elanous 0.2.9 → 0.2.11

package/src/self-implement/route-consumer-test-index.ts

@@ -0,0 +1,122 @@
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'node:path/posix';
+import ts from 'typescript';
+import { isTestPath } from './importer-test-index.js';
+
+export interface RouteConsumerTestIndex {
+  readonly testsBySource: ReadonlyMap<string, readonly string[]>;
+  /** Base routes could not be inspected for these sources; an empty match is not evidence of no consumers. */
+  readonly lookupFailures: readonly { readonly source: string; readonly reason: string }[];
+}
+
+const ROUTE_RE = /^\/(?:v\d+|api)\/[^\s]+$/;
+
+function dynamicRoutePattern(route: string): RegExp | null {
+  const segments = route.split('/').slice(1);
+  if (!segments.some((segment) => segment.startsWith(':') || segment === '*')) return null;
+  const pattern = segments.map((segment) => {
+    if (segment === '*') return '.*';
+    if (/^:[\w]+$/.test(segment)) return '[^/?#]+';
+    return segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  }).join('/');
+  return new RegExp(`^/${pattern}(?:[?#].*)?$`);
+}
+
+function testStringValues(text: string, path: string): string[] {
+  const ast = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, false);
+  const values: string[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isStringLiteralLike(node)) values.push(node.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(ast);
+  return values;
+}
+
+/** Index paths in both the current and comparison-base server source, so removing a route still selects its consumers. */
+export function buildRouteConsumerTestIndex(
+  cwd: string,
+  testPaths: readonly string[],
+  changedSources: readonly string[],
+  baseRef = 'HEAD',
+  readBase: (source: string) => { text: string } | { absent: true } | { lookupFailed: string } = (source) => {
+    const options = { cwd, encoding: 'utf8' as const, timeout: 20_000, maxBuffer: 8 * 1024 * 1024 };
+    const result = spawnSync('git', ['show', `${baseRef}:${source}`], options);
+    if (result.status === 0 && !result.error) return { text: result.stdout };
+    const tree = spawnSync('git', ['ls-tree', '--name-only', baseRef, '--', source], options);
+    if (tree.status === 0 && !tree.error && !tree.stdout.trim()) return { absent: true };
+    return { lookupFailed: (result.stderr || result.error?.message || tree.stderr || tree.error?.message || 'git show failed').trim() };
+  },
+  /** Lines added/removed in the diff for `source`; null = diff unavailable (then every route in the file counts). */
+  changedLines: (source: string) => string[] | null = (source) => {
+    const r = spawnSync('git', ['diff', '-U0', baseRef, '--', source], { cwd, encoding: 'utf8' as const, timeout: 20_000, maxBuffer: 8 * 1024 * 1024 });
+    if (r.status !== 0 || r.error) return null;
+    // `git diff` omits untracked files — a new, not-yet-added server file is all new lines (every route counts).
+    if (!r.stdout.trim() && spawnSync('git', ['ls-files', '--error-unmatch', '--', source], { cwd, encoding: 'utf8' as const, timeout: 20_000, maxBuffer: 8 * 1024 * 1024 }).status !== 0) return null;
+    return r.stdout.split('\n').filter((line) => /^[+-](?![+-]{2})/.test(line)).map((line) => line.slice(1));
+  },
+): RouteConsumerTestIndex {
+  const routesBySource = new Map<string, string[]>();
+  const lookupFailures: { source: string; reason: string }[] = [];
+  for (const source of changedSources) {
+    if (!source.startsWith('src/') || isTestPath(source) || !/\.[cm]?[jt]sx?$/.test(source)) continue;
+    const routes = new Set<string>();
+    const collect = (text: string): void => {
+      const ast = ts.createSourceFile(source, text, ts.ScriptTarget.Latest, false);
+      const visit = (node: ts.Node): void => {
+        if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)
+          && /^(get|post|put|patch|delete|route|register)$/.test(node.expression.name.text)) {
+          const path = node.arguments[0];
+          if (path && ts.isStringLiteralLike(path) && ROUTE_RE.test(path.text)) routes.add(path.text);
+        }
+        if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken
+          && /(?:pathname|path)$/.test(node.left.getText(ast)) && ts.isStringLiteralLike(node.right)
+          && ROUTE_RE.test(node.right.text)) routes.add(node.right.text);
+        if (ts.isVariableDeclaration(node) && /(?:PATH|ROUTE)$/.test(node.name.getText(ast))
+          && node.initializer && ts.isStringLiteralLike(node.initializer)
+          && ROUTE_RE.test(node.initializer.text)) routes.add(node.initializer.text);
+        if (ts.isCaseClause(node) && ts.isStringLiteralLike(node.expression)
+          && ROUTE_RE.test(node.expression.text)) routes.add(node.expression.text);
+        if (ts.isPropertyAssignment(node) && /^(path|route)$/.test(node.name.getText(ast))
+          && ts.isStringLiteralLike(node.initializer) && ROUTE_RE.test(node.initializer.text)) routes.add(node.initializer.text);
+        ts.forEachChild(node, visit);
+      };
+      visit(ast);
+    };
+    try { collect(readFileSync(resolve(cwd, source), 'utf8')); } catch { /* Deleted source: base may still contain registered routes. */ }
+    try {
+      const previous = readBase(source);
+      if ('text' in previous) collect(previous.text);
+      else if ('lookupFailed' in previous) lookupFailures.push({ source, reason: previous.lookupFailed });
+    } catch (error) {
+      lookupFailures.push({ source, reason: error instanceof Error ? error.message : String(error) });
+    }
+    // A hub server file registers every route; only routes on lines the diff touched select consumers (TC review:
+    // http-server.ts alone matched 279 tests and the cap kept the alphabetically first 30). New/deleted files keep all routes.
+    const touched = changedLines(source);
+    const selected = touched === null ? [...routes] : [...routes].filter((route) => touched.some((line) => line.includes(route)));
+    if (selected.length) routesBySource.set(source, selected);
+  }
+  const testsBySource = new Map<string, string[]>();
+  if (routesBySource.size === 0) return { testsBySource, lookupFailures };
+  for (const test of testPaths) {
+    if (!isTestPath(test)) continue;
+    let text: string;
+    try { text = readFileSync(resolve(cwd, test), 'utf8'); } catch { continue; } // deleted test
+    const literalValues = testStringValues(text, test);
+    for (const [source, routes] of routesBySource) {
+      if (routes.some((route) => {
+        const dynamic = dynamicRoutePattern(route);
+        if (dynamic) return literalValues.some((value) => dynamic.test(value));
+        let at = text.indexOf(route);
+        while (at !== -1) {
+          if (!/[\w/-]/.test(text[at + route.length] ?? '')) return true;
+          at = text.indexOf(route, at + 1);
+        }
+        return false;
+      })) testsBySource.set(source, [...(testsBySource.get(source) ?? []), test]);
+    }
+  }
+  return { testsBySource, lookupFailures };
+}

