elanous 0.2.15 → 0.2.17

package/src/maturity/tui-slash-availability.ts

@@ -8,6 +8,15 @@ export interface TuiSlashAvailability {
   discord: boolean;
 }
 
+export function formatBotUnavailableSlashReply(name: string, surface: 'telegram' | 'discord'): string {
+  return `/${name}은(는) ${surface === 'telegram' ? '텔레그램' : '디스코드'}에서 아직 지원되지 않습니다. TUI에서 /${name}을(를) 사용하세요.`;
+}
+
+export function botUnavailableSlashReply(entry: TuiSlashAvailability | undefined, surface: 'telegram' | 'discord'): string | null {
+  if (!entry || entry[surface] || entry.maturity === 'system') return null;
+  return formatBotUnavailableSlashReply(entry.name, surface);
+}
+
 /** Project canonical TUI commands onto the maturity map and bot-surface grade maps.
  * An absent bot grade means unavailable; a missing TUI grade is a registry error.
  */

package/src/nexus/api/grid.ts

@@ -0,0 +1,61 @@
+import { getUserConfig } from '../../user-config.js';
+import { readHqLease, type HqDeps } from '../../hq/hq.js';
+import { measurePoolLease, type PoolLeaseMeasure } from '../../task-orchestrator/surfaces/pod-lease.js';
+import { parsePodPool, resolvePodPoolSpec, type PodPoolMember, type PoolKubectl } from '../../task-orchestrator/surfaces/pod-pool.js';
+
+export interface GridData {
+  /** null means the arbiter could not be read, not that no lease exists. */
+  hq: { record: ReturnType<typeof readHqLease>['record']; ageSeconds: number | null; expired: boolean | null; reason: string | null };
+  /** Configured member order; capacity comes from measurePoolLease when available. occupied is running + pending, or null on measurement failure. */
+  members: Array<{ context: string; capacity: number; running: number | null; pending: number | null; occupied: number | null; reason: string | null }>;
+  poolReason: string | null;
+}
+
+export interface GridDeps {
+  hq?: HqDeps;
+  readHq?: () => ReturnType<typeof readHqLease>;
+  poolSpec?: () => string | null;
+  /** Optional read-only kubectl seam; never use a probe that creates Pods. */
+  kubectl?: PoolKubectl;
+  measure?: (members: readonly PodPoolMember[]) => PoolLeaseMeasure;
+}
+
+/** Independent, fail-soft read snapshots. No lease status/heartbeat, DNS probe Pod, host reservation or writes. */
+export function buildGridData(deps: GridDeps = {}): GridData {
+  let hq: GridData['hq'];
+  try {
+    hq = { ...(deps.readHq ?? (() => readHqLease(deps.hq)))(), reason: null };
+  } catch (error) {
+    hq = { record: null, ageSeconds: null, expired: null, reason: String(error) };
+  }
+
+  let members: GridData['members'] = [];
+  let poolReason: string | null = null;
+  try {
+    const spec = (deps.poolSpec ?? (() => resolvePodPoolSpec(undefined, process.env, () => {
+      const config = getUserConfig();
+      return config.harness?.podPool ?? config.pod?.pool;
+    })))();
+    if (spec) {
+      const configured = parsePodPool(spec);
+      try {
+        const measured = (deps.measure ?? ((pool) => measurePoolLease(pool, { skipDnsProbe: true, ...(deps.kubectl ? { kubectl: deps.kubectl } : {}) })))(configured);
+        const byContext = new Map(measured.members.map((m) => [m.context, m]));
+        members = configured.map((member) => {
+          const row = byContext.get(member.context);
+          const running = row?.running ?? null;
+          const pending = row?.pending ?? null;
+          return { context: member.context, capacity: row?.capacity ?? member.capacity, running, pending,
+            occupied: running === null || pending === null ? null : running + pending,
+            reason: row?.reason ?? (row ? null : '측정 불가') };
+        });
+      } catch (error) {
+        poolReason = String(error);
+        members = configured.map(({ context, capacity }) => ({ context, capacity, running: null, pending: null, occupied: null, reason: poolReason }));
+      }
+    } else poolReason = 'pool not configured';
+  } catch (error) {
+    poolReason = String(error);
+  }
+  return { hq, members, poolReason };
+}

package/src/nexus/api/http-server.ts

@@ -22,6 +22,7 @@ import { spawnSync } from 'node:child_process';
 import { isAbsolute } from 'node:path';
 import { createProject, listProjects } from '../../project/project-store.js';
 import { handleOutputsGet, type OutputsDeps } from './outputs-route.js';
+import { buildGridData, type GridDeps } from './grid.js';
 import { DECISIONS_PATH, handleDecisions, type DecisionsRouteDeps } from './decisions-route.js';
 import { CARD_FOLLOWUP_PATH, createCardFollowupJobs, type CardFollowupJobs } from './card-followup-route.js';
 import { SKILL_EXEC_PATH, createSkillExecJobs, type SkillExecJobs } from './skill-exec-route.js';
@@ -341,7 +342,7 @@ import {
   handleTasksList,
   handleTaskDetail,
 } from './tasks-scheduler.js';
-import { handleTaskCardsGet, handleTaskCardsWishPost } from './task-cards-api.js';
+import { handleTaskCardsGet, handleTaskCardsWishPost, handleTaskCardsClosePost } from './task-cards-api.js';
 import { handleTaskCreatePost, handleTaskApprovePost } from './tasks-create.js';
 import { matchIngestAuthorization } from './ingest-token.js';
 import {
@@ -478,6 +479,8 @@ export interface NexusHttpServerOpts {
   /** Optional installer state root for isolated API consumers and tests. */
   pluginStateRoot?: string;
   outputs?: OutputsDeps;
+  /** Read-only grid measurement seam; omitted in production for live HQ and Pod pool reads. */
+  grid?: GridDeps;
   decisions?: Pick<DecisionsRouteDeps, 'ledger'>;
   cardFollowup?: CardFollowupJobs;
   skillExec?: SkillExecJobs;
@@ -1385,6 +1388,12 @@ export async function routeRequest(
     });
   }
 
