : ''}`);
+      }
+    }
+    const chargeMetric = metrics.actualChargeUsd;
+    const chargeSource = record(chargeMetric) ? chargeMetric.collector : undefined;
+    // This is deliberately a naming heuristic; it cannot prove the referenced billing artifact is genuine.
+    if (typeof chargeSource === 'string' && /estimate|rate.?card/i.test(chargeSource)) {
+      issue(`${prefix}.metrics.actualChargeUsd must identify an actual billing source, not an estimate`);
+    }
+    if (arm.provider === 'claude-code') {
+      if (!record(chargeMetric) || chargeMetric.status !== 'not-applicable'
+        || chargeMetric.reason !== 'subscription · no billing source'
+        || !validSource({ collector: 'subscription-disposition', evidenceRef: chargeMetric.evidenceRef })) {
+        issue(`${prefix}.metrics.actualChargeUsd must explicitly state subscription · no billing source`);
+      }
+      if ('creditDelta' in metrics) issue(`${prefix}.metrics.creditDelta must not imply subscription credit measurement`);
+    } else if (!validSource(chargeMetric)) {
+      issue(`${prefix}.metrics.actualChargeUsd needs an actual billing source`);
+    }
+    if ('estimatedChargeUsd' in metrics) {
+      const estimate = metrics.estimatedChargeUsd;
+      if (!record(estimate) || estimate.status !== 'estimated' || typeof estimate.reason !== 'string' || !estimate.reason.trim()
+        || !validSource({ collector: 'estimate', evidenceRef: estimate.evidenceRef })) {
+        issue(`${prefix}.metrics.estimatedChargeUsd must be explicitly marked estimated with reason and evidenceRef`);
+      }
+    }
+  }
+  const providerPair = providers.has('openrouter') && providers.has('bedrock');
+  const validClaudePair = providers.has('elanous') && providers.has('claude-code');
+  if (!providerPair && !validClaudePair) issue('pair must be openrouter + bedrock or elanous + claude-code');
+
+  const sealed = record(input.sealed) ? input.sealed : {};
+  if (sealed.directory !== 'sealed' || sealed.directoryMode !== '0700') issue('sealed output directory must be sealed/ with mode 0700');
+  if (sealed.unblindKey !== 'sealed/unblind-key.json') issue('unblind key must use the bench-blind-pack sealed path');
+  if (sealed.meteringReceipt !== 'sealed/metering-receipt.json') issue('metering receipt must stay beside the unblind key');
+  if (sealed.fileMode !== '0600') issue('sealed files must use mode 0600');
+
+  const publicFields = Array.isArray(input.publicFields) ? input.publicFields : [];
+  for (const field of publicFields) {
+    if (typeof field !== 'string' || PRIVATE_PUBLIC_FIELDS.test(field)) issue(`private metering/identity field cannot enter public output: ${String(field)}`);
+  }
+  return { readyToMeasure: issues.length === 0, metricsMeasured: false, armsLaunched: 0, issues };
+}
+
+async function main(argv: string[]): Promise<number> {
+  if (argv.length !== 1 || argv.includes('--help') || argv.includes('-h')) {
+    process.stderr.write('Usage: bun scripts/bench-metering-plan.ts <measurement-plan.json>\n');
+    return argv.includes('--help') || argv.includes('-h') ? 0 : 2;
+  }
+  try {
+    const plan = JSON.parse(await readFile(argv[0]!, 'utf8')) as unknown;
+    const result = checkBenchMeteringPlan(plan);
+    if (!result.readyToMeasure) {
+      process.stderr.write(`bench metering plan refused (${result.issues.length} issue(s)):\n${result.issues.map((entry) => `- ${entry}`).join('\n')}\n`);
+      return 2;
+    }
+    process.stdout.write('plan-ready; no metrics measured; no benchmark arms launched\n');
+    return 0;
+  } catch (error) {
+    process.stderr.write(`bench metering plan refused: ${error instanceof Error ? error.message : String(error)}\n`);
+    return 2;
+  }
+}
+
+if (import.meta.main) process.exitCode = await main(process.argv.slice(2));

