elanous 0.2.5 → 0.2.7

package/src/steward/triage-budget.ts

@@ -0,0 +1,127 @@
+import { createHash } from 'node:crypto';
+import { debug } from '../debug/log.js';
+import type { TriageDecision, TriageIssue } from './triage.js';
+
+export interface HashedTriageDecision extends TriageDecision {
+  inputHash: string;
+  /** Other issues whose ref/body the judge read while producing this decision. */
+  contextInputs?: string[];
+  /** Retained from a previous run without a current judgment; never route as a fresh decision. */
+  deferred?: true;
+}
+
+export function triageInputHash(issue: TriageIssue, issues: TriageIssue[] = [], tracks?: Record<string, string>, contextInputs: string[] = []): string {
+  const byId = new Map(issues.map(item => [item.identifier, item]));
+  return createHash('sha256').update(JSON.stringify([
+    'context-inputs-v2', issue.identifier, issue.ref, issue.title, issue.body,
+    issues.map(item => [item.identifier, item.title]), tracks && Object.keys(tracks).length ? tracks : null,
+    contextInputs.map(id => [id, byId.get(id)?.ref ?? null, byId.get(id)?.body ?? null]),
+  ])).digest('hex');
+}
+
+export async function triageWithinBudget({ issues, previous, judge, tracks, concurrency = 8, perIssueMs = 90_000, deadlineMs = 240_000, now = Date.now, onJudged }: {
+  issues: TriageIssue[];
+  previous: Array<TriageDecision & { inputHash?: string }>;
+  judge: (issue: TriageIssue, observedIssues?: TriageIssue[]) => Promise<TriageDecision>;
+  tracks?: Record<string, string>;
+  concurrency?: number;
+  perIssueMs?: number;
+  deadlineMs?: number;
+  now?: () => number;
+  onJudged?: (decision: HashedTriageDecision) => void;
+}): Promise<{ decisions: HashedTriageDecision[]; stats: { reused: number; judged: number; timedOut: number; deferred: number } }> {
+  const end = now() + deadlineMs;
+  const slots = Number.isFinite(concurrency) ? Math.max(1, Math.floor(concurrency)) : 4;
+  const stats = { reused: 0, judged: 0, timedOut: 0, deferred: 0 };
+  const old = new Map(previous.map(decision => [decision.issue, decision]));
+  const isTemporary = (decision: TriageDecision): boolean =>
+    decision.rung === 'hitl' && decision.hitlReason === 'other' &&
+    ['triage deferred — deadline', 'triage judgment timed out — human review',
+      'triage judgment unavailable — human review'].includes(decision.why);
+  const decisions: HashedTriageDecision[] = new Array(issues.length);
+  const pending: number[] = [];
+  for (const [index, issue] of issues.entries()) {
+    const earlier = old.get(issue.identifier) as HashedTriageDecision | undefined;
+    const hash = triageInputHash(issue, issues, tracks, earlier?.contextInputs ?? []);
+    if (earlier?.inputHash === hash && !earlier.deferred && !isTemporary(earlier)) {
+      decisions[index] = { ...earlier, inputHash: hash };
+      stats.reused++;
+    } else pending.push(index);
+  }
+
+  let cursor = 0;
+  const activeWork = new Set<Promise<TriageDecision>>();
+  const settleSignals = new Set<Promise<boolean>>();
+  const timedOut = Symbol('triage-timeout');
+  const worker = async (): Promise<void> => {
+    while (cursor < pending.length) {
+      const remaining = end - now();
+      if (remaining <= 0) return;
+      if (activeWork.size >= slots) {
+        let timer: ReturnType<typeof setTimeout> | undefined;
+        const settled = Promise.race([...settleSignals]);
+        let deadlineElapsed: boolean;
+        try {
+          deadlineElapsed = await Promise.race([settled, new Promise<true>(resolve => { timer = setTimeout(() => resolve(true), remaining); })]);
+        } finally { if (timer) clearTimeout(timer); }
+        if (deadlineElapsed) return;
+        continue;
+      }
+      const index = pending[cursor++]!;
+      const issue = issues[index]!;
+      const observed = new Set<string>();
+      const observedIssues = issues.map(item => new Proxy(item, {
+        get(target, property, receiver) {
+          if (item.identifier !== issue.identifier && (property === 'ref' || property === 'body')) observed.add(item.identifier);
+          return Reflect.get(target, property, receiver);
+        },
+      }));
+      // Check immediately before invoking; a clock that advanced while preparing inputs must not start a new call.
+      const issueRemaining = end - now();
+      if (issueRemaining <= 0) { cursor--; return; }
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      let decision: TriageDecision;
+      try {
+        const work = Promise.resolve(judge(issue, observedIssues));
+        // Even a timed-out judge keeps its concurrency slot until the underlying call settles.
+        activeWork.add(work);
+        const settled = work.then(() => false, () => false);
+        void settled.then(() => {
+          activeWork.delete(work);
+          settleSignals.delete(settled);
+        });
+        settleSignals.add(settled);
+        const timeout = new Promise<never>((_, reject) => {
+          timer = setTimeout(() => reject(timedOut), Math.min(perIssueMs, issueRemaining));
+        });
+        decision = await Promise.race([work, timeout]);
+        stats.judged++;
+      } catch (error) {
+        if (error === timedOut) {
+          stats.timedOut++;
+          decision = { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0, why: 'triage judgment timed out — human review' };
+        } else {
+          stats.judged++;
+          decision = { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0, why: 'triage judgment unavailable — human review' };
+        }
+      } finally { if (timer) clearTimeout(timer); }
+      const contextInputs = [...observed].sort();
+      decisions[index] = { ...decision, inputHash: triageInputHash(issue, issues, tracks, contextInputs),
+        ...(contextInputs.length ? { contextInputs } : {}) };
+      onJudged?.(decisions[index]!);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(slots, pending.length) }, () => worker()));
+  for (const index of pending.slice(cursor)) {
+    const issue = issues[index]!;
+    const earlier = old.get(issue.identifier);
+    decisions[index] = earlier
+      ? { ...earlier, inputHash: earlier.inputHash ?? '', deferred: true }
+      : { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0,
+        why: 'triage deferred — deadline', inputHash: triageInputHash(issue, issues, tracks), deferred: true };
+    if (!earlier) onJudged?.(decisions[index]!);
+    stats.deferred++;
+  }
+  debug.log('steward.triage', 'budget', stats);
+  return { decisions, stats };
+}