package/src/self-implement/run-status-mapping.ts

@@ -1,4 +1,4 @@
-export type RunStatus = 'completed' | 'failed' | 'cancelled';
+export type RunStatus = 'completed' | 'failed' | 'cancelled' | 'parked';
 /** ⭐ `crashed` — ***잡히지 않은 예외로 죽어 종결을 스스로 못 적은*** 런 (2026-08-11 · 🅣⊕🅢 어휘 합의).
  *  ⛔ `aborted`(스스로 중단을 «판정»했다)와 다른 값이다 — 이쪽은 «판정할 겨를이 없었다».
  *  📏 왜 생겼나: 실측 미완 57 중 ≈38 이 어느 원장에도 종결이 없었고, 멈춘 자리가 전부 「노드 안」이었다. */
@@ -20,7 +20,8 @@ export type SelfImplementStage =
   | 'aborted'
   | 'timed-out'
   | 'pr-declined'
-  | 'soft-stopped';
+  | 'soft-stopped'
+  | 'parked';
 
 const STAGE_OUTCOMES = {
   merged: { runStatus: 'completed' },
@@ -34,9 +35,10 @@ const STAGE_OUTCOMES = {
   'timed-out': { runStatus: 'failed', failureKind: 'timed-out' },
   'pr-declined': { runStatus: 'cancelled' },
   'soft-stopped': { runStatus: 'cancelled' },
+  parked: { runStatus: 'parked' },
 } satisfies Record<SelfImplementStage, MappedRunOutcome>;
 
-const RUN_STATUSES = new Set<RunStatus>(['completed', 'failed', 'cancelled']);
+const RUN_STATUSES = new Set<RunStatus>(['completed', 'failed', 'cancelled', 'parked']);
 