package/scripts/demo/demo1104-parallel-host.ts

@@ -0,0 +1,56 @@
+import type { TerminalSessionRegistry } from '../../src/terminal/session-registry.js';
+import {
+  createDemo1104ParallelScenes,
+  createDemo1104TuiTabAdapters,
+  type DemoParallelSnapshot,
+  type DemoSurfaceAdapter,
+} from './demo1104-parallel-scenes.js';
+import type { DemoActId } from './demo1104-stage.config.js';
+import { spawnCodingAgent } from '../../src/terminal/coding-agent.js';
+
+export type Demo1104ParallelHostOptions = {
+  registry: TerminalSessionRegistry;
+  cwd: string;
+  termSize: () => { cols: number; rows: number };
+  runMission: Parameters<typeof createDemo1104TuiTabAdapters>[0]['runMission'];
+  showVideo: Parameters<typeof createDemo1104TuiTabAdapters>[0]['showVideo'];
+  videoSources: Readonly<Record<string, string>>;
+  webRunGraph: DemoSurfaceAdapter;
+  telegram: DemoSurfaceAdapter;
+  spawnAgent?: typeof spawnCodingAgent;
+};
+
+export type Demo1104ParallelStage = {
+  start(): Promise<void>;
+  runActNow(id: DemoActId): Promise<void>;
+  switchToVideo(id: DemoActId): Promise<void>;
+  snapshot(): DemoParallelSnapshot;
+};
+
+/** The single host composition point for the two visible agent tabs and the two secretary surfaces. */
+export function createDemo1104ParallelHost(options: Demo1104ParallelHostOptions): Demo1104ParallelStage {
+  const tuiTabs = createDemo1104TuiTabAdapters({
+    registry: options.registry,
+    cwd: options.cwd,
+    termSize: options.termSize,
+    runMission: options.runMission,
+    showVideo: options.showVideo,
+    videoSources: options.videoSources,
+    ...(options.spawnAgent ? { spawnAgent: options.spawnAgent } : {}),
+  });
+  return createDemo1104ParallelScenes({
+    ...tuiTabs,
+    'web-run-graph': options.webRunGraph,
+    telegram: options.telegram,
+  });
+}
+
+/** Start all four demo surfaces together and return the live controls to the demo runner. */
+export async function startDemo1104ParallelHost(options: Demo1104ParallelHostOptions): Promise<{
+  stage: Demo1104ParallelStage;
+  snapshot: DemoParallelSnapshot;
+}> {
+  const stage = createDemo1104ParallelHost(options);
+  await stage.start();
+  return { stage, snapshot: stage.snapshot() };
+}