package/src/steward/triage-plan.ts

@@ -0,0 +1,75 @@
+import { resolveRoleModel } from '../user-config.js';
+import type { HitlReason, Rung, TriageIssue } from './triage.js';
+
+export type StewardAsk = (prompt: string, role: 'classify' | 'planning') => Promise<unknown>;
+export interface ClassifiedIssue { issue: string; rung: Rung; why: string; hitlReason?: HitlReason; duplicateOf?: string }
+export interface IssuePlan { issue: string; priority: number; dependsOn: string[]; owner?: string }
+
+const unsafe: Array<[HitlReason, RegExp]> = [
+  ['money', /돈|유료|결제|구매|판매|송금|환불|크레딧\s*(?:추가|구매)|paid|payment|purchase/i],
+  ['public', /공개|발행|외부\s*게시|publish|public\s*release/i],
+  ['security', /보안|(?:API|보안|인증|접근)\s*키|(?:키|자격|권한|secret|credential|permission)\s*(?:변경|교체|발급|삭제|공유|노출)|키체인|\b(?:api[ -]?key|secret[ -]?key|access[ -]?token)\b/i],
+  ['irreversible', /비가역|강제\s*푸시|force.push|영구\s*삭제|리셋권\s*소비|drop\s*table|초기화/i],
+];
+
+export function unsafeReason(issue: TriageIssue): HitlReason | undefined {
+  return unsafe.find(([, pattern]) => pattern.test(`${issue.title}\n${issue.body}`))?.[0];
+}
+
+function parsed(raw: unknown): Record<string, unknown> {
+  const value: unknown = typeof raw === 'string'
+    ? JSON.parse(raw.replace(/^```(?:json)?\s*|\s*```$/g, '').trim()) : raw;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Invalid steward response');
+  return value as Record<string, unknown>;
+}
+
+export function ruleJudgment(issue: TriageIssue, issues: TriageIssue[]): ClassifiedIssue | undefined {
+  const normalize = (text: string) => text.normalize('NFKC').trim().replace(/\s+/g, ' ').toLocaleLowerCase();
+  const title = normalize(issue.title);
+  const index = issues.findIndex(item => item.identifier === issue.identifier);
+  const prior = index < 0 ? issues.filter(item => item.identifier !== issue.identifier) : issues.slice(0, index);
+  // Same title alone is not proof: two different tasks can share a title. Only same title AND same body is a
+  // rule duplicate; anything else goes to classification.
+  const body = normalize(issue.body ?? '');
+  const duplicate = title && prior.find(item => normalize(item.title) === title && normalize(item.body ?? '') === body);
+  if (duplicate) return { issue: issue.identifier, rung: 0, duplicateOf: duplicate.identifier, why: `duplicate of ${duplicate.identifier}` };
+  return undefined;
+}
+
+export async function askSteward(prompt: string, role: 'classify' | 'planning'): Promise<unknown> {
+  const { streamLLM } = await import('../llm.js');
+  const result = await streamLLM([{ role: 'user', content: prompt }], () => {}, { model: resolveRoleModel(role).model });
+  return parsed(result);
+}
+
+export async function classifyIssue(issue: TriageIssue, ask: StewardAsk = askSteward): Promise<ClassifiedIssue> {
+  const candidate = unsafeReason(issue);
+  const response = parsed(await ask(`스튜어드 분류. JSON 객체만: {"rung":0|1|2|3|4|5|"hitl","hitlReason":null,"why":"한 문장"}. 0=이미됨, 1=셸, 2=CLI, 3=조사, 4=하니스 골, 5=외부 에이전트. 돈·공개·보안·비가역은 hitl; 그 외 사람 확인은 other. 확인되지 않은 완료를 추측하지 마라. ${candidate ? `안전 후보 ${candidate}: 이유를 확인하라.` : ''}\n이슈: ${JSON.stringify(issue)}`, 'classify'));
+  if (![0, 1, 2, 3, 4, 5, 'hitl'].includes(response.rung as Rung) || typeof response.why !== 'string' || !response.why.trim()) throw new Error(`Invalid steward classification: ${issue.identifier}`);
+  const reason = candidate ?? (unsafe.some(([name]) => name === response.hitlReason) ? response.hitlReason as HitlReason : undefined)
+    ?? (response.rung === 'hitl' ? 'other' : undefined);
+  return { issue: issue.identifier, rung: reason ? 'hitl' : response.rung as Rung,
+    ...(reason ? { hitlReason: reason } : {}), why: response.why.trim().replace(/\s+/g, ' ') };
+}
+
+/** One request for the current batch, never one request per issue. */
+export async function planIssues(classified: ClassifiedIssue[], ask: StewardAsk = askSteward, tracks?: Record<string, string>, issues: TriageIssue[] = []): Promise<IssuePlan[]> {
+  if (!classified.length) return [];
+  const keys = Object.keys(tracks ?? {});
+  const byId = new Map(issues.map(issue => [issue.identifier, issue]));
+  const response = parsed(await ask(`스튜어드 계획. 새로 분류한 이슈마다 priority(숫자), dependsOn(제공된 이슈 키 배열), owner(담당 트랙 키 또는 null)를 정해 JSON {"plans":[{"issue":"키","priority":1,"dependsOn":[],"owner":null}]} 만 출력. 새로 분류한 이슈만 한 번씩 포함하라. 다른 키를 의존으로 넣지 마라. 담당 트랙: ${JSON.stringify(tracks ?? {})}\n제공된 이슈 키: ${JSON.stringify(issues.map(row => ({ key: row.identifier, title: row.title })))}\n새로 분류한 이슈: ${JSON.stringify(classified.map(row => ({ ...row, title: byId.get(row.issue)?.title ?? '', body: byId.get(row.issue)?.body ?? '' })))}`, 'planning'));
+  const plans = response.plans;
+  if (!Array.isArray(plans) || plans.length !== classified.length) throw new Error('Invalid steward plan');
+  const allowed = new Set(issues.length ? issues.map(row => row.identifier) : classified.map(row => row.issue));
+  const planned = new Set(classified.map(row => row.issue));
+  const seen = new Set<string>();
+  return plans.map((raw: unknown) => {
+    const row = parsed(raw);
+    if (typeof row.issue !== 'string' || !planned.has(row.issue) || seen.has(row.issue) ||
+      typeof row.priority !== 'number' || !Number.isFinite(row.priority) ||
+      !Array.isArray(row.dependsOn) || !row.dependsOn.every((dep: unknown) => typeof dep === 'string' && allowed.has(dep) && dep !== row.issue)) throw new Error('Invalid steward plan');
+    seen.add(row.issue);
+    return { issue: row.issue, priority: row.priority, dependsOn: row.dependsOn as string[],
+      ...(typeof row.owner === 'string' && keys.includes(row.owner) ? { owner: row.owner } : {}) };
+  });
+}