 /** Runtime guard for the run-status payload produced by observeRunOutcome. */
 export function isRunStatus(value: unknown): value is RunStatus {

package/src/self-implement/seams.ts

@@ -39,6 +39,7 @@ import { writeScopedTypecheckConfig } from './scoped-typecheck-config.js';
 // ⭐ 게이트 스코프 근본 수리(2026-07-26) — 풀 `bun test` 폴백 제거 + 연관 테스트 유도(순수).
 import { resolveGateScope } from './gate-scope.js';
 import { buildImporterTestIndex, isTestPath } from './importer-test-index.js';
+import { buildRouteConsumerTestIndex } from './route-consumer-test-index.js';
 import { countTestDeclarations } from './test-declarations.js';
 import {
   allowsBaselineOnlyFailure,
@@ -75,6 +76,7 @@ import { tscEnv, assessTypecheckExecution, classifyTypecheckErrors, diffTypechec
 import { nestCapReached, childNestEnv, nestInfo } from '../agent/nest-depth.js';
 import { harnessBoundaryEnv, harnessBoundaryRequestsEnv, harnessBoundaryResponsesEnv, harnessSpaceEnv, getHarnessSpace, normalizeSpaceId, getHarnessRunId, resolveRunIdentity } from '../harness/harness-space.js';
 import { debug } from '../debug/log.js';
+import { RELEASE_PATH_HOLD_MARKER, RELEASE_PATH_LABEL, releasePathHoldShouldPost, releasePathHoldCommentsArgs, releasePrFilePaths } from '../self-dev/release-path-guard.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { gateDecision, reviewDecision, mergeDecision } from './decision-events.js';
 import { LogStore } from '../mss/logging/log-store.js';
@@ -85,7 +87,9 @@ import { countReflectFactConflicts, type MustFixRefutation, type ReflectEvidence
 import { isSupervisorDecisionSection, splitGoalSections, supervisorGoalDigest } from './goal-digest.js';
 import type { SupervisionReworkSource } from './supervision-vocabulary.js';
 import type { ReworkBudgetVerdict } from './run-outcome.js';
-import { runHeadlessGoalLoopPty } from './headless-elanous-driver.js';
+import { pickImplementRoleForGoal, runHeadlessGoalLoopPty } from './headless-elanous-driver.js';
+import { childLlmSelectionEnv } from '../agent/run-context.js';
+import { observeExternalEvent } from '../context-bus/external-events.js';
 import { buildLlmHitlRelay, SIDE_EFFECT_RE } from '../harness/llm-hitl-relay.js';
 import { dispatchAskUserQuestion } from '../ask-user-question/tool.js';
 import { parseQuestionRequest } from '../ask-user-question/types.js';
@@ -1641,7 +1645,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       if ((o.ptyAvailable ?? ptyAvailable)()) {
         try {
           const res = await (o.runHeadlessGoalLoopPty ?? runHeadlessGoalLoopPty)({
-            binRoot, cwd, featurePrompt: prompt, maxWaitSec, brain,
+            binRoot, cwd, featurePrompt: prompt, goalDocument: feature, maxWaitSec, brain,
             ...(activityGraceSec !== undefined ? { activityGraceSec, activityGraceSource: 'caller' as const } : {}),
             autoStop: getUserConfig().tools.selfImplement.autoStop,
             autoAssist: getUserConfig().tools.selfImplement.autoAssist,
@@ -1698,9 +1702,14 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       // 폴백 — PTY 불가/cap 초과/에러. 기존 헤드리스 spawnSync 경로 보존(블로킹이지만 견고).
       const args = [`${binRoot}/bin/elanous.mjs`, 'dev', '--implement'];
       const executionId = randomUUID();
+      const fallbackImplementRole = !childLlm && !process.env.ELANOUS_LLM_MODEL?.trim()
+        ? pickImplementRoleForGoal(feature) : undefined;
       if (o.configDir) args.push('--config-dir', o.configDir);
       args.push(prompt);
-      const r = runSpawnSync('bun', args, {
+      const fallbackSource = `elanous://harness/${encodeURIComponent(runId ?? 'unknown')}/${encodeURIComponent(executionId)}`;
+      observeExternalEvent({ origin: 'harness-child', kind: 'started', summary: 'Harness child started (fallback)', source: fallbackSource });
+      let r: ReturnType<typeof runSpawnSync>;
+      try { r = runSpawnSync('bun', args, {
         cwd, encoding: 'utf8', timeout: maxWaitSec * 1000, maxBuffer: 32 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
         ...(executionSignal ? { signal: executionSignal } : {}),   // /cancel 또는 구현 timeout → 자식 SIGTERM(고아 방지)
@@ -1716,6 +1725,9 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           //   ⇒ 실물: 쿼터 신호가 갱신 안 되는 우주를 봐서 전 계정 unknown ⇒ 회전이 100% 계정 선택 ⇒ 429(4회).
           ...(o.stateDir && o.stateDirSource ? { ELANOUS_STATE_DIR_SOURCE: o.stateDirSource } : {}),
           ...childNestEnv(),
+          ...childLlmSelectionEnv(childLlm ?? (fallbackImplementRole
+            ? { provider: fallbackImplementRole.provider, model: fallbackImplementRole.model, source: 'config' }
+            : undefined)),
           ...((): Record<string, string> => {
             const sp = getHarnessSpace() ?? { inHarness: true as const, kind: 'self-implement' as const, id: normalizeSpaceId(basename(cwd)), runId: getHarnessRunId() };
             // ★ K run-identity 공백 방어 — driver 와 동일 계약(호출자 > 상속 > canonical mint). 빈 runId 는
@@ -1727,7 +1739,12 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           ...harnessBoundaryResponsesEnv(executionId),
           ...harnessPolicyEnv(),
         },
-      });
+      }); } catch (error) {
+        observeExternalEvent({ origin: 'harness-child', kind: 'finished', summary: 'Harness child failed (fallback)', source: fallbackSource });
+        throw error;
+      }
+      observeExternalEvent({ origin: 'harness-child', kind: 'finished',
+        summary: `Harness child finished (fallback): ${r.status ?? 'unknown'}`, source: fallbackSource });
       const transcript = `${r.stdout ?? ''}${r.stderr ?? ''}`;
       const errCode = (r.error as { code?: string } | undefined)?.code;
       const timedOut = errCode === 'ETIMEDOUT' || r.signal === 'SIGTERM';
@@ -1807,9 +1824,11 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         trackedFiles.filter(isTestPath),
         [...new Set([...trackedFiles, ...changedAll, ...observationChangedFiles])].filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file)),
       );
+      const routeConsumerTestIndex = buildRouteConsumerTestIndex(cwd, trackedFiles.filter(isTestPath), changedAll, comparisonBase ?? 'HEAD');
