elanous 0.2.6 → 0.2.8

package/src/relay/relay-server.ts

@@ -0,0 +1,220 @@
+import { createPublicKey, randomBytes, verify } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import type { ServerWebSocket } from 'bun';
+import { MAX_FRAME_BYTES } from './channel.js';
+
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+const MAX_CLIENTS_PER_SERVER = 8;
+const BYTES_PER_SECOND = 1024 * 1024;
+const BURST_BYTES = 2 * BYTES_PER_SECOND;
+const PING_INTERVAL_MS = 30_000;
+const DEAD_PEER_MS = 90_000;
+const AUTH_TIMEOUT_MS = 10_000;
+
+type SocketData = { role: 'host' | 'client'; serverId: string; clientId?: number; challenge?: string; authenticated: boolean; lastSeen: number; tokens: number; refillAt: number; authTimer?: ReturnType<typeof setTimeout> };
+type Socket = ServerWebSocket<SocketData>;
+type Room = { host?: Socket; clients: Map<number, Socket>; nextId: number; bytes: number; failures: Record<string, number> };
+
+export interface RelayServerOptions {
+  port?: number;
+  hostname?: string;
+  /** Ed25519 signing public keys (base64url raw 32 bytes), pinned by X25519-derived serverId. */
+  trustedHostKeys?: ReadonlyMap<string, string>;
+}
+
+/** Load operator-provisioned pins, never keys claimed by connecting hosts. */
+export function loadTrustedHostKeys(file: string): ReadonlyMap<string, string> {
+  const raw: unknown = JSON.parse(readFileSync(file, 'utf8'));
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('invalid relay trusted host keys');
+  const result = new Map<string, string>();
+  for (const [id, key] of Object.entries(raw)) {
+    if (!/^[a-f0-9]{64}$/.test(id) || typeof key !== 'string' || !decodeKey(key)) {
+      throw new Error('invalid relay trusted host key entry');
+    }
+    result.set(id, key);
+  }
+  return result;
+}
+
+export function challengeMessage(serverId: string, nonce: string): Uint8Array {
+  return Buffer.from(`elanous-relay-v1:${serverId}:${nonce}`, 'utf8');
+}
+
+function decodeKey(value: string): Buffer | undefined {
+  if (!/^[A-Za-z0-9_-]{43}$/.test(value)) return undefined;
+  const decoded = Buffer.from(value, 'base64url');
+  return decoded.length === 32 && decoded.toString('base64url') === value ? decoded : undefined;
+}
+
+function encodeClientId(id: number, payload: Uint8Array): Uint8Array {
+  const result = new Uint8Array(payload.length + 4);
+  new DataView(result.buffer).setUint32(0, id, false);
+  result.set(payload, 4);
+  return result;
+}
+
+/** The relay never parses or logs encrypted channel payloads. Host binary frames carry a
+ * four-byte big-endian clientId prefix; phone binary frames are raw ciphertext. */
+export function startRelayServer(options: RelayServerOptions = {}) {
+  if (!options.trustedHostKeys?.size) throw new Error('relay trusted host keys required');
+  const trustedHostKeys = new Map(options.trustedHostKeys);
+  for (const [id, key] of trustedHostKeys) {
+    if (!/^[a-f0-9]{64}$/.test(id) || !decodeKey(key)) throw new Error('invalid relay trusted host key entry');
+  }
+  const rooms = new Map<string, Room>();
+  const sockets = new Set<Socket>();
+  const roomFor = (id: string): Room => {
+    let room = rooms.get(id);
+    if (!room) { room = { clients: new Map(), nextId: 1, bytes: 0, failures: {} }; rooms.set(id, room); }
+    return room;
+  };
+  const fail = (room: Room, reason: string) => { room.failures[reason] = (room.failures[reason] ?? 0) + 1; };
+  const sendControl = (ws: Socket, value: object) => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(value)); };
+  const drop = (ws: Socket) => {
+    const data = ws.data;
+    if (data.authTimer) clearTimeout(data.authTimer);
+    sockets.delete(ws);
+    const room = rooms.get(data.serverId);
+    if (!room) return;
+    if (!data.authenticated) {
+      if (!room.host && room.clients.size === 0 &&
+          !Array.from(sockets).some(peer => peer.data.serverId === data.serverId)) rooms.delete(data.serverId);
+      return;
+    }
+    if (data.role === 'host' && room.host === ws) {
+      room.host = undefined;
+      const clients = [...room.clients.values()];
+      room.clients.clear();
+      for (const client of clients) client.close(1012, 'host disconnected');
+    } else if (data.role === 'client' && data.clientId !== undefined && room.clients.get(data.clientId) === ws) {
+      room.clients.delete(data.clientId);
+      if (room.host) sendControl(room.host, { type: 'client-disconnected', clientId: data.clientId });
+    }
+    if (!room.host && room.clients.size === 0 &&
+        !Array.from(sockets).some(peer => peer.data.serverId === data.serverId)) rooms.delete(data.serverId);
+  };
+  const capacity = (ws: Socket, length: number): boolean => {
+    const data = ws.data;
+    const now = Date.now();
+    data.tokens = Math.min(BURST_BYTES, data.tokens + (now - data.refillAt) * BYTES_PER_SECOND / 1000);
+    data.refillAt = now;
+    if (length > data.tokens) return false;
+    data.tokens -= length;
+    return true;
+  };
+  const server = Bun.serve<SocketData>({
+    hostname: options.hostname ?? '127.0.0.1', port: options.port ?? 0,
+    fetch(req, server) {
+      const url = new URL(req.url);
+      if (url.pathname !== '/host' && url.pathname !== '/client') return new Response('not found', { status: 404 });
+      const serverId = url.searchParams.get('serverId');
+      if (!serverId || !/^[a-f0-9]{64}$/.test(serverId)) return new Response('invalid serverId', { status: 400 });
+      if (!trustedHostKeys.has(serverId)) return new Response('unknown serverId', { status: 403 });
