elanous 0.2.6 → 0.2.7

package/src/steward/triage.ts

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { fetchLinearIssues } from '../connectors/linear.js';
 import { getSecretAsync } from '../nexus/config/secrets/index.js';
@@ -9,6 +9,9 @@ import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { redactSecrets } from '../task-cards/card-store.js';
 import { directiveHash } from './directive.js';
 import { recordTriageOnCards, type StewardCardDeps } from './steward-cards.js';
+import { triageWithinBudget } from './triage-budget.js';
+import { askSteward, classifyIssue, planIssues, ruleJudgment, unsafeReason, type ClassifiedIssue, type StewardAsk } from './triage-plan.js';
+import { failureAlertText, markStageStart, markStageEnd, readFailureStreak, shouldAlert, writeFailureStreak, type FailureStreak, type StewardStage } from './failure-streak.js';
 
 export type Rung = 0 | 1 | 2 | 3 | 4 | 5 | 'hitl';
 /** `other` = the judge chose human review for a reason outside the four named ones (kept as HITL, never downgraded). */
@@ -19,6 +22,8 @@ export interface TriageDecision {
   hitlReason?: HitlReason; why: string; role?: string; cost?: number;
   /** Owner track from `loops.steward.tracks` (absent when no table is configured or the judge picked none of its keys). */
   owner?: string;
+  /** Carried from a previous triage without a current judgment; scheduling must not route it. */
+  deferred?: true;
 }
 export interface ScheduledDecision extends TriageDecision { disposition: 'now' | 'wait' | 'hitl' }
 export interface StewardSettings {
@@ -26,6 +31,7 @@ export interface StewardSettings {
   roles?: Record<string, { maxConcurrent?: number }>;
   budget?: number;
   tracks?: Record<string, string>;
+  alertAfterFailures?: number;
 }
 export interface StewardDeps {
   fetch?: typeof fetch;
@@ -37,18 +43,15 @@ export interface StewardDeps {
   root?: string;
   cardStore?: StewardCardDeps['store'];
   warn?: (message: string) => void;
+  ask?: StewardAsk;
+  /** Internal command boundary: the current sync has already claimed this pid. */
+  stageOwnedByCommand?: boolean;
 }
 
 export function stewardSettings(): StewardSettings {
   return getUserConfig().loops?.steward ?? {};
 }
 
-const unsafe: Array<[HitlReason, RegExp]> = [
-  ['money', /돈|유료|결제|구매|판매|송금|환불|크레딧\s*(?:추가|구매)|paid|payment|purchase/i],
-  ['public', /공개|발행|외부\s*게시|publish|public\s*release/i],
-  ['security', /보안|(?:키|자격|권한|secret|credential|permission)\s*(?:변경|교체|발급|삭제|공유|노출)|키체인/i],
-  ['irreversible', /비가역|강제\s*푸시|force.push|영구\s*삭제|리셋권\s*소비|drop\s*table|초기화/i],
-];
 
 function parseJudgment(issue: TriageIssue, raw: unknown, tracks?: Record<string, string>): TriageDecision {
   const value = typeof raw === 'string' ? JSON.parse(raw) as unknown : raw;
@@ -59,8 +62,8 @@ function parseJudgment(issue: TriageIssue, raw: unknown, tracks?: Record<string,
       typeof d.priority !== 'number' || !Number.isFinite(d.priority) || typeof d.why !== 'string' || !d.why.trim()) {
     throw new Error(`Invalid triage judgment: ${issue.identifier}`);
   }
-  const forced = unsafe.find(([, pattern]) => pattern.test(`${issue.title}\n${issue.body}`))?.[0];
-  const named = forced ?? (unsafe.some(([reason]) => reason === d.hitlReason) ? d.hitlReason as HitlReason : undefined);
+  const forced = unsafeReason(issue);
+  const named = forced ?? (['money', 'public', 'security', 'irreversible'].includes(d.hitlReason as string) ? d.hitlReason as HitlReason : undefined);
   // A HITL judgment without one of the four named reasons stays HITL (`other`) — one issue must not stop the stage.
   const hitlReason = named ?? (d.rung === 'hitl' ? 'other' as const : undefined);
   return {
@@ -81,30 +84,68 @@ export function trackTablePrompt(tracks?: Record<string, string>): string {
   return `\n담당 트랙(owner) — 아래 중 하나(${keys.map(k => JSON.stringify(k)).join('|')}) · 이슈가 어느 트랙 일인지:\n${keys.map(k => `- ${k}: ${tracks[k]}`).join('\n')}`;
 }
 