+  // routeRequest is the live GET-only caller of buildGridData; keep it behind the owner auth gate.
+  if (pathname === '/v1/grid') {
+    if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+    if (method !== 'GET') return jsonResponse({ error: 'method-not-allowed', method }, 405);
+    return jsonResponse(buildGridData(opts.grid));
+  }
   if (method === 'GET' && pathname === '/v1/outputs') {
     if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return handleOutputsGet(req, opts.outputs);
@@ -1457,6 +1466,15 @@ export async function routeRequest(
       const mutated = await handleGraphsMutation(pathname, req);
       if (mutated) return mutated;
     }
+    const cardClose = /^\/v1\/task-cards\/([^/]+)\/close$/.exec(pathname);
+    if (method === 'POST' && cardClose) {
+      if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
+      if (bearerCredential(req, opts.metaApi) !== 'bearer-match') return jsonResponse({ error: 'forbidden' }, 403);
+      let id: string;
+      try { id = decodeURIComponent(cardClose[1]!); }
+      catch { return jsonResponse({ error: 'not_found' }, 404); }
+      return handleTaskCardsClosePost(req, id);
+    }
     if (method === 'POST' && pathname === '/v1/task-cards/wish') {
       if (!opts.metaApi || !checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
       return handleTaskCardsWishPost(req);

package/src/nexus/api/task-cards-api.ts

@@ -25,6 +25,25 @@ export async function handleTaskCardsWishPost(req: Request, root?: string): Prom
   }
 }
 
+export async function handleTaskCardsClosePost(req: Request, id: string, root?: string): Promise<Response> {
+  if (!/^[a-zA-Z0-9_-]+$/.test(id)) return jsonResponse({ error: 'not_found' }, 404);
+  let body: unknown;
+  try { body = await req.json(); }
+  catch { return jsonResponse({ error: 'bad_request' }, 400); }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return jsonResponse({ error: 'bad_request' }, 400);
+  const { reason } = body as Record<string, unknown>;
+  if (typeof reason !== 'string' || !reason.trim() || reason.trim().includes('\n') || reason.trim().includes('\r')) {
+    return jsonResponse({ error: 'bad_request' }, 400);
+  }
+  const store = new CardStore(root);
+  try {
+    if (!store.getCard(id)) return jsonResponse({ error: 'not_found' }, 404);
+    return jsonResponse({ card: store.closeCard(id, reason) });
+  } finally {
+    store.close();
+  }
+}
+
 export interface WishPlacement { cellId: string; cellTitle: string; version: string; status: 'green' | 'yellow' | 'red' | 'done' }
 
 export function isSplitCell(cell: unknown): cell is { id: string } {

package/src/oauth/codex.ts

@@ -24,9 +24,11 @@
 // the official CLI stays in sync.
 