package/scripts/demo/demo1104-parallel.ts

@@ -0,0 +1,72 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { resolve } from 'node:path';
+import { DisplayCoordinator } from '../../src/display/coordinator.js';
+import { TerminalSessionRegistry } from '../../src/terminal/session-registry.js';
+import { createDemoRunGraphSurfaceAdapter, createDemoTelegramDryRunAdapter } from './demo1104-parallel-scenes.js';
+import { DEMO1104_STAGE_CONFIG } from './demo1104-stage.config.js';
+import { startDemo1104ParallelHost } from './demo1104-parallel-host.js';
+
+const repoRoot = resolve(import.meta.dir, '../..');
+const outputDir = resolve(process.env.DEMO1104_OUTPUT_DIR ?? `${process.env.HOME}/Movies/elanous/demo-1104/live`);
+const videoSources = Object.fromEntries(['V1', 'V2', 'V3', 'V4', 'V5', 'V6'].map(id => [id, resolve(outputDir, `${id}.mp4`)]));
+const coordinator = new DisplayCoordinator({ termSize: () => ({ cols: process.stdout.columns ?? 120, rows: process.stdout.rows ?? 40 }) });
+const registry = new TerminalSessionRegistry({ coordinator });
+const webRunGraph = createDemoRunGraphSurfaceAdapter({
+  graphId: 'inside-seed',
+  graphYaml: readFileSync(resolve(repoRoot, 'graphs/demo/inside-seed.yaml'), 'utf8'),
+  videoSources,
+  onView(view, act) { stdout.write(`[web-run-graph] ${act.id} ${view.status}\n`); },
+  onVideo(transition) { stdout.write(`[web-run-graph] video ${transition.videoId}: ${transition.source}\n`); },
+});
+const telegramFile = resolve(outputDir, 'telegram-dry-run.jsonl');
+const telegram = createDemoTelegramDryRunAdapter({ file: telegramFile, linearIssueId: 'DEMO1104', videoSources });
+let stage: Awaited<ReturnType<typeof startDemo1104ParallelHost>>['stage'] | undefined;
+
+try {
+  const started = await startDemo1104ParallelHost({
+    registry,
+    cwd: repoRoot,
+    termSize: () => ({ cols: process.stdout.columns ?? 120, rows: process.stdout.rows ?? 40 }),
+    videoSources,
+    webRunGraph,
+    telegram,
+    async runMission(session, act) {
+      const prompt = `\n[11-04 ${act.id}] ${act.title}\n`;
+      session.preview.write(`${prompt}\n`);
+      stdout.write(`[${session.agentBrand}] mission sent to ${session.id}\n`);
+    },
+    showVideo(session, transition) {
+      session.preview.write(`\n[11-04 video ${transition.videoId}] ${transition.source}\n`);
+    },
+  });
+  stage = started.stage;
+  stdout.write(`11-04 parallel stage started\n${JSON.stringify(started.snapshot, null, 2)}\n`);
+  stdout.write(`Controls: act <act-id> | video <act-id> | snapshot | quit\nActs: ${DEMO1104_STAGE_CONFIG.acts.map(act => act.id).join(', ')}\n`);
+  const input = createInterface({ input: stdin, output: stdout, terminal: Boolean(stdin.isTTY) });
+  try {
+    for await (const line of input) {
+      const [command, id] = line.trim().split(/\s+/, 2);
+      if (command === 'quit' || command === 'exit') break;
+      if (command === 'snapshot') {
+        stdout.write(`${JSON.stringify(stage.snapshot(), null, 2)}\n`);
+      } else if (command === 'act' && id) {
+        await stage.runActNow(id as typeof DEMO1104_STAGE_CONFIG.acts[number]['id']);
+        stdout.write(`act complete: ${id}\n`);
+      } else if (command === 'video' && id) {
+        await stage.switchToVideo(id as typeof DEMO1104_STAGE_CONFIG.acts[number]['id']);
+        stdout.write(`video transition complete: ${id}\n`);
+      } else {
+        stdout.write('Use: act <act-id> | video <act-id> | snapshot | quit\n');
+      }
+    }
+  } finally {
+    input.close();
+  }
+} finally {
+  for (const session of registry.list()) registry.kill(session.id);
+  webRunGraph.close();
+  telegram.close();
+}

package/scripts/public-leak-baseline.txt

@@ -794,7 +794,6 @@
 2	runtime-path-outside-export	src/self-implement/project-scaffold.test.ts
 3	runtime-path-outside-export	src/self-implement/run-ledger-cli.test.ts
 1	runtime-path-outside-export	src/workflow-runtime/discovery.ts
-1	runtime-path-outside-export	test/anatomy-doc-source-citations.test.ts
 1	runtime-path-outside-export	test/dev-help-concise.test.ts
 1	runtime-path-outside-export	test/dispatch/authored-goal-queue.test.ts
 1	runtime-path-outside-export	test/federation-guard-f11-paint-cache-opt-in.test.ts

package/scripts/release-loop/docs-node.ts

@@ -29,6 +29,8 @@ type TranslationRunner = (line: string) => string;
 type AskSpawn = (command: string, args: string[], options: SpawnSyncOptionsWithStringEncoding) => SpawnSyncReturns<string>;
 
 const HANGUL = /[\uac00-\ud7a3]/;
+// Allow common English typography without accepting arbitrary non-ASCII letters, digits, or symbols.
+const PUBLIC_TRANSLATION_NON_ASCII = /[^\x00-\x7f\u00a0\u00a1\u00ab\u00b7\u00bb\u00bf\u2010-\u2015\u2018-\u201f\u2022\u2026]/u;
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
 
 function splitMarkdownPrefix(raw: string): { prefix: string; text: string } {
@@ -130,8 +132,8 @@ function translatePublicText(text: string, runner: TranslationRunner, failures:
       try {
         const candidate = runner(source).trim();
         const alphanumeric = [...candidate].filter((character) => /[\p{L}\p{N}]/u.test(character));
-        if (!candidate || HANGUL.test(candidate) || alphanumeric.length === 0 || /[^\x00-\x7f]/.test(candidate)) {
-          throw new Error('translation is empty or contains non-Latin writing');
+        if (!candidate || HANGUL.test(candidate) || alphanumeric.length === 0 || PUBLIC_TRANSLATION_NON_ASCII.test(candidate)) {
+          throw new Error('translation is empty or contains unsupported non-ASCII characters');
         }
         translated = candidate;
         cache.set(source, candidate);

package/scripts/release-loop/gate-image-pin.ts

@@ -1,5 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { constants } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { randomUUID } from 'node:crypto';
 