-async function judgeStewardIssue(issue: TriageIssue, issues: TriageIssue[], tracks?: Record<string, string>): Promise<unknown> {
-  const ownerField = tracks && Object.keys(tracks).length ? `,"owner":${JSON.stringify(Object.keys(tracks)[0])}` : '';
-  const prompt = `스튜어드 트리아지. JSON 객체만 출력: {"rung":0|1|2|3|4|5|"hitl","dependsOn":[],"priority":1,"duplicateOf":null,"hitlReason":null,"why":"한 문장","role":"builder","cost":0${ownerField}}.\n0=이미됨/중복, 1=셸, 2=CLI, 3=조사, 4=하니스 골, 5=외부 에이전트. 돈·공개·보안·비가역은 hitl(hitlReason = "money"|"public"|"security"|"irreversible" · 그 밖의 이유로 사람 확인이 필요하면 "other"). 확인되지 않은 완료/중복은 추측하지 마라. 의존은 제공된 이슈 키만 써라.${trackTablePrompt(tracks)}\n이슈 목록: ${JSON.stringify(issues.map(i => ({ key: i.identifier, title: i.title })))}\n판정 대상: ${JSON.stringify(issue)}`;
-  const { streamLLM } = await import('../llm.js');
-  const { tierModel } = await import('../llm/model-defaults.js');
-  const result = await streamLLM([{ role: 'user', content: prompt }], () => {}, { model: tierModel('best') });
-  return JSON.parse(result.replace(/^```(?:json)?\s*|\s*```$/g, '').trim()) as unknown;
-}
-
-export async function triageIssues(issues: TriageIssue[], judge: NonNullable<StewardDeps['judge']> = judgeStewardIssue, decide: typeof emitDecision = emitDecision, tracks?: Record<string, string>): Promise<TriageDecision[]> {
-  const decisions: TriageDecision[] = [];
-  for (const issue of issues) {
-    let result: TriageDecision;
+export async function triageIssues(issues: TriageIssue[], judge?: NonNullable<StewardDeps['judge']>, decide: typeof emitDecision = emitDecision, tracks?: Record<string, string>, previous: Array<TriageDecision & { inputHash?: string }> = [], ask: StewardAsk = askSteward): Promise<TriageDecision[]> {
+  const started = judge ? 0 : Date.now();
+  const classified: ClassifiedIssue[] = [];
+  const classifiedIds = new Set<string>();
+  const counts = { rule: 0, classify: 0, planning: 0 };
+  const signal = (result: TriageDecision): void => {
+    decide({ kind: result.rung === 'hitl' ? 'ESCALATE' : 'ROUTE', what: result.issue, reason: result.why,
+      purpose: 'steward triage', target: result.owner ? `${result.rung} · ${result.owner}` : String(result.rung), refs: { issue: result.issue } });
+  };
+  const { decisions } = await triageWithinBudget({ issues, previous, tracks, judge: async (issue, observedIssues) => {
     try {
-      result = parseJudgment(issue, await judge(issue, issues, tracks), tracks);
+      if (judge) return parseJudgment(issue, await judge(issue, observedIssues ?? issues, tracks), tracks);
+      const byRule = ruleJudgment(issue, observedIssues ?? issues);
+      if (byRule) { counts.rule++; return { ...byRule, dependsOn: [], priority: 0 }; }
+      counts.classify++;
+      const row = await classifyIssue(issue, ask);
+      return { ...row, dependsOn: [], priority: 0 };
     } catch (error) {
-      // A malformed or failed judgment for one issue goes to a human; the other issues are still triaged.
       try { debug.log('steward.stage', 'judgment-invalid', { issue: issue.identifier, reason: redactSecrets(String(error)) }); } catch { /* fail-soft */ }
-      result = { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0, why: 'triage judgment unavailable — human review' };
+      return { issue: issue.identifier, rung: 'hitl', hitlReason: 'other', dependsOn: [], priority: 0, why: 'triage judgment unavailable — human review' };
+    }
+  }, onJudged: result => {
+    if (!judge && !result.deferred && !result.duplicateOf &&
+        result.why !== 'triage judgment unavailable — human review' &&
+        result.why !== 'triage judgment timed out — human review' &&
+        result.why !== 'triage deferred — deadline') {
+      classified.push({ issue: result.issue, rung: result.rung, why: result.why,
+        ...(result.hitlReason ? { hitlReason: result.hitlReason } : {}) });
+      classifiedIds.add(result.issue);
+    } else signal(result);
+  } });
+  const planningBatch = classified.slice();
+  if (!judge && planningBatch.length) {
+    const remaining = 240_000 - (Date.now() - started);
+    try {
+      if (remaining <= 0) throw new Error('planning deadline');
+      counts.planning++;
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      let plans;
+      try {
+        plans = await Promise.race([planIssues(planningBatch, ask, tracks, issues), new Promise<never>((_, reject) => {
+          timer = setTimeout(() => reject(new Error('planning deadline')), remaining);
+        })]);
+      } finally { if (timer) clearTimeout(timer); }
+      const byIssue = new Map(plans.map(plan => [plan.issue, plan]));
+      for (const row of decisions) {
+        const plan = byIssue.get(row.issue);
+        if (plan && !row.deferred) {
+          row.priority = plan.priority;
+          row.dependsOn = plan.dependsOn;
+          if (plan.owner) row.owner = plan.owner;
+        }
+      }
+    } catch (error) {
+      debug.log('steward.stage', 'planning-invalid', { reason: redactSecrets(String(error)) });
+      for (const row of decisions) if (classifiedIds.has(row.issue) && !row.deferred && !row.duplicateOf) {
+        row.rung = 'hitl'; row.hitlReason = 'other'; row.why = 'triage judgment unavailable — human review';
+      }
     }
-    decisions.push(result);
-    decide({ kind: result.rung === 'hitl' ? 'ESCALATE' : 'ROUTE', what: issue.identifier, reason: result.why,
-      purpose: 'steward triage', target: result.owner ? `${result.rung} · ${result.owner}` : String(result.rung), refs: { issue: issue.identifier } });
+    for (const row of decisions) if (classifiedIds.has(row.issue) && !row.deferred) signal(row);
   }
+  debug.log('steward.triage', 'llm-calls', counts);
   return decisions;
 }
 