 import { execFileSync } from 'node:child_process';
+import { chmodSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { resolveCodexAccount, effectiveCodexHome, type CodexAccountResolution } from './codex-account.js';
-import { resolveCodexAccountForRun } from './codex-account-store.js';
+import { DEFAULT_CODEX_ACCOUNT, codexStoreKey, isValidAccountName, resolveCodexAccount, effectiveCodexHome, type CodexAccountResolution } from './codex-account.js';
+import { importCodexAccountFromHome, resolveCodexAccountForRun } from './codex-account-store.js';
+import { decodeJWTPayload } from './jwt.js';
 import { authStorePath } from './store.js';
 import { platform, release, arch } from 'node:os';
 import {
@@ -533,3 +535,81 @@ export async function getCodexAccessToken(
   const state = await loadFreshCodexAuthState(opts);
   return state ? state.tokens : null;
 }
+
+// ── Named-account host refresh (POD-TOKEN-PREREFRESH · 10-06) ─────────
+//
+// 🩸 10-06 05:3x team · 09:47 third — Pod launches refused a codex account whose access token had
+// under 3 h left, and a human refreshed it by hand (refreshCodexTokens → atomic 0600 write → account
+// import). This is that path as one function: backup → refresh → atomic write → canonical store via
+// the same import path. ⛔ Token values never leave this function — the result carries hours only.
+
+export type CodexAccountRefreshResult =
+  | { ok: true; storeKey: string; codexHome: string; beforeH: number | null; afterH: number | null; backupPath: string }
+  | { ok: false; kind: 'bad-name' | 'default-refused' | 'unknown-account' | 'unreadable' | 'no-tokens' | 'refresh-failed' | 'write-failed' | 'import-failed'; message: string };
+
+/** Hours left on a JWT access token (one decimal) — null when the token carries no readable `exp`. */
+export function codexAccessHoursLeft(accessToken: unknown, now: number = Date.now()): number | null {
+  if (typeof accessToken !== 'string') return null;
+  const exp = decodeJWTPayload(accessToken)?.exp;
+  return typeof exp === 'number' ? Math.round(((exp * 1000 - now) / 3_600_000) * 10) / 10 : null;
+}
+
+export async function refreshCodexAccountHome(
+  name: string,
+  opts: {
+    /** ⛔ Test isolation seam — default is the canonical store. */
+    storePath?: string;
+    /** ⛔ Test seam — tests inject a fake refresher; never the network. */
+    refresh?: (refreshToken: string) => Promise<TokenResponse>;
+    now?: () => number;
+  } = {},
+): Promise<CodexAccountRefreshResult> {
+  // ⛔ The CEO's default account (~/.codex) is shared with the official CLI — refreshing it here
+  //   rotates the refresh token out from under that CLI. Named accounts only.
+  if (name === DEFAULT_CODEX_ACCOUNT) {
+    return { ok: false, kind: 'default-refused', message: `'${DEFAULT_CODEX_ACCOUNT}'(~/.codex) 는 대표 기본 계정이다 — 여기서 갱신하지 않는다` };
+  }
+  if (!isValidAccountName(name)) return { ok: false, kind: 'bad-name', message: `계정 이름이 부적격이다: ${name}` };
+  const storePath = opts.storePath ?? authStorePath();
+  const now = opts.now ?? Date.now;
+  const storeKey = codexStoreKey(name);
+  const codexHome = loadTokens(storeKey, storePath)?.codexHome;
+  if (!codexHome) return { ok: false, kind: 'unknown-account', message: `${storeKey} 계정이 없거나 codexHome 을 모른다 — 먼저 account import` };
+  const authPath = join(codexHome, 'auth.json');
+  let raw: string;
+  let parsed: { tokens?: Record<string, unknown> } & Record<string, unknown>;
+  try { raw = readFileSync(authPath, 'utf8'); parsed = JSON.parse(raw); }
+  catch (error) { return { ok: false, kind: 'unreadable', message: `${authPath} 를 못 읽었다 (${error instanceof Error ? error.name : 'error'})` }; }
+  const refreshToken = parsed.tokens?.refresh_token;
+  if (typeof refreshToken !== 'string' || !refreshToken) return { ok: false, kind: 'no-tokens', message: '그 홈에 refresh 토큰이 없다 — 그 홈으로 codex login' };
+  const beforeH = codexAccessHoursLeft(parsed.tokens?.access_token, now());
+  // Backup first — the server rotates the refresh token, so a failed write after refresh must leave something to recover from.
+  const backupPath = `${authPath}.bak-${new Date(now()).toISOString().replace(/[:.]/g, '-')}`;
+  try { writeFileSync(backupPath, raw, { mode: 0o600, flag: 'wx' }); }
+  catch (error) { return { ok: false, kind: 'write-failed', message: `백업을 못 썼다 (${error instanceof Error ? error.name : 'error'})` }; }
+  let fresh: TokenResponse;
+  try { fresh = await (opts.refresh ?? ((token) => refreshCodexTokens(token)))(refreshToken); }
+  catch (error) {
+    // refreshCodexTokens' message is `codex refresh failed: status=N` — no token. Anything else: a fixed line.
+    const message = error instanceof Error && /^codex refresh failed: status=\d+$/.test(error.message) ? error.message : 'codex refresh failed';
+    return { ok: false, kind: 'refresh-failed', message };
+  }
+  const next = {
+    ...parsed,
+    tokens: { ...parsed.tokens, access_token: fresh.access_token, refresh_token: fresh.refresh_token, ...(fresh.id_token ? { id_token: fresh.id_token } : {}) },
+    last_refresh: new Date(now()).toISOString(),
+  };
+  const tmp = `${authPath}.tmp-${process.pid}-${now()}`;
+  try {
+    writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, authPath);
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* best effort */ }
+    return { ok: false, kind: 'write-failed', message: `${authPath} 원자적 쓰기 실패 (${error instanceof Error ? error.name : 'error'}) — 백업: ${backupPath}` };
+  }
+  // ⭐ Canonical store through the same path as `account import` — not a second writer.
+  const imported = await importCodexAccountFromHome(name, codexHome, storePath);
+  if (!imported.ok) return { ok: false, kind: 'import-failed', message: imported.message };
+  return { ok: true, storeKey, codexHome, beforeH, afterH: codexAccessHoursLeft(fresh.access_token, now()), backupPath };
+}