       // 워크트리에 없는 변경 경로 = 지운 파일 — 미검증으로 세지 않는다(gate-scope `isDeleted` · 2026-09-26 run-7dd4cce6).
       const isDeleted = (path: string): boolean => !isFile(path);
-      const scope = resolveGateScope(changedAll, isFile, importerTestIndex ?? undefined, postsync ? { mode: 'postsync', isDeleted } : { isDeleted });
+      const scopeOpts = { isDeleted, routeConsumerTestIndex: routeConsumerTestIndex ?? undefined };
+      const scope = resolveGateScope(changedAll, isFile, importerTestIndex ?? undefined, postsync ? { ...scopeOpts, mode: 'postsync' } : scopeOpts);
       const comparisonFailureReason = observationChanges.comparisonBaseStatus === 'unavailable'
         ? 'comparison-base-unavailable'
         : observationChanges.comparisonBaseStatus === 'comparison-failed'
@@ -1817,10 +1836,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           : undefined;
       const unmeasuredPostsync = postsync && !comparisonFailureReason && scope.reason === 'unmeasured';
       const scopeReason = comparisonFailureReason ?? scope.reason;
-      const observationScope = resolveGateScope(observationChangedFiles, isFile, importerTestIndex ?? undefined);
-      const observedChangedTestFiles = observationScope.reason === 'changed-tests'
-        ? (observationScope.testArgs ?? []).filter((file) => !observationScope.pulledInRelatedTests.includes(file))
-        : [];
+      const observedChangedTestFiles = [...new Set(observationChangedFiles.filter((file) => isTestPath(file) && isFile(file)))];
       // This reads the merge-base without executing base tests. Its static declaration count is
       // observational: dynamic generation and renamed helpers can make it incomplete.
       const declarationDecline = testDeclarationDecline(cwd, comparisonBase, observedChangedTestFiles);
@@ -1863,6 +1879,9 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         documentPaths: scope.documentPaths.slice(0, 8), documentPathCount: scope.documentPaths.length,
         documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests.slice(0, 8),
         documentsWithoutDerivedTestCount: scope.documentsWithoutDerivedTests.length,
+        callerTests: scope.callerTests,
+        callerTestsOverflow: scope.callerTestsOverflow,
+        routeBaseLookupFailures: routeConsumerTestIndex.lookupFailures,
         pulledInRelatedTests: scope.pulledInRelatedTests.slice(0, 8),
         pulledInRelatedTestCount: scope.pulledInRelatedTests.length,
         importerTestIndexAvailable: importerTestIndex !== null,
@@ -1871,7 +1890,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         importerTestsNotRunTruncated: scope.importerTestsNotRun?.truncated ?? null,
         unresolvedRelativeImportSpecifiers: scope.importerTestsNotRun?.unresolvedRelativeSpecifiers ?? null,
       // ⚠️ 커버 안 된 변경이 있으면 **테스트가 돌았어도** warn — debug 는 운영 로그에서 필터링된다(리뷰 should-fix).
-      }, { level: scope.reason === 'no-related-tests' || scope.missingTestFiles > 0 || scope.unverified.length > 0 ? 'warn' : 'debug' });
+      }, { level: scope.reason === 'no-related-tests' || scope.missingTestFiles > 0 || scope.unverified.length > 0 || scope.callerTestsOverflow.length > 0 || routeConsumerTestIndex.lookupFailures.length > 0 ? 'warn' : 'debug' });
       try { emitDecision(gateDecision({ runId: ctx?.runId, reason: scopeReason, testStepSkipped })); } catch { /* observation must not change the gate result */ }
       // `defaultSeams.gate` owns the changed-file list and runs before the test-step skip,
       // so platform-only changes remain measured even when gate-scope has no Bun filters.
@@ -2174,6 +2193,12 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           + `${scope.pulledInRelatedTests.slice(0, 8).join(', ')}`
           + `\n(편집된 테스트만 돌렸다면 이것들이 빠졌다)`
         : '';
+      const callerOverflowNote = scope.callerTestsOverflow.length > 0
+        ? `\n\n[gate-scope] ⚠️ caller test cap exceeded — not run: ${scope.callerTestsOverflow.map(({ file, reasons }) => `${file} (${reasons.join('+')})`).join(', ')}`
+        : '';
+      const routeLookupNote = routeConsumerTestIndex.lookupFailures.length > 0
+        ? `\n\n[gate-scope] ⚠️ caller route base lookup failed — unmeasured: ${routeConsumerTestIndex.lookupFailures.map(({ source, reason }) => `${source} (${reason})`).join(', ')}`
+        : '';
       const scopeNote = testStepSkipped
         ? `\n\n[gate-scope] ${scope.reason} — test 스텝을 건너뛰었다(변경파일 tsc 만 검증). `
           + (scope.reason === 'no-related-tests'
@@ -2204,7 +2229,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         : '';
       return {
         passed: gatePassed,
-        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}`,
+        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}`,
         testStepExecuted: !testStepSkipped && testStep !== undefined && !testStep.skipped,
         scopeReason,
         comparisonBaseStatus: observationChanges.comparisonBaseStatus,
@@ -2349,11 +2374,47 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
     postPrComment: async ({ number, body, cwd }) => {
       // Round comments go out as the GitHub App like the PR itself — a personal `gh` login made the owner a
       // participant and mailed them on merge (#22089).
+      if (body.startsWith(RELEASE_PATH_HOLD_MARKER)) {
+        // Several merge surfaces may hold the same PR; post the release-path hold comment once.
+        let history: unknown;
+        try {
+          history = JSON.parse((await execFileAsync('gh', releasePathHoldCommentsArgs(number), {
+            cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, maxBuffer: 64 * 1024 * 1024, env: ghAutomationEnv(process.env),
+          })).stdout);
+        } catch { history = undefined; }
+        if (!releasePathHoldShouldPost(() => history)) return;
+      }
       await execFileAsync('gh', ['pr', 'comment', String(number), '--body', body], {
         cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, maxBuffer: 64 * 1024 * 1024, env: ghAutomationEnv(process.env),
       });
     },
 