+      if (req.headers.get('upgrade')?.toLowerCase() !== 'websocket') return new Response('upgrade required', { status: 426 });
+      const role = url.pathname === '/host' ? 'host' : 'client';
+      const now = Date.now();
+      if (!server.upgrade(req, { data: { role, serverId, authenticated: false, lastSeen: now, tokens: BURST_BYTES, refillAt: now } })) {
+        return new Response('upgrade required', { status: 426 });
+      }
+      return undefined;
+    },
+    websocket: {
+      maxPayloadLength: MAX_FRAME_BYTES + 4,
+      open(ws) {
+        sockets.add(ws);
+        const data = ws.data;
+        const room = roomFor(data.serverId);
+        if (data.role === 'host') {
+          if (room.host) { fail(room, 'duplicate-host'); ws.close(1008, 'host already connected'); return; }
+          data.challenge = randomBytes(32).toString('base64url');
+          sendControl(ws, { type: 'challenge', nonce: data.challenge });
+        } else {
+          if (!room.host || room.clients.size >= MAX_CLIENTS_PER_SERVER) {
+            fail(room, !room.host ? 'host-offline' : 'client-limit');
+            ws.close(1008, !room.host ? 'host offline' : 'client limit reached');
+            return;
+          }
+          const id = room.nextId++;
+          data.clientId = id;
+          data.authenticated = true;
+          room.clients.set(id, ws);
+          sendControl(ws, { type: 'connected', clientId: id });
+          sendControl(room.host, { type: 'client-connected', clientId: id });
+        }
+        if (!data.authenticated) data.authTimer = setTimeout(() => ws.close(1008, 'authentication timeout'), AUTH_TIMEOUT_MS);
+      },
+      message(ws, message) {
+        const data = ws.data;
+        const room = rooms.get(data.serverId);
+        if (!room) { ws.close(1008, 'room missing'); return; }
+        data.lastSeen = Date.now();
+        if (!data.authenticated) {
+          if (data.role !== 'host' || typeof message !== 'string') { fail(room, 'invalid-auth'); ws.close(1008, 'authentication required'); return; }
+          let auth: unknown;
+          try { auth = JSON.parse(message); } catch { /* reject below */ }
+          const value = auth as { type?: unknown; publicKey?: unknown; signature?: unknown } | undefined;
+          const key = typeof value?.publicKey === 'string' ? decodeKey(value.publicKey) : undefined;
+          const signature = typeof value?.signature === 'string' && /^[A-Za-z0-9_-]{86}$/.test(value.signature)
+            ? Buffer.from(value.signature, 'base64url') : undefined;
+          const expected = trustedHostKeys.get(data.serverId);
+          let valid = false;
+          if (value?.type === 'auth' && key && signature?.length === 64 && data.challenge &&
+              value.publicKey === expected) {
+            try {
+              valid = verify(null, challengeMessage(data.serverId, data.challenge),
+                createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, key]), format: 'der', type: 'spki' }), signature);
+            } catch { /* invalid public key */ }
+          }
+          if (!valid || (room.host && room.host !== ws)) { fail(room, 'invalid-auth'); ws.close(1008, 'invalid host signature'); return; }
+          data.authenticated = true;
+          data.challenge = undefined;
+          if (data.authTimer) clearTimeout(data.authTimer);
+          room.host = ws;
+          sendControl(ws, { type: 'authenticated' });
+          return;
+        }
+        if (typeof message === 'string') { fail(room, 'plaintext-data'); ws.close(1003, 'binary ciphertext required'); return; }
+        const bytes = new Uint8Array(message);
+        if (bytes.length > MAX_FRAME_BYTES + (data.role === 'host' ? 4 : 0) || bytes.length < (data.role === 'host' ? 5 : 1)) {
+          fail(room, 'invalid-frame'); ws.close(1009, 'invalid frame size'); return;
+        }
+        if (!capacity(ws, bytes.length)) { fail(room, 'rate-limit'); ws.close(1008, 'rate limit exceeded'); return; }
+        if (data.role === 'client') {
+          if (!room.host || data.clientId === undefined) { ws.close(1012, 'host offline'); return; }
+          room.bytes += bytes.length;
+          room.host.send(encodeClientId(data.clientId, bytes));
+        } else {
+          if (room.host !== ws) { ws.close(1008, 'host replaced'); return; }
+          const clientId = new DataView(bytes.buffer, bytes.byteOffset, 4).getUint32(0, false);
+          const client = room.clients.get(clientId);
+          if (!client) { fail(room, 'unknown-client'); return; }
+          room.bytes += bytes.length - 4;
+          client.send(bytes.subarray(4));
+        }
+      },
+      pong(ws) { ws.data.lastSeen = Date.now(); },
+      close(ws) { drop(ws); },
+    },
+  });
+  const heartbeat = setInterval(() => {
+    for (const ws of sockets) {
+      if (Date.now() - ws.data.lastSeen > DEAD_PEER_MS) ws.close(1001, 'heartbeat timeout');
+      else ws.ping();
+    }
+  }, PING_INTERVAL_MS);
+  heartbeat.unref();
+  return {
+    server,
+    get port() { return server.port; },
+    stats(serverId: string) {
+      const room = rooms.get(serverId);
+      return room ? { host: !!room.host, clients: room.clients.size, bytes: room.bytes, failures: { ...room.failures } } :
+        { host: false, clients: 0, bytes: 0, failures: {} as Record<string, number> };
+    },
+    stop() {
+      clearInterval(heartbeat);
+      for (const ws of sockets) ws.close(1001, 'relay stopping');
+      server.stop(true);
+    },
+  };
+}