package/src/oauth/overload-failover-launch.ts

@@ -0,0 +1,75 @@
+// Launch-time application of the overload gate. Kept out of dev-cli.ts so a
+// unit test can import it without the dev-cli module graph (yaml, typescript).
+
+import type { ChildLlmSelection } from '../agent/run-context.js';
+import { debug } from '../debug/log.js';
+import { resolveGrokCredential } from '../grok/credential.js';
+import {
+  applyOverloadFailoverToChild,
+  readLlmCallOutcomes,
+  type OverloadFailoverLaunchDecision,
+} from './overload-failover.js';
+
+const CODEX_NAMES = new Set(['codex', 'openai-codex']);
+
+export function codexProviderNamed(provider: string | undefined): boolean {
+  if (!provider?.trim()) return false;
+  return CODEX_NAMES.has(provider.trim().toLowerCase());
+}
+
+let launchOverloadOutcomesForTesting: (() => ReturnType<typeof readLlmCallOutcomes>) | undefined;
+
+/** Test seam. `undefined` restores the real log store. */
+export function setLaunchOverloadOutcomesForTesting(
+  reader: (() => ReturnType<typeof readLlmCallOutcomes>) | undefined,
+): void {
+  launchOverloadOutcomesForTesting = reader;
+}
+
+export interface LaunchOverloadFlags {
+  provider?: string;
+  model?: string;
+  /** Pinned childLlm config naming codex. A flag is handled via `provider`. */
+  codexPinned?: boolean;
+  /** Test seam. Default: a grok credential resolves on this host. */
+  grokAvailable?: boolean;
+}
+
+/** Explicit codex stays. Otherwise k `llm.call`/`outcome` overload rows move
+ *  the unpinned child to grok before spawn. */
+export function applyLaunchOverloadFailover(
+  selection: ChildLlmSelection | undefined,
+  flags: LaunchOverloadFlags = {},
+  readOutcomes?: () => ReturnType<typeof readLlmCallOutcomes>,
+  env: NodeJS.ProcessEnv = process.env,
+): ChildLlmSelection | undefined {
+  // Test processes never read this machine's operational logs.db — results must not depend on the host's history.
+  const inTest = env.NODE_ENV === 'test' || Boolean(env.ELANOUS_TEST_HOME);
+  const reader = launchOverloadOutcomesForTesting ?? readOutcomes ?? (inTest ? () => [] : () => readLlmCallOutcomes());
+  let outcomes: ReturnType<typeof readLlmCallOutcomes> = [];
+  try { outcomes = reader(); } catch { outcomes = []; }
+  const explicit = codexProviderNamed(flags.provider) || flags.codexPinned === true;
+  let grokAvailable = flags.grokAvailable;
+  if (grokAvailable === undefined && outcomes.length > 0 && !inTest) {
+    // Only resolve when a switch is possible — a host without grok credentials must stay on codex. Tests inject it.
+    try { grokAvailable = resolveGrokCredential() !== null; } catch { grokAvailable = false; }
+  }
+  const { selection: next, decision } = applyOverloadFailoverToChild(selection, {
+    codexExplicit: explicit,
+    outcomes,
+    ...(grokAvailable !== undefined ? { grokAvailable } : {}),
+    defaultProvider: selection?.provider ?? 'openai-codex',
+  });
+  if (decision.switched && next?.provider === 'grok' && next.model) {
+    debug.log('self-dev', 'overload-failover', {
+      from: selection?.provider ?? 'openai-codex',
+      to: next.provider,
+      model: next.model,
+      why: decision.why,
+    }, { level: 'warn' });
+    return { provider: next.provider, model: next.model, source: 'config' };
+  }
+  return selection;
+}
+
+export type { OverloadFailoverLaunchDecision };