package/src/steward/triage.ts

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { fetchLinearIssues } from '../connectors/linear.js';
 import { getSecretAsync } from '../nexus/config/secrets/index.js';
@@ -9,6 +9,9 @@ import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { redactSecrets } from '../task-cards/card-store.js';
 import { directiveHash } from './directive.js';
 import { recordTriageOnCards, type StewardCardDeps } from './steward-cards.js';
+import { triageWithinBudget } from './triage-budget.js';
+import { askSteward, classifyIssue, planIssues, ruleJudgment, unsafeReason, type ClassifiedIssue, type StewardAsk } from './triage-plan.js';
+import { failureAlertText, markStageStart, markStageEnd, readFailureStreak, shouldAlert, writeFailureStreak, type FailureStreak, type StewardStage } from './failure-streak.js';
 
 export type Rung = 0 | 1 | 2 | 3 | 4 | 5 | 'hitl';
 /** `other` = the judge chose human review for a reason outside the four named ones (kept as HITL, never downgraded). */
@@ -19,6 +22,8 @@ export interface TriageDecision {
   hitlReason?: HitlReason; why: string; role?: string; cost?: number;
   /** Owner track from `loops.steward.tracks` (absent when no table is configured or the judge picked none of its keys). */
   owner?: string;
+  /** Carried from a previous triage without a current judgment; scheduling must not route it. */
+  deferred?: true;
 }
 export interface ScheduledDecision extends TriageDecision { disposition: 'now' | 'wait' | 'hitl' }
 export interface StewardSettings {
@@ -26,6 +31,7 @@ export interface StewardSettings {
   roles?: Record<string, { maxConcurrent?: number }>;
   budget?: number;
   tracks?: Record<string, string>;
+  alertAfterFailures?: number;
 }
 export interface StewardDeps {
   fetch?: typeof fetch;
@@ -37,18 +43,15 @@ export interface StewardDeps {
   root?: string;
   cardStore?: StewardCardDeps['store'];
   warn?: (message: string) => void;
+  ask?: StewardAsk;
+  /** Internal command boundary: the current sync has already claimed this pid. */
+  stageOwnedByCommand?: boolean;
 }
 
 export function stewardSettings(): StewardSettings {
   return getUserConfig().loops?.steward ?? {};
 }
 