 /** A gate run may execute only against one immutable image identity and its exact source tag. */
 export interface GateImagePin { runId: string; digest: string; image: string; commit: string }
@@ -17,7 +19,68 @@ export interface ResolveGateImagePinOptions {
   poolImages: ReadonlyMap<string, readonly string[]>;
 }
 
-function normalizeGateImageDigest(value: unknown): string | null {
+interface PinnedGateImagePullDecision {
+  push: false;
+  imageRef: string;
+  tagDrift?: { event: 'image-tag-drift'; runId: string; tag: string; pinnedDigest: string; observedDigest: string | null; reason: 'digest-changed' | 'tag-unavailable' };
+}
+
+export interface PinnedGateImageSyncResult {
+  images: Map<string, { ok: true; action: 'fresh'; detail: string; ms: 0; imageRef: string }>;
+  tagDrifts: Array<{ event: 'image-tag-drift'; runId: string; tag: string; pinnedDigest: string;
+    observedDigest: string | null; reason: 'digest-changed' | 'tag-unavailable'; context: string }>;
+}
+
+function imageRepository(image: string): string {
+  let repository = image.trim().replace(/@sha256:[a-f0-9]{64}$/i, '');
+  const firstSlash = repository.indexOf('/');
+  if (firstSlash > 0) {
+    const first = repository.slice(0, firstSlash);
+    if (first === 'localhost' || first.includes('.') || first.includes(':')) repository = repository.slice(firstSlash + 1);
+  }
+  return repository.replace(/:[^/:]+$/, '');
+}
+
+/** Build a Job image ref from the registry service visible inside a pool's Kubernetes cluster. */
+function pinnedGateImagePullDecision(input: {
+  runId: string; registry: string; image: string; digest: string; observedTagDigest?: string | null;
+}): PinnedGateImagePullDecision {
+  const digest = normalizeGateImageDigest(input.digest);
+  const registry = input.registry.trim().replace(/\/$/, '');
+  const repository = imageRepository(input.image);
+  if (!input.runId || !registry || !repository || repository.includes('@') || !digest) throw new Error('invalid pinned gate image pull identity');
+  const observed = normalizeGateImageDigest(input.observedTagDigest);
+  const tag = `${registry}/${repository}:${input.image.split(':').at(-1) ?? ''}`;
+  return {
+    push: false,
+    imageRef: `${registry}/${repository}@${digest}`,
+    ...(!observed || observed !== digest ? { tagDrift: { event: 'image-tag-drift', runId: input.runId,
+      tag, pinnedDigest: digest, observedDigest: observed, reason: observed ? 'digest-changed' as const : 'tag-unavailable' as const } } : {}),
+  };
+}
+
+/** Convert every selected gate member to a digest ref; this path deliberately has no build/push operation. */
+export function pinnedGateImageSync(input: {
+  runId: string; commit: string; digest: string; image: string;
+  members: readonly { context: string; registry: string }[];
+  probeTagDigest: (member: { context: string; registry: string }) => string | null;
+}): PinnedGateImageSyncResult {
+  const repository = imageRepository(input.image);
+  if (!/^[0-9a-f]{40}$/i.test(input.commit) || !repository || repository.includes('@')) throw new Error('invalid pinned gate image identity');
+  const tag = `${repository}:${input.commit.slice(0, 12)}`;
+  const images = new Map<string, { ok: true; action: 'fresh'; detail: string; ms: 0; imageRef: string }>();
+  const tagDrifts: PinnedGateImageSyncResult['tagDrifts'] = [];
+  for (const member of input.members) {
+    const decision = pinnedGateImagePullDecision({ runId: input.runId, registry: member.registry, image: tag,
+      digest: input.digest, observedTagDigest: input.probeTagDigest(member) });
+    images.set(member.context, { ok: true, action: 'fresh', detail: 'run-pinned-digest; tag push skipped', ms: 0,
+      imageRef: decision.imageRef });
+    if (decision.tagDrift) tagDrifts.push({ ...decision.tagDrift, context: member.context });
+  }
+  return { images, tagDrifts };
+}
+
+export function normalizeGateImageDigest(value: unknown): string | null {
   if (typeof value !== 'string' || !/^sha256:[a-f0-9]{64}$/i.test(value.trim())) return null;
   return value.trim().toLowerCase();
 }
@@ -52,6 +115,57 @@ export function readGateImagePin(path: string, expectedRunId: string, expectedIm
   return { runId: expectedRunId, digest: normalizeGateImageDigest(parsed.digest)!, image: expectedImage, commit: normalizedCommit };
 }
 