package/src/oauth/overload-failover.ts

@@ -0,0 +1,137 @@
+// Launch-time codex → grok switch driven only by `llm.call` / `outcome`.
+//
+// #24256 read `llm.response` / `llm.stream`. Those rows do not carry
+// provider + status + kind, so a launch that consulted them never saw
+// overload. This module refuses every other category.
+//
+// Boundaries:
+//   • an explicit codex child (flag or pinned config) never switches (#24183)
+//   • k consecutive codex overload/5xx/rate-limit outcomes switch the next
+//     child to grok before that child is spawned
+//   • k later successful outcomes restore codex
+//   • a 400 (kind `other`) never counts
+
+import { logsDbPath, LogStore, type LogStoreRow } from '../mss/logging/log-store.js';
+import {
+  codexOverloadStreakReached,
+  overloadRecovered,
+  OVERLOAD_FAILOVER_STREAK,
+  type LlmCallOutcome,
+  type LlmCallOutcomeKind,
+} from '../session-runtime/retry-policy.js';
+import { lookupLlmTierSpec } from '../model-tier/llm-tier-map.js';
+
+export const LLM_CALL_CATEGORY = 'llm.call';
+export const LLM_CALL_EVENT = 'outcome';
+
+const KINDS = new Set<LlmCallOutcomeKind>(['ok', 'overloaded', '5xx', 'rate-limit', 'other']);
+
+export interface OverloadFailoverLaunchInput {
+  /** True when the launch named codex (flag or pinned childLlm). */
+  readonly codexExplicit: boolean;
+  /** Provider the launch would have used before this gate. */
+  readonly provider: string;
+  readonly model?: string;
+  readonly outcomes: readonly LlmCallOutcome[];
+  readonly streak?: number;
+  /** grok may be selected. Unknown is not a reason to stay on a hot codex. */
+  readonly grokAvailable?: boolean;
+}
+
+export interface OverloadFailoverLaunchDecision {
+  readonly provider: string;
+  readonly model?: string;
+  readonly switched: boolean;
+  readonly why: 'explicit-codex' | 'not-codex' | 'streak' | 'recovered' | 'below-streak' | 'grok-unavailable';
+}
+
+export function parseLlmCallOutcome(row: Pick<LogStoreRow, 'category' | 'event' | 'data'>): LlmCallOutcome | undefined {
+  if (row.category !== LLM_CALL_CATEGORY || row.event !== LLM_CALL_EVENT || !row.data) return undefined;
+  let parsed: unknown;
+  try { parsed = JSON.parse(row.data); } catch { return undefined; }
+  if (!parsed || typeof parsed !== 'object') return undefined;
+  const rec = parsed as { provider?: unknown; status?: unknown; kind?: unknown };
+  if (typeof rec.provider !== 'string' || rec.provider.length === 0) return undefined;
+  if (typeof rec.status !== 'number' || !Number.isFinite(rec.status)) return undefined;
+  if (typeof rec.kind !== 'string' || !KINDS.has(rec.kind as LlmCallOutcomeKind)) return undefined;
+  return { provider: rec.provider, status: rec.status, kind: rec.kind as LlmCallOutcomeKind };
+}
+
+/** Newest-last. Rows that are not `llm.call`/`outcome` are dropped, never guessed. */
+export function outcomesFromCallRows(rows: readonly (Pick<LogStoreRow, 'category' | 'event' | 'data' | 'ts_ms'> & { id?: number })[]): LlmCallOutcome[] {
+  // The store returns newest first; calls in the same millisecond keep that order unless ties break on row id.
+  return [...rows]
+    .filter((row) => row.category === LLM_CALL_CATEGORY && row.event === LLM_CALL_EVENT)
+    .sort((a, b) => a.ts_ms - b.ts_ms || (a.id ?? 0) - (b.id ?? 0))
+    .flatMap((row) => {
+      const parsed = parseLlmCallOutcome(row);
+      return parsed ? [parsed] : [];
+    });
+}
+
+export function readLlmCallOutcomes(opts: {
+  dbPath?: string;
+  sinceMs?: number;
+  limit?: number;
+  open?: (path: string) => Pick<LogStore, 'query' | 'close'>;
+} = {}): LlmCallOutcome[] {
+  const path = opts.dbPath ?? logsDbPath();
+  const open = opts.open ?? ((dbPath: string) => LogStore.openReadOnly(dbPath));
+  let store: Pick<LogStore, 'query' | 'close'> | undefined;
+  try {
+    store = open(path);
+    const rows = store.query({
+      exactCategories: [LLM_CALL_CATEGORY],
+      events: [LLM_CALL_EVENT],
+      ...(opts.sinceMs !== undefined ? { sinceMs: opts.sinceMs } : {}),
+      limit: opts.limit ?? 50,
+    });
+    return outcomesFromCallRows(rows);
+  } catch {
+    return [];
+  } finally {
+    try { store?.close(); } catch { /* a missing store is "no sample", not a launch failure */ }
+  }
+}
+
+export function decideOverloadFailoverLaunch(input: OverloadFailoverLaunchInput): OverloadFailoverLaunchDecision {
+  const streak = input.streak ?? OVERLOAD_FAILOVER_STREAK;
+  const base = { provider: input.provider, ...(input.model !== undefined ? { model: input.model } : {}) };
+  if (input.codexExplicit) return { ...base, switched: false, why: 'explicit-codex' };
+  const onCodex = input.provider === 'openai-codex' || input.provider === 'codex';
+  if (!onCodex) return { ...base, switched: false, why: 'not-codex' };
+  if (overloadRecovered(input.outcomes, streak)) return { ...base, switched: false, why: 'recovered' };
+  if (!codexOverloadStreakReached(input.outcomes, streak)) return { ...base, switched: false, why: 'below-streak' };
+  if (input.grokAvailable === false) return { ...base, switched: false, why: 'grok-unavailable' };
+  return {
+    provider: 'grok',
+    model: lookupLlmTierSpec('grok', 'better').model,
+    switched: true,
+    why: 'streak',
+  };
+}
+
+/** Apply the gate to a not-yet-pinned child selection. Explicit codex is left untouched. */
+export function applyOverloadFailoverToChild<T extends { provider: string; model: string; source: 'flag' | 'config' }>(
+  selection: T | undefined,
+  opts: {
+    codexExplicit: boolean;
+    outcomes: readonly LlmCallOutcome[];
+    grokAvailable?: boolean;
+    defaultProvider?: string;
+  },
+): { selection: T | { provider: string; model: string; source: 'config' } | undefined; decision: OverloadFailoverLaunchDecision } {
+  const provider = selection?.provider ?? opts.defaultProvider ?? 'openai-codex';
+  const decision = decideOverloadFailoverLaunch({
+    codexExplicit: opts.codexExplicit,
+    provider,
+    ...(selection?.model !== undefined ? { model: selection.model } : {}),
+    outcomes: opts.outcomes,
+    grokAvailable: opts.grokAvailable,
+  });
+  if (!decision.switched || !decision.model) return { selection, decision };
+  return {
+    selection: { provider: decision.provider, model: decision.model, source: 'config' },
+    decision,
+  };
+}