-const unsafe: Array<[HitlReason, RegExp]> = [
-  ['money', /돈|유료|결제|구매|판매|송금|환불|크레딧\s*(?:추가|구매)|paid|payment|purchase/i],
-  ['public', /공개|발행|외부\s*게시|publish|public\s*release/i],
-  ['security', /보안|(?:키|자격|권한|secret|credential|permission)\s*(?:변경|교체|발급|삭제|공유|노출)|키체인/i],
-  ['irreversible', /비가역|강제\s*푸시|force.push|영구\s*삭제|리셋권\s*소비|drop\s*table|초기화/i],
-];
 
 function parseJudgment(issue: TriageIssue, raw: unknown, tracks?: Record<string, string>): TriageDecision {
   const value = typeof raw === 'string' ? JSON.parse(raw) as unknown : raw;
@@ -59,8 +62,8 @@ function parseJudgment(issue: TriageIssue, raw: unknown, tracks?: Record<string,
       typeof d.priority !== 'number' || !Number.isFinite(d.priority) || typeof d.why !== 'string' || !d.why.trim()) {
     throw new Error(`Invalid triage judgment: ${issue.identifier}`);
   }
-  const forced = unsafe.find(([, pattern]) => pattern.test(`${issue.title}\n${issue.body}`))?.[0];
-  const named = forced ?? (unsafe.some(([reason]) => reason === d.hitlReason) ? d.hitlReason as HitlReason : undefined);
+  const forced = unsafeReason(issue);
+  const named = forced ?? (['money', 'public', 'security', 'irreversible'].includes(d.hitlReason as string) ? d.hitlReason as HitlReason : undefined);
   // A HITL judgment without one of the four named reasons stays HITL (`other`) — one issue must not stop the stage.
   const hitlReason = named ?? (d.rung === 'hitl' ? 'other' as const : undefined);
   return {
@@ -81,30 +84,68 @@ export function trackTablePrompt(tracks?: Record<string, string>): string {
   return `\n담당 트랙(owner) — 아래 중 하나(${keys.map(k => JSON.stringify(k)).join('|')}) · 이슈가 어느 트랙 일인지:\n${keys.map(k => `- ${k}: ${tracks[k]}`).join('\n')}`;
 }
 