@@ -128,7 +169,7 @@ export function scheduleTriage(decisions: TriageDecision[], settings: StewardSet
     const role = item.owner ?? item.role ?? String(item.rung);
     const max = settings.roles?.[role]?.maxConcurrent ?? Infinity;
     const blocked = item.dependsOn.some(dep => !completed.has(dep));
-    const status: ScheduledDecision['disposition'] = item.rung === 'hitl' || item.hitlReason ? 'hitl' :
+    const status: ScheduledDecision['disposition'] = item.deferred || item.rung === 'hitl' || item.hitlReason ? 'hitl' :
       item.rung === 0 || item.duplicateOf || blocked || (slots[role] ?? 0) >= max || (item.cost ?? 0) > remaining ? 'wait' : 'now';
     if (status === 'now') { slots[role] = (slots[role] ?? 0) + 1; remaining -= item.cost ?? 0; }
     return { ...item, disposition: status };
@@ -147,6 +188,44 @@ async function linear<T>(key: string, query: string, variables: Record<string, u
   return body.data;
 }
 
+function graphRunId(): string | undefined {
+  const path = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!path) return undefined;
+  try {
+    const context = JSON.parse(readFileSync(path, 'utf8')) as { graphId?: string; runId?: string };
+    return context.graphId === 'steward' && /^[a-zA-Z0-9._-]+$/.test(context.runId ?? '') ? context.runId : undefined;
+  } catch { return undefined; }
+}
+
+function isProcessAlive(pid: number): boolean {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === 'EPERM'; }
+}
+
+function skippedPath(root: string): string {
+  // A graph run has a stable id across command nodes. Without a graph context,
+  // keep the skip until the next sync: stage subprocess parents may differ.
+  const runId = graphRunId();
+  return join(root, 'steward', runId ? `skipped-${runId}.json` : 'skipped-no-context.json');
+}
+
+function currentOpen(root: string, stage: StewardStage): FailureStreak['open'] & { pid?: number; runId?: string } {
+  const open = readFailureStreak(root).open;
+  return open ?? { stage, startedAt: new Date().toISOString() };
+}
+
+function skipOverlappingRun(root: string, open: FailureStreak['open'] & { pid?: number; runId?: string }): void {
+  // The skip marker is shared by every stage of one graph run. A loser inside the SAME run must not write it,
+  // or the winner's own triage·schedule·report would skip too — it just exits.
+  if (open.runId && open.runId === graphRunId()) {
+    debug.log('steward.stage', 'skipped-overlap-same-run', { openStage: open.stage, pid: open.pid });
+    return;
+  }
+  debug.log('steward.stage', 'skipped-overlap', { openStage: open.stage, pid: open.pid });
+  writeFileSync(skippedPath(root), JSON.stringify({ openStage: open.stage, pid: open.pid }));
+}
+
 function reportPath(root: string): string { return join(root, 'steward', 'observe.json'); }
 function readState(path: string): { issues: Record<string, string>; digestDay?: string } {
   try { return JSON.parse(readFileSync(path, 'utf8')) as ReturnType<typeof readState>; }
@@ -157,30 +236,66 @@ function readState(path: string): { issues: Record<string, string>; digestDay?:
 export async function runStewardStage(stage: 'sync' | 'triage' | 'schedule' | 'report', deps: StewardDeps = {}): Promise<void> {
   const settings = stewardSettings();
   if ((settings.mode ?? 'observe') !== 'observe') throw new Error('steward act mode is out of scope');
-  const key = await (deps.getSecret ?? getSecretAsync)('connector.linear.apiKey');
-  if (!key) throw new Error('connector.linear.apiKey missing');
   const root = deps.root ?? effectiveInstanceRoot();
+  if (stage === 'sync' && !deps.stageOwnedByCommand) {
+    return withStageSlot(root, async () => {
+      const open = readFailureStreak(root).open as (FailureStreak['open'] & { pid?: number }) | undefined;
+      if (open?.pid && isProcessAlive(open.pid)) { skipOverlappingRun(root, open); return; }
+      rmSync(skippedPath(root), { force: true });
+      await runStewardStage(stage, { ...deps, stageOwnedByCommand: true });
+    }, () => { skipOverlappingRun(root, currentOpen(root, stage)); });
+  }
   const dir = join(root, 'steward');
   mkdirSync(dir, { recursive: true });
   const snapshot = join(dir, 'issues.json');
   const judgments = join(dir, 'triage.json');