package/src/release-loop/checklist.ts

@@ -18,6 +18,8 @@ export interface ChecklistItem {
   deadlineVersion?: string;
   ceoMinutes?: number;
   ceoDate?: string;
+  /** 다른 칸의 처리량을 올리는 칸(자율성·효율성·동시성). 없으면 가속 등급이 아니다. */
+  accelerator?: true;
   evidence?: string;
   disposition?: ChecklistDisposition;
   kind?: ChecklistKind;
@@ -103,7 +105,7 @@ export function validateCeoLoad(input: { ceoMinutes?: number; ceoDate?: string }
   if (input.ceoDate !== undefined && (!/^\d{4}-\d{2}-\d{2}$/.test(input.ceoDate) || !Number.isFinite(Date.parse(`${input.ceoDate}T00:00:00Z`)) || new Date(`${input.ceoDate}T00:00:00Z`).toISOString().slice(0, 10) !== input.ceoDate)) throw new CliUserError('대표 손 날짜는 YYYY-MM-DD 이어야 한다');
 }
 
-export function addItem(v: string, input: { id: string; title: string; owner?: string; kind?: ChecklistKind; priority?: ChecklistItem['priority']; predecessors?: string[]; deadlineVersion?: string; ceoMinutes?: number; ceoDate?: string }, options: { allowDuplicateId?: boolean } = {}): Checklist {
+export function addItem(v: string, input: { id: string; title: string; owner?: string; kind?: ChecklistKind; priority?: ChecklistItem['priority']; predecessors?: string[]; deadlineVersion?: string; ceoMinutes?: number; ceoDate?: string; accelerator?: boolean }, options: { allowDuplicateId?: boolean } = {}): Checklist {
   if (!input.id.trim()) throw new CliUserError('칸 id 가 비었다');
   if (!input.title.trim()) throw new CliUserError('칸 제목이 비었다');
   if (input.kind !== undefined && input.kind !== 'screen') throw new CliUserError(`잘못된 종류: ${input.kind}`, 'screen');
@@ -111,6 +113,7 @@ export function addItem(v: string, input: { id: string; title: string; owner?: s
   if (input.priority !== undefined && !['P0', 'P1', 'P2'].includes(input.priority)) throw new CliUserError(`잘못된 우선순위: ${input.priority}`);
   if (input.predecessors !== undefined && (!Array.isArray(input.predecessors) || input.predecessors.some((p) => typeof p !== 'string' || !p.trim() || p === input.id))) throw new CliUserError('잘못된 선행 칸');
   if (input.deadlineVersion !== undefined) store.validateVersion(input.deadlineVersion);
+  if (input.accelerator !== undefined && input.accelerator !== true) throw new CliUserError('가속 등급은 true 이거나 생략한다');
   validateCeoLoad(input);
   return mutate(v, (data, otherItems) => {
     if (data.items.some((item) => item.id === input.id)) throw new CliUserError(`이미 있는 칸: ${input.id}`, 'set <id> 로 고친다');
@@ -122,14 +125,14 @@ export function addItem(v: string, input: { id: string; title: string; owner?: s
     }
     const by = process.env.ELANOUS_TRACK || 'cli';
     const at = new Date().toISOString();
-    const item: ChecklistItem = { id: input.id, title: input.title, status: 'yellow', ...(input.owner !== undefined ? { owner: input.owner } : {}), ...(input.kind !== undefined ? { kind: input.kind } : {}), ...(input.priority !== undefined ? { priority: input.priority } : {}), ...(input.predecessors !== undefined ? { predecessors: input.predecessors } : {}), ...(input.deadlineVersion !== undefined ? { deadlineVersion: input.deadlineVersion } : {}), ...(input.ceoMinutes !== undefined ? { ceoMinutes: input.ceoMinutes } : {}), ...(input.ceoDate !== undefined ? { ceoDate: input.ceoDate } : {}), updatedAt: at, updatedBy: by };
+    const item: ChecklistItem = { id: input.id, title: input.title, status: 'yellow', ...(input.owner !== undefined ? { owner: input.owner } : {}), ...(input.kind !== undefined ? { kind: input.kind } : {}), ...(input.priority !== undefined ? { priority: input.priority } : {}), ...(input.predecessors !== undefined ? { predecessors: input.predecessors } : {}), ...(input.deadlineVersion !== undefined ? { deadlineVersion: input.deadlineVersion } : {}), ...(input.ceoMinutes !== undefined ? { ceoMinutes: input.ceoMinutes } : {}), ...(input.ceoDate !== undefined ? { ceoDate: input.ceoDate } : {}), ...(input.accelerator === true ? { accelerator: true as const } : {}), updatedAt: at, updatedBy: by };
     data.items.push(item);
     change(data, item.id, 'add', null, item, by, at);
     return true;
   });
 }
 