package/src/release-loop/checklist.ts

@@ -4,9 +4,12 @@ import { dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { debug } from '../debug/log.js';
 import { releaseLedgerRoot } from '../instance/resolve.js';
+import { CliUserError } from '../cli/cli-user-error.js';
 
 export type ChecklistStatus = 'green' | 'yellow' | 'red' | 'done';
 export type ChecklistDisposition = 'move' | 'known-issue' | 'block';
+/** `screen` = a five-surface feature cell — its evidence carries a `짝:` line (MANUAL-five-surface-parity §A). */
+export type ChecklistKind = 'screen';
 export interface ChecklistItem {
   id: string;
   title: string;
@@ -14,6 +17,7 @@ export interface ChecklistItem {
   owner?: string;
   evidence?: string;
   disposition?: ChecklistDisposition;
+  kind?: ChecklistKind;
   updatedAt: string;
   updatedBy: string;
 }
@@ -54,7 +58,7 @@ function releasedVersion(): string {
 }
 
 function pathFor(v: string): string {
-  if (!/^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/.test(v)) throw new Error(`체크리스트 판이 아니다: ${v}`);
+  if (!/^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/.test(v)) throw new CliUserError(`체크리스트 판이 아니다: ${v}`);
   return join(releaseLedgerRoot(), 'release', v, 'checklist.json');
 }
 
@@ -109,27 +113,29 @@ function change(data: Checklist, id: string, field: string, from: unknown, to: u
 
 function refresh(data: Checklist): void { data.released = releasedVersion(); data.dev = devVersion(); }
 