   const schedule = join(dir, 'schedule.json');
   const fetchFn = deps.fetch ?? fetch;
+  const skip = skippedPath(root);
+  if (stage !== 'sync' && existsSync(skip)) return;
+  const key = await (deps.getSecret ?? getSecretAsync)('connector.linear.apiKey');
+  if (!key) throw new Error('connector.linear.apiKey missing');
   if (stage === 'sync') {
     const events = await fetchLinearIssues({ apiKey: key, teamKey: settings.linearTeam ?? 'ELA', fetch: fetchFn });
     writeFileSync(snapshot, JSON.stringify(events.map(e => ({ identifier: e.identifier, ref: e.ref, title: e.title, body: e.body }))));
   } else if (stage === 'triage') {
     const issues = JSON.parse(readFileSync(snapshot, 'utf8')) as TriageIssue[];
-    const judge = deps.judge ?? judgeStewardIssue;
-    writeFileSync(judgments, JSON.stringify(await triageIssues(issues, judge, deps.decide, settings.tracks)));
+    const judge = deps.judge;
+    let previous: Array<TriageDecision & { inputHash?: string }> = [];
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(judgments, 'utf8'));
+      if (Array.isArray(parsed) && parsed.every((item): item is TriageDecision & { inputHash?: string } =>
+        item !== null && typeof item === 'object' && typeof item.issue === 'string' &&
+        (item.inputHash === undefined || typeof item.inputHash === 'string') &&
+        (item.deferred === undefined || item.deferred === true) &&
+        (item.contextInputs === undefined || (Array.isArray(item.contextInputs) &&
+          item.contextInputs.every((id: unknown) => typeof id === 'string'))) &&
+        [0, 1, 2, 3, 4, 5, 'hitl'].includes(item.rung) &&
+        Array.isArray(item.dependsOn) && item.dependsOn.every((dep: unknown) => typeof dep === 'string') &&
+        typeof item.priority === 'number' && Number.isFinite(item.priority) && typeof item.why === 'string')) previous = parsed;
+    } catch { /* Missing or corrupt previous judgments are an empty cache. */ }
+    writeFileSync(judgments, JSON.stringify(await triageIssues(issues, judge, deps.decide, settings.tracks, previous, deps.ask)));
   } else if (stage === 'schedule') {
     const decisions = JSON.parse(readFileSync(judgments, 'utf8')) as TriageDecision[];
     const pending = new Set(decisions.flatMap(decision => decision.dependsOn));
     const completed = new Set<string>();
-    for (const identifier of pending) {
-      const data = await linear<{ issue: { identifier: string; state?: { type: string } } | null }>(key,
-        'query($id:String!){issue(id:$id){identifier state{type}}}', { id: identifier }, fetchFn);
-      if (data.issue?.identifier === identifier && data.issue.state?.type === 'completed') completed.add(identifier);
+    if (pending.size) {
+      const ids = [...pending];
+      for (let offset = 0; offset < ids.length; offset += 250) {
+        const batch = ids.slice(offset, offset + 250);
+        let cursor: string | null = null;
+        do {
+          const data: { issues: { nodes: Array<{ identifier: string; state?: { type: string } }>; pageInfo: { hasNextPage: boolean; endCursor: string | null } } } = await linear(key,
+            'query($ids:[String!]!,$after:String){issues(filter:{identifier:{in:$ids}},first:250,after:$after){nodes{identifier state{type}} pageInfo{hasNextPage endCursor}}}',
+            { ids: batch, after: cursor }, fetchFn);
+          if (!Array.isArray(data.issues?.nodes) || !data.issues.pageInfo ||
+              (data.issues.pageInfo.hasNextPage && (!data.issues.pageInfo.endCursor || data.issues.pageInfo.endCursor === cursor))) {
+            throw new Error('Linear dependencies incomplete');
+          }
+          for (const item of data.issues.nodes) if (pending.has(item.identifier) && item.state?.type === 'completed') completed.add(item.identifier);
+          cursor = data.issues.pageInfo.hasNextPage ? data.issues.pageInfo.endCursor : null;
+        } while (cursor);
+      }
     }
     writeFileSync(schedule, JSON.stringify(scheduleTriage(decisions, settings, {}, completed)));
   } else {
@@ -222,17 +337,104 @@ async function sendStewardDigest(text: string): Promise<void> {
   if (!deliver(text, 'digest')) throw new Error('steward digest delivery failed');
 }
 