+    addPrLabel: async ({ number, label, cwd }) => {
+      if (label === RELEASE_PATH_LABEL) {
+        const existing = await execFileAsync('gh', ['label', 'list', '--search', label, '--json', 'name'], {
+          cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, env: ghAutomationEnv(process.env),
+        });
+        const names: unknown = JSON.parse(existing.stdout);
+        if (!Array.isArray(names)) throw new Error('gh label list returned an invalid list');
+        if (!names.some((item: unknown) => !!item && typeof item === 'object' && 'name' in item && item.name === label)) {
+          await execFileAsync('gh', ['label', 'create', label, '--color', 'D93F0B', '--description', 'Release path requires OP approval'], {
+            cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, env: ghAutomationEnv(process.env),
+          });
+        }
+      }
+      await execFileAsync('gh', ['pr', 'edit', String(number), '--add-label', label], {
+        cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, env: ghAutomationEnv(process.env),
+      });
+    },
+    readPrFiles: async ({ number, cwd }) => {
+      // Paginate the PR file API: a single `gh pr view --json files` can omit files after the first page.
+      const { stdout } = await execFileAsync('gh', [
+        'api', '--paginate', '--slurp', '--method', 'GET', '-f', 'per_page=100',
+        `repos/{owner}/{repo}/pulls/${number}/files`,
+      ], { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT, maxBuffer: 64 * 1024 * 1024, env: ghAutomationEnv(process.env) });
+      return releasePrFilePaths(JSON.parse(stdout));
+    },
+
     ...(o.approvePr ? { approvePr: o.approvePr } : {}),
 