-export function addItem(v: string, input: { id: string; title: string; owner?: string }): Checklist {
-  if (!input.id.trim()) throw new Error('칸 id 가 비었다');
-  if (!input.title.trim()) throw new Error('칸 제목이 비었다');
+export function addItem(v: string, input: { id: string; title: string; owner?: string; kind?: ChecklistKind }): Checklist {
+  if (!input.id.trim()) throw new CliUserError('칸 id 가 비었다');
+  if (!input.title.trim()) throw new CliUserError('칸 제목이 비었다');
+  if (input.kind !== undefined && input.kind !== 'screen') throw new CliUserError(`잘못된 종류: ${input.kind}`, 'screen');
   return mutate(v, (data) => {
-    if (data.items.some((item) => item.id === input.id)) throw new Error(`이미 있는 칸: ${input.id}`);
+    if (data.items.some((item) => item.id === input.id)) throw new CliUserError(`이미 있는 칸: ${input.id}`, 'set <id> 로 고친다');
     const by = process.env.ELANOUS_TRACK || 'cli';
     const at = new Date().toISOString();
-    const item: ChecklistItem = { id: input.id, title: input.title, status: 'yellow', ...(input.owner !== undefined ? { owner: input.owner } : {}), updatedAt: at, updatedBy: by };
+    const item: ChecklistItem = { id: input.id, title: input.title, status: 'yellow', ...(input.owner !== undefined ? { owner: input.owner } : {}), ...(input.kind !== undefined ? { kind: input.kind } : {}), updatedAt: at, updatedBy: by };
     data.items.push(item);
     change(data, item.id, 'add', null, item, by, at);
     return true;
   });
 }
 
-export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string; disposition?: ChecklistDisposition }, by: string): Checklist {
+export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string; disposition?: ChecklistDisposition; kind?: ChecklistKind }, by: string): Checklist {
   return mutate(v, (data) => {
     const item = data.items.find((i) => i.id === id);
-    if (!item) throw new Error(`없는 칸: ${id}`);
-    if (patch.status !== undefined && !['green', 'yellow', 'red', 'done'].includes(patch.status)) throw new Error(`잘못된 상태: ${patch.status}`);
-    if (patch.disposition !== undefined && !['move', 'known-issue', 'block'].includes(patch.disposition)) throw new Error(`잘못된 처분: ${patch.disposition}`);
-    const fields = (['evidence', 'owner', 'status', 'disposition'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
+    if (!item) throw new CliUserError(`없는 칸: ${id}`, 'list 로 칸 목록을 본다');
+    if (patch.status !== undefined && !['green', 'yellow', 'red', 'done'].includes(patch.status)) throw new CliUserError(`잘못된 상태: ${patch.status}`);
+    if (patch.disposition !== undefined && !['move', 'known-issue', 'block'].includes(patch.disposition)) throw new CliUserError(`잘못된 처분: ${patch.disposition}`);
+    if (patch.kind !== undefined && patch.kind !== 'screen') throw new CliUserError(`잘못된 종류: ${patch.kind}`, 'screen');
+    const fields = (['evidence', 'owner', 'status', 'disposition', 'kind'] as const).filter((field) => patch[field] !== undefined && patch[field] !== item[field]);
     if (fields.length === 0) return false;
     const at = new Date().toISOString();
     for (const field of fields) {
@@ -147,7 +153,7 @@ export function setItem(v: string, id: string, patch: { status?: ChecklistStatus
 export function removeItem(v: string, id: string, by: string): Checklist {
   return mutate(v, (data) => {
     const index = data.items.findIndex((i) => i.id === id);
-    if (index < 0) throw new Error(`없는 칸: ${id}`);
+    if (index < 0) throw new CliUserError(`없는 칸: ${id}`, 'list 로 칸 목록을 본다');
     const at = new Date().toISOString();
     const [item] = data.items.splice(index, 1);
     change(data, id, 'remove', item, null, by, at);
@@ -179,11 +185,29 @@ export interface ChecklistGate {
   blocked: string[];
   moved: string[];
   knownIssues: Array<{ id: string; title: string; evidence: string }>;
+  /** Screen cells whose `짝:` line is missing or has an untracked ⏳ — a warning; it never changes `ok`. */
+  parity?: Array<{ id: string; why: string }>;
+}
+
+const PARITY_LINE = /짝:\s*PWA\s*(.+?)\s*·\s*데스크톱\s*(.+?)\s*·\s*폴드\s*(.+?)\s*·\s*아이폰\s*(.+?)\s*·\s*아이패드\s*(.+?)\s*$/m;
+const PARITY_SURFACES = ['PWA', '데스크톱', '폴드', '아이폰', '아이패드'] as const;
+
+/** Why a screen cell's evidence fails the five-surface rule, or null when it passes. */
+export function parityGap(evidence: string | undefined): string | null {
+  if (!evidence || !/짝:/.test(evidence)) return '근거에 짝: 줄이 없다';
+  const match = PARITY_LINE.exec(evidence);
+  if (!match) return '짝: 줄에 다섯 열(PWA · 데스크톱 · 폴드 · 아이폰 · 아이패드)이 다 없다';
+  const untracked = PARITY_SURFACES.filter((_, i) => match[i + 1]!.includes('⏳') && !/\(칸 /.test(match[i + 1]!));
+  return untracked.length ? `⏳ 에 (칸 …) 번호가 없다: ${untracked.join(', ')}` : null;
 }
 