+export interface StewardCommandDeps extends StewardDeps {
+  runStage?: typeof runStewardStage;
+  deliverAlert?: (text: string, kind: 'alert') => boolean | Promise<boolean>;
+}
+
+// One stage at a time per instance: an exclusive flock(2) on a stable file, taken in-process through libc
+// (as graph-tick does). The kernel drops it when the process dies, so a killed stage never leaves a stale lock.
+// The `flock` command-line tool is Linux-only — on macOS, where the steward cron runs, it does not exist (10-01).
+const STAGE_LOCK_WAIT_MS = 15 * 60_000;
+
+async function withStageSlot<T>(root: string, run: () => Promise<T>, onBusy?: () => T): Promise<T> {
+  const dir = join(root, 'steward');
+  mkdirSync(dir, { recursive: true });
+  const library = process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : process.platform === 'linux' ? 'libc.so.6' : null;
+  if (!library) throw new Error(`steward stage lock unavailable on ${process.platform}`);
+  const { dlopen, FFIType } = await import('bun:ffi');
+  const lib = dlopen(library, { flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 } });
+  const flock = (fd: number, operation: number): number => lib.symbols.flock(fd, operation) as number;
+  const fd = openSync(join(dir, 'stage-slot.lock'), 'a');
+  // LOCK_EX|LOCK_NB (2|4), retried on a timer: a blocking FFI call would freeze the event loop, and a holder in the
+  // same process could then never release (the lock is per open file, so a second open in one process contends too).
+  // With onBusy (sync), one try only: a busy slot means another run is in flight — skip instead of waiting.
+  if (onBusy && flock(fd, 2 | 4) !== 0) { closeSync(fd); lib.close(); return onBusy(); }
+  const deadline = Date.now() + STAGE_LOCK_WAIT_MS;
+  while (flock(fd, 2 | 4) !== 0) {
+    if (Date.now() >= deadline) { closeSync(fd); lib.close(); throw new Error('steward stage lock unavailable: another stage is still running'); }
+    await new Promise(resolve => setTimeout(resolve, 200));
+  }
+  try { return await run(); }
+  finally { try { flock(fd, 8); } finally { closeSync(fd); lib.close(); } }
+}
+
+/** The command-node boundary records both normal exits and an unclosed stage from a killed process. */
+export async function runStewardStageCommand(stage: StewardStage, deps: StewardCommandDeps = {}): Promise<0 | 1> {
+  const root = deps.root ?? effectiveInstanceRoot();
+  if (stage !== 'sync' && existsSync(skippedPath(root))) return 0;
+  return withStageSlot(root, async () => {
+    const now = deps.now ?? (() => new Date());
+    const threshold = stewardSettings().alertAfterFailures ?? 3;
+    const alertIfNeeded = async (state: FailureStreak): Promise<void> => {
+      if (!shouldAlert(state, threshold)) return;
+      try {
+        const send = deps.deliverAlert ?? (async (text: string, kind: 'alert') => {
+          const { deliver } = await import('../domains/outbound-alert.js');
+          return deliver(text, kind) !== false;
+        });
+        if (!await send(failureAlertText(state), 'alert')) throw new Error('steward alert delivery failed');
+        state.alertedAt = now().toISOString();