     // ★ 내부 리뷰(2026-07-21·review-gated merge) — worktree diff → reviewPullRequest(agent-substrate·미션/

package/src/self-implement/test-seams.ts

@@ -32,6 +32,7 @@ export function seams(over: Partial<SelfImplementSeams> & { gateResults?: boolea
     defaultBranchRef: () => 'origin/main',
     mergeMain: async () => ({ status: 'up-to-date' }),
     openPr: async ({ head }) => ({ url: `https://pr/${head}`, number: 7 }),
+    readPrFiles: async () => ['src/ordinary.ts'],
     readPrDiff: async () => '',
     readPrCommitShas: async () => ({ baseCommit: 'base-sha', headCommit: 'checked-head-sha' }),
     approvePr: async () => true,

package/src/self-implement/uncommitted-work.ts

@@ -0,0 +1,59 @@
+import { spawnSync } from 'node:child_process';
+import { isElanousRuntimeArtifactPath } from './gate-scope.js';
+
+export type UncommittedWork =
+  | { status: 'clean'; trackedChanges: string[]; untrackedFiles: string[] }
+  | { status: 'changes'; trackedChanges: string[]; untrackedFiles: string[] }
+  | { status: 'unavailable'; reason: string };
+
+/** Observe the index and working tree without staging, refreshing, or changing any files. */
+export function detectUncommittedWork(worktree: string): UncommittedWork {
+  const gitEnv = { ...process.env };
+  for (const key of Object.keys(gitEnv)) {
+    if (key.startsWith('GIT_')) delete gitEnv[key];
+  }
+  let result: ReturnType<typeof spawnSync>;
+  try {
+    result = spawnSync('git', ['--no-optional-locks', 'status', '--porcelain=v1', '-z', '--untracked-files=all'], {
+      cwd: worktree,
+      env: gitEnv,
+      encoding: 'utf8',
+      timeout: 10_000,
+    });
+  } catch (error) {
+    return { status: 'unavailable', reason: error instanceof Error ? error.message : String(error) };
+  }
+  if (result.error || result.status !== 0 || typeof result.stdout !== 'string') {
+    const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : '';
+    return { status: 'unavailable', reason: result.error?.message || stderr || 'git status failed' };
+  }
+
+  const trackedChanges = new Set<string>();
+  const untrackedFiles = new Set<string>();
+  const entries = result.stdout.split('\0');
+  if (entries.at(-1) !== '') return { status: 'unavailable', reason: 'incomplete git status output' };
+  entries.pop();
+  for (let i = 0; i < entries.length; i += 1) {
+    const entry = entries[i]!;
+    if (entry.length < 4 || entry[2] !== ' ') return { status: 'unavailable', reason: 'invalid git status output' };
+    const kind = entry.slice(0, 2);
+    const path = entry.slice(3);
+    if (!path) return { status: 'unavailable', reason: 'invalid git status path' };
+    if (kind === '??') {
+      if (!isElanousRuntimeArtifactPath(path) && path !== '.elanous-test' && !path.startsWith('.elanous-test/')
+        && path !== '.elanous-skill-artifacts' && !path.startsWith('.elanous-skill-artifacts/')) {
+        untrackedFiles.add(path);
+      }
+    } else if (kind !== '!!') {
+      trackedChanges.add(path);
+      if (kind.includes('R') || kind.includes('C')) {
+        const original = entries[++i];
+        if (!original) return { status: 'unavailable', reason: 'incomplete git rename/copy output' };
+        if (kind.includes('R')) trackedChanges.add(original);
+      }
+    }
+  }
+  return trackedChanges.size || untrackedFiles.size
+    ? { status: 'changes', trackedChanges: [...trackedChanges], untrackedFiles: [...untrackedFiles] }
+    : { status: 'clean', trackedChanges: [], untrackedFiles: [] };
+}