 export function checklistGate(v: string): ChecklistGate {
-  const result: ChecklistGate = { ok: true, red: [], undecided: [], blocked: [], moved: [], knownIssues: [] };
+  const result: ChecklistGate = { ok: true, red: [], undecided: [], blocked: [], moved: [], knownIssues: [], parity: [] };
   for (const item of listChecklist(v).items) {
+    if (item.kind === 'screen') {
+      const why = parityGap(item.evidence);
+      if (why) result.parity!.push({ id: item.id, why });
+    }
     if (item.status === 'red') result.red.push(item.id);
     if (item.status !== 'yellow') continue;
     if (item.disposition === 'block') result.blocked.push(item.id);

package/src/self-dev/decompose.ts

@@ -341,6 +341,7 @@ export function buildSelfDevDecomposePrompt(feature: string, maxTasks = DEFAULT_
     '## Rules',
     `- Emit at most ${maxTasks} sub-features. Fewer is better — do NOT over-split, except when a sub-feature mixes ${SELF_DEV_CONCERN_SPLIT_THRESHOLD} or more concern classes — ${SELF_DEV_CONCERN_CLASSES.join(' / ')} — split it into sibling sub-features.`,
     '- SEPARATE DEFINE FROM WIRE: adding a new function/type/export is a SEPARATE task from wiring it into an existing runtime call site. A task that both defines a new symbol AND integrates it across modules tends to leave dead-code (defined but never called) that fails integration gates. Pattern: (a) add the function + its unit test; then (b) a dependent task that wires it into the specific existing call site — name the exact `file.ts:function` to modify.',
+    '- Exception to SEPARATE DEFINE FROM WIRE: Keep a definition and its registration/wiring in the same sub-feature — a handler with its route, a command with its CLI registration, a node with its graph/recipe entry.',
     '- Each sub-feature must be a self-contained, mergeable unit of work.',
     '- `dependsOn`: list the `id`s of sub-features that MUST land first (e.g. a shared',
     '  type/interface before its consumers). Independent sub-features share NO dependency',

package/src/self-dev/dev-pipeline.ts

@@ -1871,7 +1871,10 @@ async function runDevPipelineDispatch(
   observeDevSelection('completion', plan.completion, plan.completionSource, plan.completionSource === 'request' ? spec.completion : undefined, entryRoute, spec.runId, plan.entrance, plan.entranceUnstamped);
   observeDevSelection('autoReview', plan.autoReview, plan.autoReviewSource, plan.autoReviewSource === 'request' ? spec.autoReview : undefined, entryRoute, spec.runId, plan.entrance, plan.entranceUnstamped);
   assertDispatchHonorsOptions(plan); // 미이행 옵션 거부(수락 후 무시 금지)
-  emitHumanProgress(completionAnnouncement(plan.completion), spec.humanReadableOutput !== false, deps.progress);
+  // CHAT1 — a plain chat turn (`interactive`) is not a dev run: its completion/base lines are noise to a person.
+  //   The selection is still observed above; only the human-facing lines are dev-run-only.
+  const devRunLines = plan.dispatch !== 'interactive';
+  if (devRunLines) emitHumanProgress(completionAnnouncement(plan.completion), spec.humanReadableOutput !== false, deps.progress);
   if (spec.notice) emitHumanProgress(spec.notice, spec.humanReadableOutput !== false, deps.progress);
 
   if (plan.dispatch === 'parallel') {
@@ -1899,8 +1902,8 @@ async function runDevPipelineDispatch(
     rule: plan.baseSelection?.rule ?? 'unspecified',
     evidence: plan.baseSelection?.evidence ?? 'not applicable',
   });
-  emitHumanProgress(formatDevBaseSelectionAnnouncement(plan), spec.humanReadableOutput !== false, deps.progress);
-  const nonDefaultBaseWarning = formatDevNonDefaultBaseWarning(plan);
+  if (devRunLines) emitHumanProgress(formatDevBaseSelectionAnnouncement(plan), spec.humanReadableOutput !== false, deps.progress);
+  const nonDefaultBaseWarning = devRunLines ? formatDevNonDefaultBaseWarning(plan) : undefined;
   if (nonDefaultBaseWarning) {
     emitHumanProgress(nonDefaultBaseWarning, spec.humanReadableOutput !== false, deps.progress);
   }

package/src/self-dev/orchestrate.ts

@@ -987,6 +987,23 @@ async function deleteLabelledJobs(runId: string, selectedTargets: readonly { con
   return counts.reduce((sum, count) => sum + count, 0);
 }
 