-async function judgeStewardIssue(issue: TriageIssue, issues: TriageIssue[], tracks?: Record<string, string>): Promise<unknown> {
-  const ownerField = tracks && Object.keys(tracks).length ? `,"owner":${JSON.stringify(Object.keys(tracks)[0])}` : '';
-  const prompt = `스튜어드 트리아지. JSON 객체만 출력: {"rung":0|1|2|3|4|5|"hitl","dependsOn":[],"priority":1,"duplicateOf":null,"hitlReason":null,"why":"한 문장","role":"builder","cost":0${ownerField}}.\n0=이미됨/중복, 1=셸, 2=CLI, 3=조사, 4=하니스 골, 5=외부 에이전트. 돈·공개·보안·비가역은 hitl(hitlReason = "money"|"public"|"security"|"irreversible" · 그 밖의 이유로 사람 확인이 필요하면 "other"). 확인되지 않은 완료/중복은 추측하지 마라. 의존은 제공된 이슈 키만 써라.${trackTablePrompt(tracks)}\n이슈 목록: ${JSON.stringify(issues.map(i => ({ key: i.identifier, title: i.title })))}\n판정 대상: ${JSON.stringify(issue)}`;
-  const { streamLLM } = await import('../llm.js');
-  const { tierModel } = await import('../llm/model-defaults.js');
-  const result = await streamLLM([{ role: 'user', content: prompt }], () => {}, { model: tierModel('best') });
-  return JSON.parse(result.replace(/^```(?:json)?\s*|\s*```$/g, '').trim()) as unknown;
-}
-
-export async function triageIssues(issues: TriageIssue[], judge: NonNullable<StewardDeps['judge']> = judgeStewardIssue, decide: typeof emitDecision = emitDecision, tracks?: Record<string, string>): Promise<TriageDecision[]> {
-  const decisions: TriageDecision[] = [];
-  for (const issue of issues) {
-    let result: TriageDecision;
+export async function triageIssues(issues: TriageIssue[], judge?: NonNullable<StewardDeps['judge']>, decide: typeof emitDecision = emitDecision, tracks?: Record<string, string>, previous: Array<TriageDecision & { inputHash?: string }> = [], ask: StewardAsk = askSteward): Promise<TriageDecision[]> {
+  const started = judge ? 0 : Date.now();
+  const classified: ClassifiedIssue[] = [];
+  const classifiedIds = new Set<string>();
+  const counts = { rule: 0, classify: 0, planning: 0 };
+  const signal = (result: TriageDecision): void => {
+    decide({ kind: result.rung === 'hitl' ? 'ESCALATE' : 'ROUTE', what: result.issue, reason: result.why,
+      purpose: 'steward triage', target: result.owner ? `${result.rung} · ${result.owner}` : String(result.rung), refs: { issue: result.issue } });
+  };
+  const { decisions } = await triageWithinBudget({ issues, previous, tracks, judge: async (issue, observedIssues) => {
     try {
-      result = parseJudgment(issue, await judge(issue, issues, tracks), tracks);
+      if (judge) return parseJudgment(issue, await judge(issue, observedIssues ?? issues, tracks), tracks);
+      const byRule = ruleJudgment(issue, observedIssues ?? issues);
+      if (byRule) { counts.rule++; return { ...byRule, dependsOn: [], priority: 0 }; }
+      counts.classify++;
+      const row = await classifyIssue(issue, ask);
+      return { ...row, dependsOn: [], priority: 0 };
     } catch (error) {
-      // A malformed or failed judgment for one issue goes to a human; the other issues are still triaged.
       try { debug.log('steward.stage', 'judgment-invalid', { issue: issue.identifier, reason: redactSecrets(String(error)) }); } catch { /* fail-soft */ }
-      result = { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0, why: 'triage judgment unavailable — human review' };
+      return { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0, why: 'triage judgment unavailable — human review' };
+    }
+  }, onJudged: result => {
+    if (!judge && !result.deferred && !result.duplicateOf &&
+        result.why !== 'triage judgment unavailable — human review' &&
+        result.why !== 'triage judgment timed out — human review' &&
+        result.why !== 'triage deferred — deadline') {
+      classified.push({ issue: result.issue, rung: result.rung, why: result.why,
+        ...(result.hitlReason ? { hitlReason: result.hitlReason } : {}) });
+      classifiedIds.add(result.issue);
+    } else signal(result);
+  } });
+  const planningBatch = classified.slice();
+  if (!judge && planningBatch.length) {
+    const remaining = 240_000 - (Date.now() - started);
+    try {
+      if (remaining <= 0) throw new Error('planning deadline');
+      counts.planning++;
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      let plans;
+      try {
+        plans = await Promise.race([planIssues(planningBatch, ask, tracks, issues), new Promise<never>((_, reject) => {
+          timer = setTimeout(() => reject(new Error('planning deadline')), remaining);
+        })]);
+      } finally { if (timer) clearTimeout(timer); }
+      const byIssue = new Map(plans.map(plan => [plan.issue, plan]));
+      for (const row of decisions) {
+        const plan = byIssue.get(row.issue);
+        if (plan && !row.deferred) {
+          row.priority = plan.priority;
+          row.dependsOn = plan.dependsOn;
+          if (plan.owner) row.owner = plan.owner;
+        }
+      }
+    } catch (error) {
+      debug.log('steward.stage', 'planning-invalid', { reason: redactSecrets(String(error)) });
+      for (const row of decisions) if (classifiedIds.has(row.issue) && !row.deferred && !row.duplicateOf) {
+        row.rung = 'hitl'; row.hitlReason = 'other'; row.why = 'triage judgment unavailable — human review';
+      }
     }
-    decisions.push(result);
-    decide({ kind: result.rung === 'hitl' ? 'ESCALATE' : 'ROUTE', what: issue.identifier, reason: result.why,
-      purpose: 'steward triage', target: result.owner ? `${result.rung} · ${result.owner}` : String(result.rung), refs: { issue: issue.identifier } });
+    for (const row of decisions) if (classifiedIds.has(row.issue) && !row.deferred) signal(row);
   }
+  debug.log('steward.triage', 'llm-calls', counts);
   return decisions;
 }
 
@@ -128,7 +169,7 @@ export function scheduleTriage(decisions: TriageDecision[], settings: StewardSet
     const role = item.owner ?? item.role ?? String(item.rung);
     const max = settings.roles?.[role]?.maxConcurrent ?? Infinity;
     const blocked = item.dependsOn.some(dep => !completed.has(dep));
-    const status: ScheduledDecision['disposition'] = item.rung === 'hitl' || item.hitlReason ? 'hitl' :
+    const status: ScheduledDecision['disposition'] = item.deferred || item.rung === 'hitl' || item.hitlReason ? 'hitl' :
       item.rung === 0 || item.duplicateOf || blocked || (slots[role] ?? 0) >= max || (item.cost ?? 0) > remaining ? 'wait' : 'now';
     if (status === 'now') { slots[role] = (slots[role] ?? 0) + 1; remaining -= item.cost ?? 0; }
     return { ...item, disposition: status };
@@ -147,6 +188,44 @@ async function linear<T>(key: string, query: string, variables: Record<string, u
   return body.data;
 }
 