package/src/session/chat.ts

@@ -109,6 +109,8 @@ export interface RunTurnOpts {
    *  delegated coding agent's approval prompts back to the originating
    *  chat via `delegate_code_agent`. */
   hitlConfirmChannel?: import('../hitl/confirm.js').ConfirmChannel;
+  /** Verified by the hosting bot from the inbound user id against its server-side owner allowlist. */
+  verifiedOwner?: { id: string };
   /** Paired multi-option question channel (Telegram sets this). Surface
    *  runTurnImpls thread it into `delegate_code_agent` so a delegated
    *  agent's structured questions render as option buttons in the

package/src/session/index.ts

@@ -202,6 +202,8 @@ export interface SessionMeta {
    *  아님). ~/.elanous 공유 스토어 세션은 전부 'prod'. append 는 이 값을 보존(생성자 귀속).
    *  구 세션엔 부재(tolerant read) — 미상 = 필터 비매치. */
   originInstance?: string;
+  /** Project association, omitted for sessions without an assigned project (including legacy records). */
+  projectId?: string;
   /** For telegram-sourced sessions; undefined for cli. */
   tgChatId?: number;
   tgThreadId?: number;
@@ -383,6 +385,7 @@ export interface CreateSessionOpts {
   tgBotId?: string;
   /** Stable identity for a persona's resident conversation. */
   personaId?: string;
+  projectId?: string;
   title?: string;
   /** 표면 origin(cli/pwa/tg/dc/harness) — source 유니온 밖의 세밀 라벨(PWA 챗 구분용). */
   origin?: string;
@@ -450,6 +453,33 @@ function writeIndex(entries: SessionMeta[], root: string = sessionRoot(), remove
   });
 }
 
+/** 세션 메타 하나를 잠금 «안에서» 디스크의 최신 목록 위에 고쳐 쓴다(IA1b).
+ *  `appendMessage` 가 잠금 밖에서 읽은 목록을 통째로 쓰면, 그 사이 다른 프로세스가 바꾼
+ *  같은 세션의 `projectId`·`messageCount` 를 옛 값으로 덮었다. 없는 id 면 `null`. */
+export function updateSessionMeta(
+  id: string,
+  mutate: (meta: SessionMeta) => void,
+  root: string = sessionRoot(),
+  opts: { bubble?: boolean } = {},
+): SessionMeta | null {
+  ensureRoots(root);
+  const p = indexPath(root);
+  return withDirLock(join(root, '.index.lock'), INDEX_LOCK_TIMEOUT_MS, () => {
+    const idx = readIndex(root);
+    const pos = idx.findIndex((m) => m.id === id);
+    if (pos < 0) return null;
+    const meta = { ...idx[pos] };
+    mutate(meta);
+    idx.splice(pos, 1);
+    if (opts.bubble) idx.unshift(meta);
+    else idx.splice(pos, 0, meta);
+    const tmp = `${p}.${process.pid}.${randomUUID().slice(0, 8)}.tmp`;
+    writeFileSync(tmp, JSON.stringify(idx, null, 2) + '\n', 'utf-8');
+    renameSync(tmp, p);
+    return meta;
+  });
+}
+
 // ── Tier 1 Phase 3 — listener primitive ──────────────────────────────
 //
 // Channel-agnostic subscribe API the daemon-mirror module (PR 2) hooks
@@ -534,6 +564,7 @@ export function createSession(opts: CreateSessionOpts = {}, root: string = sessi
     tgThreadId: opts.tgThreadId,
     ...(opts.tgBotId ? { tgBotId: opts.tgBotId } : {}),
     ...(opts.personaId ? { personaId: opts.personaId } : {}),
+    ...(opts.projectId !== undefined ? { projectId: opts.projectId } : {}),
     tgSessionKey,
   };
   writeFileSync(sessionFile(id, root), '', 'utf-8');
@@ -575,6 +606,7 @@ export function adoptSession(id: string, opts: CreateSessionOpts = {}, root: str
     sourceKind: opts.sourceKind ?? defaultSessionSourceKind(source),
     ...(opts.forkedFromId ? { forkedFromId: opts.forkedFromId } : {}),
     ...(origin ? { origin } : {}),
+    ...(opts.projectId !== undefined ? { projectId: opts.projectId } : {}),
     originInstance: resolveInstanceName(),
     ...(opts.tgChatId != null ? { tgChatId: opts.tgChatId } : {}),
     ...(opts.tgThreadId != null ? { tgThreadId: opts.tgThreadId } : {}),
@@ -601,6 +633,7 @@ export function forkSessionFromHistory(
     tgThreadId: opts.tgThreadId,
     title: opts.title,
     origin: opts.origin,
+    projectId: opts.projectId,
   }, root);
   for (const msg of opts.messages) {
     const content = typeof msg.content === 'string' ? msg.content : '';
@@ -627,20 +660,16 @@ export function appendMessage(id: string, msg: SerializedMessage, root: string =
   const line = JSON.stringify(enriched) + '\n';
   appendFileSync(file, line, 'utf-8');
 