+/** `self-dev-runs/<runId>/pid.json` — what `harness stop <runId>` reads (start time guards PID reuse).
+ *  HS1: written as soon as the run ID exists, not only when the jobs start — pod planning and image sync can
+ *  take minutes before that, and a stop in that window found «no process» (10-01 · three runs). */
+export function writeRunPidRecord(runId: string, runsDir: string = selfDevRunsDir()): string {
+  const pidPath = join(runsDir, runId, 'pid.json');
+  mkdirSync(join(runsDir, runId), { recursive: true });
+  const temporary = `${pidPath}.${process.pid}.${randomUUID()}.tmp`;
+  const fd = openSync(temporary, 'wx', 0o600);
+  try {
+    try {
+      writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: Date.now() - Math.floor(process.uptime() * 1000), argv0: process.argv0 }));
+    } finally { closeSync(fd); }
+    renameSync(temporary, pidPath);
+  } catch (error) { unlinkSync(temporary); throw error; }
+  return pidPath;
+}
+
 /**
  * Run N self-dev jobs in parallel under the TOX dispatcher and resolve
  * once every job reaches a terminal status.
@@ -1419,17 +1436,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
     signals.on('SIGTERM', onTerm);
     signals.on('SIGINT', onInt);
     try {
-      if (pidPath) {
-        mkdirSync(join(opts.runsDir ?? selfDevRunsDir(), runId!), { recursive: true });
-        const temporary = `${pidPath}.${process.pid}.${randomUUID()}.tmp`;
-        const fd = openSync(temporary, 'wx', 0o600);
-        try {
-          try {
-            writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: Date.now() - Math.floor(process.uptime() * 1000), argv0: process.argv0 }));
-          } finally { closeSync(fd); }
-          renameSync(temporary, pidPath);
-        } catch (error) { unlinkSync(temporary); throw error; }
-      }
+      if (pidPath) writeRunPidRecord(runId!, opts.runsDir ?? selfDevRunsDir());
     } catch (error) { cleanup(); reject(error); return; }
 
     // Current full result set: resumed-done goals + each running task's

package/src/self-dev/run-record-mirror.ts

@@ -0,0 +1,44 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+import type { SelfDevRunState } from './run-store.js';
+
+export function mirrorDir(): string {
+  return join(releaseLedgerRoot(), 'self-dev-runs');
+}
+
+function mirrorPath(runId: string, dir: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(runId)) throw new Error(`invalid self-dev run ID: ${runId}`);
+  return join(dir, `${runId}.json`);
+}
+
+/** Best-effort atomic copy in the machine ledger; never disrupts the primary checkpoint. */
+export function mirrorRunRecord(state: SelfDevRunState, primaryDir: string): void {
+  let temp: string | undefined;
+  try {
+    const dir = mirrorDir();
+    if (resolve(primaryDir) === resolve(dir)) return;
+    const path = mirrorPath(state.runId, dir);
+    mkdirSync(dir, { recursive: true });
+    temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temp, JSON.stringify(state, null, 2), { mode: 0o600 });
+    renameSync(temp, path);
+  } catch (error) {
+    if (temp) { try { unlinkSync(temp); } catch { /* no temporary file to remove */ } }
+    try { debug.log('self-dev.run-store', 'mirror-failed', { runId: state.runId, reason: String(error) }); } catch { /* keep the primary save fail-soft */ }
+  }
+}
+
+export function loadMirroredRunRecord(runId: string): SelfDevRunState | null {
+  try {
+    const record = JSON.parse(readFileSync(mirrorPath(runId, mirrorDir()), 'utf8')) as SelfDevRunState | null;
+    return record && record.runId === runId
+      && typeof record.createdAt === 'number' && Number.isFinite(record.createdAt)
+      && typeof record.updatedAt === 'number' && Number.isFinite(record.updatedAt)
+      && Array.isArray(record.results) ? record : null;
+  } catch {
+    return null;
+  }
+}

package/src/self-dev/run-store.ts

@@ -27,6 +27,7 @@ import type { RunIdSource } from '../harness/harness-space.js';
 import { withFileLockSync } from '../storage/file-lock.js';
 import type { SelfDevJobResult, SelfDevGoal } from './orchestrate.js';
 import type { SupervisorStopReason } from './run-supervisor.js';
+import { loadMirroredRunRecord, mirrorRunRecord } from './run-record-mirror.js';
 