-export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string; disposition?: ChecklistDisposition; kind?: ChecklistKind; priority?: ChecklistItem['priority']; predecessors?: string[]; deadlineVersion?: string; ceoMinutes?: number; ceoDate?: string }, by: string): Checklist {
+export function setItem(v: string, id: string, patch: { status?: ChecklistStatus; evidence?: string; owner?: string; disposition?: ChecklistDisposition; kind?: ChecklistKind; priority?: ChecklistItem['priority']; predecessors?: string[]; deadlineVersion?: string; ceoMinutes?: number; ceoDate?: string; accelerator?: boolean | null }, by: string): Checklist {
   return mutate(v, (data) => {
     const item = data.items.find((i) => i.id === id);
     if (!item) throw new CliUserError(`없는 칸: ${id}`, 'list 로 칸 목록을 본다');
@@ -139,6 +142,7 @@ export function setItem(v: string, id: string, patch: { status?: ChecklistStatus
     if (patch.priority !== undefined && !['P0', 'P1', 'P2'].includes(patch.priority)) throw new CliUserError(`잘못된 우선순위: ${patch.priority}`);
     if (patch.predecessors !== undefined && (!Array.isArray(patch.predecessors) || patch.predecessors.some((p) => typeof p !== 'string' || !p.trim() || p === id))) throw new CliUserError('잘못된 선행 칸');
     if (patch.deadlineVersion !== undefined) store.validateVersion(patch.deadlineVersion);
+    if (patch.accelerator !== undefined && patch.accelerator !== true && patch.accelerator !== null) throw new CliUserError('가속 등급은 true(부여) 또는 null(해제)이다');
     validateCeoLoad(patch);
     if (patch.owner !== undefined) {
       parseOwner(patch.owner);
@@ -146,13 +150,14 @@ export function setItem(v: string, id: string, patch: { status?: ChecklistStatus
         throw new CliUserError(`지금 주인: ${item.owner} — --force 로만 바꾼다`, 'release checklist claim <id> --by <자리> --force');
       }
     }
-    const fields = (['evidence', 'owner', 'status', 'disposition', 'kind', 'priority', 'predecessors', 'deadlineVersion', 'ceoMinutes', 'ceoDate'] as const).filter((field) => patch[field] !== undefined && JSON.stringify(patch[field]) !== JSON.stringify(item[field]));
+    const fields = (['evidence', 'owner', 'status', 'disposition', 'kind', 'priority', 'predecessors', 'deadlineVersion', 'ceoMinutes', 'ceoDate', 'accelerator'] as const).filter((field) => patch[field] !== undefined && JSON.stringify(patch[field]) !== JSON.stringify(item[field] ?? null));
     if (fields.length === 0) return false;
     const at = new Date().toISOString();
     for (const field of fields) {
       const from = item[field];
       const to = patch[field]!;
-      (item as unknown as Record<string, unknown>)[field] = to;
+      if (field === 'accelerator' && to === null) delete item.accelerator;
+      else (item as unknown as Record<string, unknown>)[field] = to;
       item.updatedAt = at;
       item.updatedBy = by;
       change(data, id, field, from, to, by, at);