+function graphRunId(): string | undefined {
+  const path = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!path) return undefined;
+  try {
+    const context = JSON.parse(readFileSync(path, 'utf8')) as { graphId?: string; runId?: string };
+    return context.graphId === 'steward' && /^[a-zA-Z0-9._-]+$/.test(context.runId ?? '') ? context.runId : undefined;
+  } catch { return undefined; }
+}
+
+function isProcessAlive(pid: number): boolean {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === 'EPERM'; }
+}
+
+function skippedPath(root: string): string {
+  // A graph run has a stable id across command nodes. Without a graph context,
+  // keep the skip until the next sync: stage subprocess parents may differ.
+  const runId = graphRunId();
+  return join(root, 'steward', runId ? `skipped-${runId}.json` : 'skipped-no-context.json');
+}
+
+function currentOpen(root: string, stage: StewardStage): FailureStreak['open'] & { pid?: number; runId?: string } {
+  const open = readFailureStreak(root).open;
+  return open ?? { stage, startedAt: new Date().toISOString() };
+}
+
+function skipOverlappingRun(root: string, open: FailureStreak['open'] & { pid?: number; runId?: string }): void {
+  // The skip marker is shared by every stage of one graph run. A loser inside the SAME run must not write it,
+  // or the winner's own triage·schedule·report would skip too — it just exits.
+  if (open.runId && open.runId === graphRunId()) {
+    debug.log('steward.stage', 'skipped-overlap-same-run', { openStage: open.stage, pid: open.pid });
+    return;
+  }
+  debug.log('steward.stage', 'skipped-overlap', { openStage: open.stage, pid: open.pid });
+  writeFileSync(skippedPath(root), JSON.stringify({ openStage: open.stage, pid: open.pid }));
+}
+
 function reportPath(root: string): string { return join(root, 'steward', 'observe.json'); }
 function readState(path: string): { issues: Record<string, string>; digestDay?: string } {
   try { return JSON.parse(readFileSync(path, 'utf8')) as ReturnType<typeof readState>; }
@@ -157,30 +236,66 @@ function readState(path: string): { issues: Record<string, string>; digestDay?:
 export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'report', deps: StewardDeps = {}): Promise<void> {
   const settings = stewardSettings();
   if ((settings.mode ?? 'observe') !== 'observe') throw new Error('steward act mode is out of scope');
-  const key = await (deps.getSecret ?? getSecretAsync)('connector.linear.apiKey');
-  if (!key) throw new Error('connector.linear.apiKey missing');
   const root = deps.root ?? effectiveInstanceRoot();
+  if (stage === 'sync' && !deps.stageOwnedByCommand) {
+    return withStageSlot(root, async () => {
+      const open = readFailureStreak(root).open as (FailureStreak['open'] & { pid?: number }) | undefined;
+      if (open?.pid && isProcessAlive(open.pid)) { skipOverlappingRun(root, open); return; }
+      rmSync(skippedPath(root), { force: true });
+      await runStewardStage(stage, { ...deps, stageOwnedByCommand: true });
+    }, () => { skipOverlappingRun(root, currentOpen(root, stage)); });
+  }
   const dir = join(root, 'steward');
   mkdirSync(dir, { recursive: true });
   const snapshot = join(dir, 'issues.json');
   const judgments = join(dir, 'triage.json');
   const schedule = join(dir, 'schedule.json');
   const fetchFn = deps.fetch ?? fetch;
+  const skip = skippedPath(root);
+  if (stage !== 'sync' && existsSync(skip)) return;
+  const key = await (deps.getSecret ?? getSecretAsync)('connector.linear.apiKey');
+  if (!key) throw new Error('connector.linear.apiKey missing');
   if (stage === 'sync') {
     const events = await fetchLinearIssues({ apiKey: key, teamKey: settings.linearTeam ?? 'ELA', fetch: fetchFn });
     writeFileSync(snapshot, JSON.stringify(events.map(e => ({ identifier: e.identifier, ref: e.ref, title: e.title, body: e.body }))));
   } else if (stage === 'triage') {
     const issues = JSON.parse(readFileSync(snapshot, 'utf8')) as TriageIssue[];
-    const judge = deps.judge ?? judgeStewardIssue;
-    writeFileSync(judgments, JSON.stringify(await triageIssues(issues, judge, deps.decide, settings.tracks)));
+    const judge = deps.judge;
+    let previous: Array<TriageDecision & { inputHash?: string }> = [];
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(judgments, 'utf8'));
+      if (Array.isArray(parsed) && parsed.every((item): item is TriageDecision & { inputHash?: string } =>
+        item !== null && typeof item === 'object' && typeof item.issue === 'string' &&
+        (item.inputHash === undefined || typeof item.inputHash === 'string') &&
+        (item.deferred === undefined || item.deferred === true) &&
+        (item.contextInputs === undefined || (Array.isArray(item.contextInputs) &&
+          item.contextInputs.every((id: unknown) => typeof id === 'string'))) &&
+        [0, 1, 2, 3, 4, 5, 'hitl'].includes(item.rung) &&
+        Array.isArray(item.dependsOn) && item.dependsOn.every((dep: unknown) => typeof dep === 'string') &&
+        typeof item.priority === 'number' && Number.isFinite(item.priority) && typeof item.why === 'string')) previous = parsed;
+    } catch { /* Missing or corrupt previous judgments are an empty cache. */ }
+    writeFileSync(judgments, JSON.stringify(await triageIssues(issues, judge, deps.decide, settings.tracks, previous, deps.ask)));
   } else if (stage === 'schedule') {
     const decisions = JSON.parse(readFileSync(judgments, 'utf8')) as TriageDecision[];
     const pending = new Set(decisions.flatMap(decision => decision.dependsOn));
     const completed = new Set<string>();
-    for (const identifier of pending) {
-      const data = await linear<{ issue: { identifier: string; state?: { type: string } } | null }>(key,
-        'query($id:String!){issue(id:$id){identifier state{type}}}', { id: identifier }, fetchFn);
-      if (data.issue?.identifier === identifier && data.issue.state?.type === 'completed') completed.add(identifier);
+    if (pending.size) {
+      const ids = [...pending];
+      for (let offset = 0; offset < ids.length; offset += 250) {
+        const batch = ids.slice(offset, offset + 250);
+        let cursor: string | null = null;
+        do {
+          const data: { issues: { nodes: Array<{ identifier: string; state?: { type: string } }>; pageInfo: { hasNextPage: boolean; endCursor: string | null } } } = await linear(key,
+            'query($ids:[String!]!,$after:String){issues(filter:{identifier:{in:$ids}},first:250,after:$after){nodes{identifier state{type}} pageInfo{hasNextPage endCursor}}}',
+            { ids: batch, after: cursor }, fetchFn);
+          if (!Array.isArray(data.issues?.nodes) || !data.issues.pageInfo ||
+              (data.issues.pageInfo.hasNextPage && (!data.issues.pageInfo.endCursor || data.issues.pageInfo.endCursor === cursor))) {
+            throw new Error('Linear dependencies incomplete');
+          }
+          for (const item of data.issues.nodes) if (pending.has(item.identifier) && item.state?.type === 'completed') completed.add(item.identifier);
+          cursor = data.issues.pageInfo.hasNextPage ? data.issues.pageInfo.endCursor : null;
+        } while (cursor);
+      }
     }
     writeFileSync(schedule, JSON.stringify(scheduleTriage(decisions, settings, {}, completed)));
   } else {
@@ -222,17 +337,104 @@ async function sendStewardDigest(text: string): Promise<void> {
   if (!deliver(text, 'digest')) throw new Error('steward digest delivery failed');
 }
 