 export interface SelfDevRunParticipant {
   id: string;
@@ -151,18 +152,26 @@ export function saveSelfDevRun(state: SelfDevRunState, dir = selfDevRunsDir()):
     withFileLockSync(join(dir, `${state.runId}.lock`), () => {
       const current = loadSelfDevRunFromPath(runPath(state.runId, dir));
       const participants = mergeParticipants(current?.participants, state.participants);
-      writeSelfDevRun({
+      const saved = {
         ...state,
         ...(participants === undefined ? {} : { participants }),
         ...(current?.parkedResolution && !state.parkedResolution ? { parkedResolution: current.parkedResolution } : {}),
-      }, dir);
+      };
+      writeSelfDevRun(saved, dir);
+      mirrorRunRecord(saved, dir);
     });
   } catch { /* fail-soft — a lost checkpoint just means no resume, not a crash */ }
 }
 
 /** Load a run checkpoint by id, or null if absent/corrupt. */
 export function loadSelfDevRun(runId: string, dir = selfDevRunsDir()): SelfDevRunState | null {
-  return loadSelfDevRunFromPath(runPath(runId, dir));
+  const primary = loadSelfDevRunFromPath(runPath(runId, dir));
+  if (primary) return primary;
+  const mirrored = loadMirroredRunRecord(runId);
+  if (mirrored) {
+    try { debug.log('self-dev.run-store', 'read-from-mirror', { runId }); } catch { /* preserve fail-soft reads */ }
+  }
+  return mirrored;
 }
 
 /** Add one participant without losing registrations made by another caller for this run. */

package/src/self-implement/harness-policy-gates.ts

@@ -4,8 +4,9 @@ import { runIsolationHardcodeGate } from '../../scripts/ci-isolation-hardcode-ga
 import { runMockModuleRestoreGate } from '../../scripts/ci-mock-module-restore-gate.js';
 import { runModelHardcodeGate } from '../../scripts/ci-model-hardcode-gate.js';
 import { runDaemonPortGate } from '../../scripts/ci-daemon-port-gate.js';
+import { runPublicExportLeakGate } from '../../scripts/ci-public-export-leak-gate.js';
 
-type GateName = 'isolation-gate' | 'mock-module-restore-gate' | 'model-hardcode-gate' | 'daemon-port-gate';
+type GateName = 'isolation-gate' | 'mock-module-restore-gate' | 'model-hardcode-gate' | 'daemon-port-gate' | 'public-export-leak';
 type GateOutput = { args: string[]; cwd: string; log: (line: string) => void; error: (line: string) => void };
 type GateRunner = (out: GateOutput) => number;
 
@@ -27,6 +28,8 @@ export function runHarnessPolicyGates(input: {
     ['mock-module-restore-gate', input.gates?.['mock-module-restore-gate'] ?? runMockModuleRestoreGate],
     ['model-hardcode-gate', input.gates?.['model-hardcode-gate'] ?? runModelHardcodeGate],
     ['daemon-port-gate', input.gates?.['daemon-port-gate'] ?? ((out) => runDaemonPortGate({ log: out.log, error: out.error, cwd: out.cwd, args: [] }))],
+    // LEAK1 — the check release prepare fails on, before the harness lands (0.2.7: a mark in a test title).
+    ['public-export-leak', input.gates?.['public-export-leak'] ?? runPublicExportLeakGate],
   ];
   const failures: Array<{ gate: GateName; lines: string[] }> = [];
   for (const [gate, run] of runners) {

package/src/self-implement/report-origin.ts

@@ -2,12 +2,23 @@ import type { MissionOrigin } from '../autopilot/mission-origin.js';
 
 export const REPORT_ORIGIN_ENV = 'ELANOUS_REPORT_ORIGIN';
 
-const CHANNELS = new Set<MissionOrigin['channel']>(['telegram', 'pwa', 'voice', 'cli', 'api', 'tui']);
+const CHANNELS = new Set<MissionOrigin['channel']>(['telegram', 'pwa', 'voice', 'cli', 'api', 'tui', 'discord']);
+const SNOWFLAKE = /^\d{1,20}$/;
 