+        writeFailureStreak(root, state);
+        debug.log('steward.streak', 'alerted', { consecutive: state.consecutive, stage: state.lastStage });
+      } catch (error) {
+        try { debug.log('steward.streak', 'alert-failed', { consecutive: state.consecutive, stage: state.lastStage,
+          reason: redactSecretText(error instanceof Error ? error.message : String(error)) }); } catch { /* alert observability must not change the stage result */ }
+      }
+    };
+    const open = readFailureStreak(root).open as (FailureStreak['open'] & { pid?: number; runId?: string }) | undefined;
+    if (stage === 'sync') {
+      if (open?.pid && isProcessAlive(open.pid)) {
+        skipOverlappingRun(root, open);
+        return 0;
+      }
+      rmSync(skippedPath(root), { force: true });
+    } else if (existsSync(skippedPath(root))) return 0;
+    const hadOpen = open !== undefined;
+    const started = markStageStart(root, stage, now());
+    if (started.open) {
+      Object.assign(started.open, { pid: process.pid, ...(graphRunId() ? { runId: graphRunId() } : {}) });
+      writeFailureStreak(root, started);
+    }
+    if (hadOpen) {
+      debug.log('steward.streak', 'recorded', { consecutive: started.consecutive, stage: started.lastStage });
+      await alertIfNeeded(started);
+    }
+    let error: unknown;
+    let ok = false;
+    try { await (deps.runStage ?? runStewardStage)(stage, { ...deps, stageOwnedByCommand: true }); ok = true; }
+    catch (caught) { error = caught; }
+    const reason = ok ? '' : redactSecretText(error instanceof Error ? error.message : String(error)).slice(0, 300);
+    const state = markStageEnd(root, stage, ok, reason, now());
+    debug.log('steward.streak', 'recorded', { consecutive: state.consecutive, stage });
+    await alertIfNeeded(state);
+    if (!ok) {
+      console.error(`steward ${stage}: stage failed — ${reason}`);
+      debug.log('steward.stage', 'failed', { stage, reason });
+      return 1;
+    }
+    return 0;
+  }, stage === 'sync' ? () => { skipOverlappingRun(root, currentOpen(root, stage)); return 0 as const; } : undefined);
+}
+
 if (import.meta.main) {
   const stage = process.argv[2];
   if (!['sync', 'triage', 'schedule', 'report'].includes(stage ?? '')) {
     console.error('steward: expected sync|triage|schedule|report');
     process.exitCode = 2;
   } else {
-    runStewardStage(stage as 'sync' | 'triage' | 'schedule' | 'report').catch((error: unknown) => {
-      // Say why (secrets masked) — 09-29 the first resident run failed as a bare «stage failed» on a missing Linear key.
-      const reason = redactSecretText(error instanceof Error ? error.message : String(error)).slice(0, 300);
-      console.error(`steward ${stage}: stage failed — ${reason}`);
-      debug.log('steward.stage', 'failed', { stage, reason });
+    runStewardStageCommand(stage as StewardStage).then(code => { process.exitCode = code; }).catch((error: unknown) => {
+      console.error(`steward ${stage}: ${redactSecretText(error instanceof Error ? error.message : String(error))}`);
       process.exitCode = 1;
     });
   }