package/src/release-loop/feature-store.ts

@@ -33,7 +33,7 @@ const walWait = new Int32Array(new SharedArrayBuffer(4));
 const SCHEMA_COLUMNS: Record<string, readonly string[]> = {
   imported_versions: ['json_hash', 'imported_at'],
   events: ['reason'],
-  assignments: ['priority', 'predecessors', 'deadline_version', 'ceo_minutes', 'ceo_date'],
+  assignments: ['priority', 'predecessors', 'deadline_version', 'ceo_minutes', 'ceo_date', 'accelerator'],
   release_schedules: ['freeze_from', 'freeze_until'],
 };
 function schemaCurrent(db: Database): boolean {
@@ -75,7 +75,7 @@ function open(root = releaseLedgerRoot()): Database {
       if (!(db.query('PRAGMA table_info(events)').all() as Array<{ name: string }>).some((column) => column.name === 'reason')) db.exec('ALTER TABLE events ADD COLUMN reason TEXT');
       db.exec('CREATE TABLE IF NOT EXISTS release_schedules (version TEXT PRIMARY KEY, cut_at TEXT NOT NULL, land_by TEXT, updated_at TEXT NOT NULL, updated_by TEXT NOT NULL)');
       const assignmentColumns = db.query('PRAGMA table_info(assignments)').all() as Array<{ name: string }>;
-      for (const [name, sql] of [['priority', 'TEXT'], ['predecessors', 'TEXT'], ['deadline_version', 'TEXT'], ['ceo_minutes', 'INTEGER'], ['ceo_date', 'TEXT']] as const) {
+      for (const [name, sql] of [['priority', 'TEXT'], ['predecessors', 'TEXT'], ['deadline_version', 'TEXT'], ['ceo_minutes', 'INTEGER'], ['ceo_date', 'TEXT'], ['accelerator', 'INTEGER']] as const) {
         if (!assignmentColumns.some((column) => column.name === name)) db.exec(`ALTER TABLE assignments ADD COLUMN ${name} ${sql}`);
       }
       const scheduleColumns = db.query('PRAGMA table_info(release_schedules)').all() as Array<{ name: string }>;
@@ -169,7 +169,7 @@ function evidenceRefs(db: Database, version: string, id: string): string[] {
   return (db.query('SELECT ref FROM evidence WHERE feature_id = ? AND version = ? ORDER BY rowid').all(id, version) as Array<{ ref: string }>).map((row) => row.ref);
 }
 function items(db: Database, version: string): ChecklistItem[] {
-  const rows = db.query(`SELECT f.id, COALESCE(a.title_override, f.title) AS title, a.owner, a.kind, a.priority, a.predecessors, a.deadline_version, a.ceo_minutes, a.ceo_date, a.status, a.disposition, a.evidence, a.updated_at, a.updated_by
+  const rows = db.query(`SELECT f.id, COALESCE(a.title_override, f.title) AS title, a.owner, a.kind, a.priority, a.predecessors, a.deadline_version, a.ceo_minutes, a.ceo_date, a.accelerator, a.status, a.disposition, a.evidence, a.updated_at, a.updated_by
     FROM assignments a JOIN features f ON f.id = a.feature_id WHERE a.version = ? ORDER BY a.rowid`).all(version) as Array<Record<string, string | number | null>>;
   return rows.map((r) => {
     const evidence = [r.evidence, ...evidenceRefs(db, version, r.id as string)].filter((value) => value !== null).join('\n');
@@ -178,6 +178,7 @@ function items(db: Database, version: string): ChecklistItem[] {
       ...(r.priority !== null ? { priority: r.priority as ChecklistItem['priority'] } : {}), ...(r.predecessors !== null ? { predecessors: JSON.parse(r.predecessors as string) as string[] } : {}),
       ...(r.deadline_version !== null ? { deadlineVersion: r.deadline_version as string } : {}),
       ...(r.ceo_minutes !== null ? { ceoMinutes: r.ceo_minutes as number } : {}), ...(r.ceo_date !== null ? { ceoDate: r.ceo_date as string } : {}),
+      ...(r.accelerator === 1 ? { accelerator: true as const } : {}),
       ...(r.evidence !== null || evidence ? { evidence } : {}), ...(r.disposition !== null ? { disposition: r.disposition as ChecklistItem['disposition'] } : {}),
       updatedAt: r.updated_at as string, updatedBy: r.updated_by as string };
   });
@@ -191,9 +192,9 @@ function putItem(db: Database, version: string, item: ChecklistItem): void {
   if (!feature) db.query('INSERT INTO features (id, title, owner, kind, created_at) VALUES (?, ?, ?, ?, ?)').run(item.id, item.title, item.owner ?? null, item.kind ?? null, item.updatedAt);
   // features.owner/kind follow the latest assignment so details() and the checklist never disagree after a set.
   else if (item.owner !== undefined || item.kind !== undefined) db.query('UPDATE features SET owner = COALESCE(?, owner), kind = COALESCE(?, kind) WHERE id = ?').run(item.owner ?? null, item.kind ?? null, item.id);
-  db.query(`INSERT INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT(feature_id, version) DO UPDATE SET status=excluded.status, disposition=excluded.disposition, evidence=excluded.evidence, owner=excluded.owner, kind=excluded.kind, priority=excluded.priority, predecessors=excluded.predecessors, deadline_version=excluded.deadline_version, ceo_minutes=excluded.ceo_minutes, ceo_date=excluded.ceo_date, updated_at=excluded.updated_at, updated_by=excluded.updated_by`)
-    .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, feature && feature.title !== item.title ? item.title : null, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.updatedAt, item.updatedBy);
+  db.query(`INSERT INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, accelerator, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(feature_id, version) DO UPDATE SET status=excluded.status, disposition=excluded.disposition, evidence=excluded.evidence, owner=excluded.owner, kind=excluded.kind, priority=excluded.priority, predecessors=excluded.predecessors, deadline_version=excluded.deadline_version, ceo_minutes=excluded.ceo_minutes, ceo_date=excluded.ceo_date, accelerator=excluded.accelerator, updated_at=excluded.updated_at, updated_by=excluded.updated_by`)
+    .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, feature && feature.title !== item.title ? item.title : null, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.accelerator === true ? 1 : null, item.updatedAt, item.updatedBy);
 }
 function jsonHash(contents: string | Buffer): string { return createHash('sha256').update(contents).digest('hex'); }
 
@@ -234,8 +235,8 @@ function importOnDb(db: Database, version: string): boolean {
       // Keep a legacy per-version title until an explicit retitle unifies the feature identity.
       if (!existing) putItem(db, version, item);
       else {
-        db.query('INSERT OR IGNORE INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
-          .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, item.title === existing.title ? null : item.title, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.updatedAt, item.updatedBy);
+        db.query('INSERT OR IGNORE INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, accelerator, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+          .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, item.title === existing.title ? null : item.title, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.accelerator === true ? 1 : null, item.updatedAt, item.updatedBy);
       }
     }
     for (const entry of data.history) record(db, version, entry);
@@ -262,7 +263,7 @@ function importOnDb(db: Database, version: string): boolean {
       record(db, version, { at: new Date().toISOString(), by: item.updatedBy, id: item.id, field: 'reimport', from: null, to: item, released: data.released, dev: data.dev });
       continue;
     }
-    const fields = ['title', 'status', 'evidence', 'owner', 'disposition', 'kind', 'priority', 'predecessors', 'deadlineVersion', 'ceoMinutes', 'ceoDate'] as const;
+    const fields = ['title', 'status', 'evidence', 'owner', 'disposition', 'kind', 'priority', 'predecessors', 'deadlineVersion', 'ceoMinutes', 'ceoDate', 'accelerator'] as const;
     const baseEvidence = (db.query('SELECT evidence FROM assignments WHERE feature_id = ? AND version = ?').get(item.id, version) as { evidence: string | null }).evidence ?? undefined;
     const preserveRefs = item.evidence === baseEvidence || item.evidence === current.evidence;
     const differs = fields.some((field) => field === 'evidence'