 function isReportOrigin(value: unknown): value is MissionOrigin {
   if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
   const origin = value as Record<string, unknown>;
   if (!CHANNELS.has(origin.channel as MissionOrigin['channel'])) return false;
+  // Discord carries its own reply target (channel ⊕ optional thread snowflakes) — same shape as MissionOrigin.
+  if (origin.channel === 'discord') {
+    for (const key of Object.keys(origin)) {
+      if (!['channel', 'channelId', 'discordThreadId', 'botId', 'hitlMessageId'].includes(key)) return false;
+    }
+    return typeof origin.channelId === 'string' && SNOWFLAKE.test(origin.channelId)
+      && (origin.discordThreadId === undefined || (typeof origin.discordThreadId === 'string' && SNOWFLAKE.test(origin.discordThreadId)))
+      && (origin.botId === undefined || (typeof origin.botId === 'string' && origin.botId.length > 0))
+      && (origin.hitlMessageId === undefined || Number.isSafeInteger(origin.hitlMessageId));
+  }
   if (origin.channel === 'telegram' && (!Number.isSafeInteger(origin.chatId) || origin.chatId === 0)) return false;
   for (const key of Object.keys(origin)) {
     if (!['channel', 'chatId', 'botId', 'threadId', 'hitlMessageId'].includes(key)) return false;

package/src/session/chat.ts

@@ -30,6 +30,7 @@ import {
 import { buildMemoryInjection, buildMemoryInjectionLLM } from '../memory.js';
 import { getUserConfig } from '../user-config.js';
 import { budgetModel } from '../llm/model-defaults.js';
+import { explicitTurnTier } from '../model-tier/turn-tier.js';
 import { recordTurn } from '../status/metrics.js';
 import {
   buildTerminalCapableTurn,
@@ -375,7 +376,18 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     return trimToBudget(wire, opts.maxTokens ?? DEFAULT_TOKEN_BUDGET);
   };
 
-  const provider = opts.provider ?? getProviderForConfig(opts.userConfig, opts.llmOpts?.model);
+  const explicitTier = opts.llmOpts?.model ? undefined : explicitTurnTier(opts.userConfig, opts.sessionId);
+  const llmOpts = explicitTier ? {
+    ...(opts.llmOpts ?? {}), model: explicitTier.model,
+    ...(explicitTier.reasoningEffort && !opts.llmOpts?.reasoningEffort ? { reasoningEffort: explicitTier.reasoningEffort } : {}),
+  } : opts.llmOpts;
+  if (explicitTier) {
+    debug.log('llm.tier', 'turn-tier-applied', {
+      sessionId: opts.sessionId, tier: explicitTier.tier, source: explicitTier.source, model: explicitTier.model,
+      reasoningEffort: llmOpts?.reasoningEffort ?? null,
+    });
+  }
+  const provider = opts.provider ?? getProviderForConfig(opts.userConfig, llmOpts?.model);
   let kept: LLMMessage[] = [];
   let dropped = 0;
   let used = 0;
@@ -394,7 +406,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
       specs: opts.tools,
       dispatch: rawDispatchTool,
       systemPromptParts: effectiveSystemPrompt ? [effectiveSystemPrompt] : [],
-      ...(opts.llmOpts ? { llmOpts: opts.llmOpts } : {}),
+      ...(llmOpts ? { llmOpts } : {}),
     };
     const terminal = hasPtyShellTool
       ? isTerminalCapableTurn(terminalBase)
@@ -409,7 +421,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     if (terminal) {
       effectiveSystemPrompt = terminal.systemPromptParts.join('\n\n');
     }
-    const turnLlmOpts = terminal ? terminal.llmOpts : opts.llmOpts;
+    const turnLlmOpts = terminal ? terminal.llmOpts : llmOpts;
     ({ kept, dropped, used } = assembleTurnMessages(effectiveSystemPrompt));
     // Durable tool telemetry (추적성) — pair each call's args (onToolCall) with its
     // result (onToolResult) and persist a role:'tool' message so later "어떤 도구
@@ -477,7 +489,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     }
   } else {
     ({ kept, dropped, used } = assembleTurnMessages(effectiveSystemPrompt));
-    const plainOpts = opts.signal ? { ...(opts.llmOpts ?? {}), signal: opts.signal } : (opts.llmOpts ?? {});
+    const plainOpts = opts.signal ? { ...(llmOpts ?? {}), signal: opts.signal } : (llmOpts ?? {});
     const stream = provider.streamChat
       ? provider.streamChat(kept, plainOpts)
       : wrapTextOnly(provider.chat(kept, plainOpts));
@@ -529,7 +541,7 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
   // status bar (CTX bar · $ · 🚀) reflects the latest numbers. Uses
   // rough estimates — providers that expose real `usage` fields can
   // override via opts.llmOpts in a later phase.
-  const resolvedModel = opts.llmOpts?.model ?? provider.defaultModel;
+  const resolvedModel = llmOpts?.model ?? provider.defaultModel;
   recordTurn({
     model: resolvedModel,
     estimatedPromptText: [...messages, userMsg].map(m =>