+/** Read a valid pin for this run and image repository while allowing its commit tag to be stale. */
+export function readGateImagePinForRun(path: string, expectedRunId: string, expectedImage: string): GateImagePin | null {
+  if (!existsSync(path)) return null;
+  const parsed = JSON.parse(readFileSync(path, 'utf8')) as { version?: unknown; runId?: unknown; digest?: unknown; image?: unknown; commit?: unknown };
+  const commit = typeof parsed.commit === 'string' && /^[0-9a-f]{40}$/i.test(parsed.commit) ? parsed.commit.toLowerCase() : null;
+  const image = typeof parsed.image === 'string' ? parsed.image : '';
+  const imageRepo = imageRepository(image);
+  if (parsed.version !== 2 || parsed.runId !== expectedRunId || !commit || !normalizeGateImageDigest(parsed.digest)
+    || !imageRepo || imageRepo !== imageRepository(expectedImage) || image !== `${imageRepo}:${commit.slice(0, 12)}`)
+    throw new Error(`invalid gate image pin: ${path}`);
+  return { runId: expectedRunId, digest: normalizeGateImageDigest(parsed.digest)!, image, commit };
+}
+
+/** Preserve a valid old tip pin before a resumed gate establishes a new commit pin. */
+export function supersedeGateImagePin(path: string, expectedRunId: string, expectedImage: string, expectedCommit: string): { pin: GateImagePin; archivePath: string } | null {
+  const prior = readGateImagePinForRun(path, expectedRunId, expectedImage);
+  if (!prior || prior.commit === expectedCommit.toLowerCase()) return null;
+  const stem = `${path}.superseded-${prior.commit.slice(0, 12)}-${process.pid}-${Date.now()}`;
+  let archivePath = stem;
+  for (let suffix = 1; ; suffix++) {
+    archivePath = suffix === 1 ? stem : `${stem}-${suffix}`;
+    try {
+      copyFileSync(path, archivePath, constants.COPYFILE_EXCL);
+      break;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      if (readFileSync(path).equals(readFileSync(archivePath))) break;
+    }
+  }
+  return { pin: prior, archivePath };
+}
+
+/** Archive the old tip and atomically replace the active pin without an absent-pin crash window. */
+export function replaceGateImagePin(path: string, runId: string, digest: string, image: string, commit: string,
+  expectedImage: string, expectedPriorCommit: string): string {
+  const prior = readGateImagePinForRun(path, runId, expectedImage);
+  if (!prior || prior.commit !== expectedPriorCommit.toLowerCase()) throw new Error('stale gate image pin changed before replacement');
+  const archived = supersedeGateImagePin(path, runId, expectedImage, commit);
+  if (!archived) throw new Error('stale gate image pin could not be archived');
+  const normalized = normalizeGateImageDigest(digest);
+  if (!normalized || !runId || !image.trim() || !/^[0-9a-f]{40}$/i.test(commit)) throw new Error('invalid gate image pin identity');
+  const value = `${JSON.stringify({ version: 2, runId, digest: normalized, image, commit: commit.toLowerCase() }, null, 2)}\n`;
+  const tempPath = `${path}.pending-${randomUUID()}`;
+  try {
+    writeFileSync(tempPath, value, { mode: 0o600, flag: 'wx' });
+    // Keep the old active pin until the complete replacement is ready; rename is atomic on this filesystem.
+    renameSync(tempPath, path);
+    return archived.archivePath;
+  } finally { rmSync(tempPath, { force: true }); }
+}
+
 export function writeGateImagePin(path: string, runId: string, digest: string, image: string, commit: string): void {
   const normalized = normalizeGateImageDigest(digest);
   if (!runId || !normalized || !image.trim() || !/^[0-9a-f]{40}$/i.test(commit)) throw new Error('invalid gate image pin identity');