package/src/task-cards/card-store.ts

@@ -38,7 +38,7 @@ type CardEvent =
  *  A key is `<section>` or `<section>:<idempotency key>`: the same section can be appended many times over a
  *  task's life (e.g. workspace diff updates), and the same full key is written once. `incidents` is open to any loop. */
 export const SECTION_OWNERS: Readonly<Record<string, string | null>> = {
-  intake: 'steward', triage: 'steward',
+  intake: 'steward', triage: 'steward', launch: 'steward', outcome: 'steward',
   gates: 'execution-loop', relations: 'execution-loop', memory: 'execution-loop',
   workspace: 'executor', run: 'executor',
   landing: 'landing-loop', release: 'release-loop',

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } fr
 import { gunzipSync } from 'node:zlib';
 import { debug } from '../../debug/log.js';
 import { runLedgerDir, runLedgerPath } from '../../self-implement/run-ledger.js';
+import { ledgerLineToLogEvent } from './pod-ledger-events.js';
 
 type Ledger = { runId: string; jsonl: string };
 type Incomplete = { runId: string; reason: string };
@@ -124,7 +125,7 @@ export function createPodLedgerFollower(opts: {
   let owned = false;
   let disabled = false;
   let lastProgressAt = now();
-  let lastProgressEvent: string | null = null;
+  let visibleProgressEvent: string | null = null;
   let lastActivityMeasuredAt = lastProgressAt;
   let lastActivityLogAt = -Infinity;
   let nextStallMinute = stallMinutes;
@@ -132,11 +133,11 @@ export function createPodLedgerFollower(opts: {
   function checkStall(ledgerRead: boolean, activityMeasured: boolean) {
     const idleMinutes = Math.max(0, (now() - lastProgressAt) / 60_000);
     if (idleMinutes >= nextStallMinute) {
-      log('self-implement.pod', 'stalled', { runId: opts.runId, lastProgressEvent, idleMinutes });
+      log('self-implement.pod', 'stalled', { runId: opts.runId, lastProgressEvent: visibleProgressEvent, idleMinutes });
       const observation = ledgerRead
         ? (activityMeasured ? '원장·작업 트리 모두 조용함' : '원장 조용함')
         : '원장 못 잼';
-      onStall(`[pod] 진행 없음 ${Math.floor(idleMinutes)}분 — ${observation} · 마지막 진행 ${lastProgressEvent ?? '없음'}${activityMeasured ? '' : ' (작업 트리 못 잼)'}`);
+      onStall(`[pod] 진행 없음 ${Math.floor(idleMinutes)}분 — ${observation} · 마지막 진행 ${visibleProgressEvent ?? '없음'}${activityMeasured ? '' : ' (작업 트리 못 잼)'}`);
       stalled = true;
       nextStallMinute = (Math.floor(idleMinutes / stallMinutes) + 1) * stallMinutes;
     }
@@ -169,7 +170,7 @@ export function createPodLedgerFollower(opts: {
           if (stalled) log('self-implement.pod', 'stall-cleared', { runId: opts.runId, idleMinutes });
           stalled = false;
           lastProgressAt = now();
-          lastProgressEvent = 'worktree-activity';
+          visibleProgressEvent = 'worktree-activity';
           nextStallMinute = stallMinutes;
           if (now() - lastActivityLogAt >= 5 * 60_000) {
             log('self-implement.pod', 'worktree-activity', { runId: opts.runId, files });
@@ -190,6 +191,11 @@ export function createPodLedgerFollower(opts: {
       log('self-implement.pod', 'ledger-live-appended', { runId: opts.runId, lines: complete.split('\n').filter(Boolean).length, bytes: Buffer.byteLength(complete), offset });
       for (const line of complete.split('\n')) {
         if (!line) continue;
+        let logEvent: ReturnType<typeof ledgerLineToLogEvent>;
+        try {
+          logEvent = ledgerLineToLogEvent(line, opts.runId);
+          if (logEvent) log(logEvent.category, logEvent.event, logEvent.data);
+        } catch { /* A failed host log write must not interrupt ledger following or stall accounting. */ }
         let entry: unknown;
         try { entry = JSON.parse(line); } catch { continue; }
         const event = (entry && typeof entry === 'object' && 'event' in entry) ? entry.event : undefined;
@@ -198,7 +204,7 @@ export function createPodLedgerFollower(opts: {
         if (stalled) log('self-implement.pod', 'stall-cleared', { runId: opts.runId, idleMinutes });
         stalled = false;
         lastProgressAt = now();
-        lastProgressEvent = event;
+        visibleProgressEvent = logEvent?.event ?? '[redacted]';
         nextStallMinute = stallMinutes;
       }
       checkStall(true, activityMeasured);