-  const idx = readIndex(root);
-  const pos = idx.findIndex(m => m.id === id);
-  if (pos < 0) throw new Error(`session missing from index: ${id}`);
-  const meta = idx[pos];
-  meta.updatedAt = msg.ts || new Date().toISOString();
-  meta.messageCount = meta.messageCount + 1;
-  // Auto-title on first user message.
-  if (meta.title === '(new session)' && msg.role === 'user' && msg.content) {
-    meta.title = msg.content.replace(/\s+/g, ' ').slice(0, 60).trim() || '(empty)';
-  }
   // Bubble to front of index so listSessions returns newest-first.
-  idx.splice(pos, 1);
-  idx.unshift(meta);
-  writeIndex(idx, root);
+  const meta = updateSessionMeta(id, (m) => {
+    m.updatedAt = msg.ts || new Date().toISOString();
+    m.messageCount = m.messageCount + 1;
+    // Auto-title on first user message.
+    if (m.title === '(new session)' && msg.role === 'user' && msg.content) {
+      m.title = msg.content.replace(/\s+/g, ' ').slice(0, 60).trim() || '(empty)';
+    }
+  }, root, { bubble: true });
+  if (!meta) throw new Error(`session missing from index: ${id}`);
   // Tier 1 Phase 3 — fire AFTER on-disk write + index update.
   // Listeners (daemon-mirror) read the just-appended message + meta
   // from a consistent state.
@@ -738,6 +767,8 @@ export interface ListSessionsOpts {
   tgThreadId?: number;
   /** 생성 인스턴스 정확 일치(prod · test:<repo> …). 구 세션(부재)은 비매치. */
   originInstance?: string;
+  /** Project id exact match; sessions without the field do not match. */
+  projectId?: string;
   /** 표면 origin 정확 일치(cli | pwa | tg | dc | harness). */
   origin?: string;
   /** 제외할 origin(들) — 예: ['harness'] 로 하니스 자식 세션을 사용자 대화 목록에서 숨김. */
@@ -774,6 +805,7 @@ export function listSessions(opts: ListSessionsOpts = {}, root: string = session
     idx = idx.filter(m => !m.sourceKind || !opts.excludeSourceKinds!.includes(m.sourceKind));
   }
   if (opts.originInstance) idx = idx.filter(m => m.originInstance === opts.originInstance);
+  if (opts.projectId !== undefined) idx = idx.filter(m => m.projectId === opts.projectId);
   if (opts.origin) idx = idx.filter(m => m.origin === opts.origin);
   if (opts.excludeOrigins && opts.excludeOrigins.length > 0) {
     idx = idx.filter((m) => {

package/src/shell-env-bootstrap.ts

@@ -210,6 +210,23 @@ export function capturedEnvAvailable(): boolean {
   return captured && cached !== null;
 }
 
+/** Append login-shell PATH entries to the target without replacing its existing environment. */
+export function mergeCapturedPath(target: NodeJS.ProcessEnv = process.env, opts: { capture?: boolean } = {}): number {
+  // capture: 아직 캡처 전이면 여기서 한 번 캡처한다(호출부가 getCapturedEnv 를 직접 부르지 않게 — identity-env 래칫).
+  const capturedPath = opts.capture || capturedEnvAvailable() ? getCapturedEnv().PATH : undefined;
+  const seen = new Set((target.PATH ?? '').split(':'));
+  const missing: string[] = [];
+  for (const entry of capturedPath?.split(':') ?? []) {
+    if (!entry || seen.has(entry)) continue;
+    missing.push(entry);
+    seen.add(entry);
+  }
+  if (missing.length) target.PATH = target.PATH ? `${target.PATH}:${missing.join(':')}` : missing.join(':');
+  const added = missing.length;
+  debug.log('shell.envbootstrap.capture', 'path-merged', { added });
+  return added;
+}
+
 /** Reset cache — test seam. */
 export function resetCapturedEnvForTesting(): void {
   cached = null;