+export interface StewardCommandDeps extends StewardDeps {
+  runStage?: typeof runStewardStage;
+  deliverAlert?: (text: string, kind: 'alert') => boolean | Promise<boolean>;
+}
+
+// One stage at a time per instance: an exclusive flock(2) on a stable file, taken in-process through libc
+// (as graph-tick does). The kernel drops it when the process dies, so a killed stage never leaves a stale lock.
+// The `flock` command-line tool is Linux-only — on macOS, where the steward cron runs, it does not exist (10-01).
+const STAGE_LOCK_WAIT_MS = 15 * 60_000;
+
+async function withStageSlot<T>(root: string, run: () => Promise<T>, onBusy?: () => T): Promise<T> {
+  const dir = join(root, 'steward');
+  mkdirSync(dir, { recursive: true });
+  const library = process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : process.platform === 'linux' ? 'libc.so.6' : null;
+  if (!library) throw new Error(`steward stage lock unavailable on ${process.platform}`);
+  const { dlopen, FFIType } = await import('bun:ffi');
+  const lib = dlopen(library, { flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 } });
+  const flock = (fd: number, operation: number): number => lib.symbols.flock(fd, operation) as number;
+  const fd = openSync(join(dir, 'stage-slot.lock'), 'a');
+  // LOCK_EX|LOCK_NB (2|4), retried on a timer: a blocking FFI call would freeze the event loop, and a holder in the
+  // same process could then never release (the lock is per open file, so a second open in one process contends too).
+  // With onBusy (sync), one try only: a busy slot means another run is in flight — skip instead of waiting.
+  if (onBusy && flock(fd, 2 | 4) !== 0) { closeSync(fd); lib.close(); return onBusy(); }
+  const deadline = Date.now() + STAGE_LOCK_WAIT_MS;
+  while (flock(fd, 2 | 4) !== 0) {
+    if (Date.now() >= deadline) { closeSync(fd); lib.close(); throw new Error('steward stage lock unavailable: another stage is still running'); }
+    await new Promise(resolve => setTimeout(resolve, 200));
+  }
+  try { return await run(); }
+  finally { try { flock(fd, 8); } finally { closeSync(fd); lib.close(); } }
+}
+
+/** The command-node boundary records both normal exits and an unclosed stage from a killed process. */
+export async function runStewardStageCommand(stage: StewardStage, deps: StewardCommandDeps = {}): Promise<0 | 1> {
+  const root = deps.root ?? effectiveInstanceRoot();
+  if (stage !== 'sync' && existsSync(skippedPath(root))) return 0;
+  return withStageSlot(root, async () => {
+    const now = deps.now ?? (() => new Date());
+    const threshold = stewardSettings().alertAfterFailures ?? 3;
+    const alertIfNeeded = async (state: FailureStreak): Promise<void> => {
+      if (!shouldAlert(state, threshold)) return;
+      try {
+        const send = deps.deliverAlert ?? (async (text: string, kind: 'alert') => {
+          const { deliver } = await import('../domains/outbound-alert.js');
+          return deliver(text, kind) !== false;
+        });
+        if (!await send(failureAlertText(state), 'alert')) throw new Error('steward alert delivery failed');
+        state.alertedAt = now().toISOString();
+        writeFailureStreak(root, state);
+        debug.log('steward.streak', 'alerted', { consecutive: state.consecutive, stage: state.lastStage });
+      } catch (error) {
+        try { debug.log('steward.streak', 'alert-failed', { consecutive: state.consecutive, stage: state.lastStage,
+          reason: redactSecretText(error instanceof Error ? error.message : String(error)) }); } catch { /* alert observability must not change the stage result */ }
+      }
+    };
+    const open = readFailureStreak(root).open as (FailureStreak['open'] & { pid?: number; runId?: string }) | undefined;
+    if (stage === 'sync') {
+      if (open?.pid && isProcessAlive(open.pid)) {
+        skipOverlappingRun(root, open);
+        return 0;
+      }
+      rmSync(skippedPath(root), { force: true });
+    } else if (existsSync(skippedPath(root))) return 0;
+    const hadOpen = open !== undefined;
+    const started = markStageStart(root, stage, now());
+    if (started.open) {
+      Object.assign(started.open, { pid: process.pid, ...(graphRunId() ? { runId: graphRunId() } : {}) });
+      writeFailureStreak(root, started);
+    }
+    if (hadOpen) {
+      debug.log('steward.streak', 'recorded', { consecutive: started.consecutive, stage: started.lastStage });
+      await alertIfNeeded(started);
+    }
+    let error: unknown;
+    let ok = false;
+    try { await (deps.runStage ?? runStewardStage)(stage, { ...deps, stageOwnedByCommand: true }); ok = true; }
+    catch (caught) { error = caught; }
+    const reason = ok ? '' : redactSecretText(error instanceof Error ? error.message : String(error)).slice(0, 300);
+    const state = markStageEnd(root, stage, ok, reason, now());
+    debug.log('steward.streak', 'recorded', { consecutive: state.consecutive, stage });
+    await alertIfNeeded(state);
+    if (!ok) {
+      console.error(`steward ${stage}: stage failed — ${reason}`);
+      debug.log('steward.stage', 'failed', { stage, reason });
+      return 1;
+    }
+    return 0;
+  }, stage === 'sync' ? () => { skipOverlappingRun(root, currentOpen(root, stage)); return 0 as const; } : undefined);
+}
+
 if (import.meta.main) {
   const stage = process.argv[2];
   if (!['sync', 'triage', 'schedule', 'report'].includes(stage ?? '')) {
     console.error('steward: expected sync|triage|schedule|report');
     process.exitCode = 2;
   } else {
-    runStewardStage(stage as 'sync' | 'triage' | 'schedule' | 'report').catch((error: unknown) => {
-      // Say why (secrets masked) — 09-29 the first resident run failed as a bare «stage failed» on a missing Linear key.
-      const reason = redactSecretText(error instanceof Error ? error.message : String(error)).slice(0, 300);
-      console.error(`steward ${stage}: stage failed — ${reason}`);
-      debug.log('steward.stage', 'failed', { stage, reason });
+    runStewardStageCommand(stage as StewardStage).then(code => { process.exitCode = code; }).catch((error: unknown) => {
+      console.error(`steward ${stage}: ${redactSecretText(error instanceof Error ? error.message : String(error))}`);
       process.exitCode = 1;
     });
   }