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -0,0 +1,68 @@
+const SECRET_FIELD = /token|secret|password|authorization|key/i;
+const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;
+const MAX_FIELDS = 32;
+// Review R2: only lifecycle events the host needs to see, and no free text. Event names must start with a known
+// lifecycle prefix; string fields survive only when they are short code-like values in a fixed set of keys.
+const EVENT_ALLOWED = /^(?:gate|gated|review|reviewed|repair|repaired|rework|merge|merged|pr|land|landed|stage|round|supervisor|child|plan|planned|decompose|decomposed|shard|stall|harvest|decision|run|pipeline|progress|human|start|started|finish|finished|done|implement|implemented|commit|test|typecheck)(?:-(?:started|finished|round|opened|closed|failed|passed|blocked|done|entry|node|outcome|delivery|decision|stop|merged|ready|requested|resolved|result|fix|must-fix|verdict|skipped|origin|cleared))*$/;
+const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result']);
+const CODE_VALUE = /^[a-z0-9_.:-]{1,40}$/i;
+
+function secretValues(root: Record<string, unknown>): string[] {
+  const secrets: string[] = [];
+  const pending: unknown[] = [root];
+  while (pending.length) {
+    const current = pending.pop();
+    if (!current || typeof current !== 'object') continue;
+    if (Array.isArray(current)) {
+      pending.push(...current);
+      continue;
+    }
+    for (const [name, value] of Object.entries(current)) {
+      if (SECRET_FIELD.test(name) && typeof value === 'string' && value.length >= 3) secrets.push(value);
+      if (value && typeof value === 'object') pending.push(value);
+    }
+  }
+  return secrets;
+}
+
+/** Project bounded ledger metadata, excluding named secrets and recognizable credential values. */
+export function ledgerLineToLogEvent(line: string, runId: string): {
+  category: string;
+  event: string;
+  data: Record<string, unknown>;
+} | undefined {
+  let entry: unknown;
+  try { entry = JSON.parse(line); } catch { return undefined; }
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry) || !('event' in entry) || typeof entry.event !== 'string') return undefined;
+  // The real run-ledger writer wraps observer fields in `data`; older/synthetic lines can be flat.
+  const details = 'data' in entry && entry.data && typeof entry.data === 'object' && !Array.isArray(entry.data)
+    ? entry.data as Record<string, unknown> : undefined;
+  const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
+  const knownSecrets = secretValues(entry);
+  const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
+  if (containsCredential(entry.event) || !EVENT_ALLOWED.test(entry.event)) return undefined;
+
+  const data: Record<string, unknown> = { runId };
+  let fields = 0;
+  for (const source of sources) {
+    for (const [name, value] of Object.entries(source)) {
+      if (name === 'event' || name === 'runId' || name === 'data' || !SAFE_FIELD.test(name) || SECRET_FIELD.test(name)) continue;
+      if (fields >= MAX_FIELDS) break;
+      const countName = `${name}Count`;
+      const outputName = Array.isArray(value) || value && typeof value === 'object' ? countName : name;
+      if (!SAFE_FIELD.test(outputName) || SECRET_FIELD.test(outputName) || Object.hasOwn(data, outputName)) continue;
+      if (typeof value === 'string') {
+        // Free text (reasons, messages, patches) never leaves the pod ledger; only short code values in known keys.
+        if (!CODE_FIELDS.has(name) || !CODE_VALUE.test(value) || containsCredential(value)) continue;
+        data[name] = value;
+      } else if (typeof value === 'number' && Number.isFinite(value) || typeof value === 'boolean' || value === null) {
+        data[name] = value;
+      } else if (Array.isArray(value) || value && typeof value === 'object') {
+        data[countName] = Array.isArray(value) ? value.length : Object.keys(value).length;
+      } else continue;
+      fields += 1;
+    }
+  }
+  return { category: 'self-implement.pod.ledger', event: entry.event, data };
+}