package/src/task-cards/card-store.ts

@@ -38,7 +38,7 @@ type CardEvent =
  *  A key is `<section>` or `<section>:<idempotency key>`: the same section can be appended many times over a
  *  task's life (e.g. workspace diff updates), and the same full key is written once. `incidents` is open to any loop. */
 export const SECTION_OWNERS: Readonly<Record<string, string | null>> = {
-  intake: 'steward', triage: 'steward',
+  intake: 'steward', triage: 'steward', launch: 'steward', outcome: 'steward',
   gates: 'execution-loop', relations: 'execution-loop', memory: 'execution-loop',
   workspace: 'executor', run: 'executor',
   landing: 'landing-loop', release: 'release-loop',

package/src/task-orchestrator/surfaces/pod-bun-cache.ts

@@ -0,0 +1,18 @@
+export const POD_BUN_CACHE_HOST_PATH = 'POD_BUN_CACHE_HOST_PATH';
+
+/** A host-backed Bun install cache; only opt into it when the mounted directory is writable. */
+export function podBunCacheVolume(hostPath: string) {
+  return {
+    volume: { name: 'bun-cache', hostPath: { path: hostPath, type: 'DirectoryOrCreate' } },
+    volumeMount: { name: 'bun-cache', mountPath: '/bun-cache', readOnly: false },
+    shellPrefix: 'if [ -d /bun-cache ] && [ -w /bun-cache ]; then export BUN_INSTALL_CACHE_DIR=/bun-cache; fi;',
+  };
+}
+
+/** First Bun install timing in a combined shard log (including a no-op install). */
+export function parseInstallSeconds(log: string): number | null {
+  const match = /(?:\d+ packages? installed|Checked \d+ installs across \d+ packages(?: \(no changes\))?)\s*\[(\d+(?:\.\d+)?)(ms|s)\]/.exec(log);
+  if (!match) return null;
+  const duration = Number(match[1]);
+  return match[2] === 'ms' ? duration / 1000 : duration;
+}