elanous 0.2.23 → 0.2.24

package/graphs/implement-loop.yaml

@@ -32,6 +32,9 @@
 #   ⛔⭐ 그리고 ***「거른 뒤의 가장 이른 행」을 「원장의 바닥」으로 읽지 마라*** — 그 둘은 다른 값이다.
 #      바닥을 재려면 그 «필터를 빼고» 같은 이벤트의 가장 이른 행을 본다.
 
+# L0 여정 단계 목록(journey_stage 닫힌 집합) — 노드별 선언 커버리지의 분모.
+# 입구 · 저작 · 배치 · 실행 · 착지 · 실패 갈래 · 종료 (RFC ARG §L0).
+journey_stages: [entry, author, dispatch, run, land, recover, end]
 # ⛔⭐ `graph_id` 는 «원장의 조인 키»다 — 바꾸면 옛 표본과 «비교 불가»가 된다.
 #   📏 2026-09-08 실측: 원장에 graphId="self-implement" 로 15건이 이미 쌓였다.
 #   📌 RFC §4.2 는 이 템플릿을 `implement-loop` 이라 불렀지만, ***코드·원장이 쓰는 이름이 canonical***이다.
@@ -72,6 +75,7 @@ runner_inputs: [ask_text, goal, worktree, branch, review-intent, head-sha, base-
 nodes:
   - node_id: author
     group: author
+    journey_stage: author
     kind: agent
     recipe: goal-author
     max_visits: 2
@@ -84,6 +88,7 @@ nodes:
 
   - node_id: plan
     group: author
+    journey_stage: author
     kind: agent
     recipe: harness-plan-rfc
     max_visits: 2
@@ -96,6 +101,7 @@ nodes:
 
   - node_id: decompose
     group: author
+    journey_stage: author
     kind: judge
     recipe: fabric-decompose-adapter
     max_visits: 12
@@ -108,6 +114,7 @@ nodes:
 
   - node_id: implement
     group: build
+    journey_stage: run
     kind: agent
     recipe: headless-goal-loop        # seams.implement → 자식 PTY
     max_visits: 12
@@ -122,6 +129,7 @@ nodes:
 
   - node_id: gate
     group: verify
+    journey_stage: run
     kind: gate
     recipe: gate-baseline              # 변경 파일 «범위» · 새 회귀만
     max_visits: 11
@@ -136,6 +144,7 @@ nodes:
 
   - node_id: review
     group: verify
+    journey_stage: run
     kind: judge
     recipe: pr-reviewer                # agent-substrate/pr-reviewer
     max_visits: 11
@@ -150,6 +159,7 @@ nodes:
 
   - node_id: rework
     group: verify
+    journey_stage: run
     kind: agent
     recipe: headless-goal-loop         # 같은 루프의 다음 라운드
     max_visits: 10
@@ -164,6 +174,7 @@ nodes:
 
   - node_id: main-sync
     group: land
+    journey_stage: land
     kind: git
     recipe: seams-git-merge-main       # LLM 충돌해결 포함
     max_visits: 2
@@ -176,6 +187,7 @@ nodes:
 
   - node_id: regate
     group: land
+    journey_stage: land
     kind: gate
     recipe: gate-baseline              # 충돌해결 «뒤» 재-gate
     max_visits: 2
@@ -188,6 +200,7 @@ nodes:
 
   - node_id: open-pr
     group: land
+    journey_stage: land
     kind: git
     recipe: seams-gh-open-pr
     # 📏 실측 2026-09-08 (원장 30일 · 전 우주 · 걸음 191개 소급 계산):
@@ -204,6 +217,7 @@ nodes:
 
   - node_id: merge
     group: land
+    journey_stage: land
     kind: git
     recipe: seams-gh-merge-squash
     # 📏 실측 2026-09-08 (원장 30일 · 전 우주 · 걸음 191개 소급 계산):
@@ -222,6 +236,7 @@ nodes:
   # ───────── 여정 앞단: 입구 → 대기열 → 발사 관문 → 배치 ─────────
   - node_id: intake
     group: entry
+    journey_stage: entry
     kind: observe
     recipe: harness-entrance            # src/harness/harness-cli-command.ts (say · ask · TUI /harness)
     max_visits: 1
@@ -233,6 +248,7 @@ nodes:
 
   - node_id: queue
     group: entry
+    journey_stage: entry
     kind: gate
     recipe: harness-queue               # src/harness/harness-queue.ts (directSay 플래그 · 기본 끔 → 건너뜀)
     max_visits: 1
@@ -244,6 +260,7 @@ nodes:
 
   - node_id: launch-gate
     group: entry
+    journey_stage: entry
     kind: gate
     recipe: pre-launch-gate             # harness-cli-command.ts preLaunchGate (예산 · 같은 골 활성 런)
     max_visits: 1
@@ -255,6 +272,7 @@ nodes:
 
   - node_id: dispatch
     group: dispatch
+    journey_stage: dispatch
     kind: judge
     recipe: harness-substrate-select    # resolveLaunchSubstrate → substrate = local | pod
     max_visits: 2
@@ -267,6 +285,7 @@ nodes:
   # ───────── Pod 배치 (substrate == pod 일 때만 — local 은 건너뛴다) ─────────
   - node_id: pool-admit
     group: dispatch-pod
+    journey_stage: dispatch
     kind: gate
     recipe: pod-pool-admission          # src/task-orchestrator/surfaces/self-implement-pod.ts (입장 · 멤버 슬롯 · 메모리 등급)
     max_visits: 4
@@ -278,6 +297,7 @@ nodes:
 
   - node_id: image-sync
     group: dispatch-pod
+    journey_stage: dispatch
     kind: gate
     recipe: pod-pool-image-sync         # src/task-orchestrator/surfaces/pod-pool.ts syncPoolImages (멤버별 · pack 한 번)
     max_visits: 4
@@ -289,6 +309,7 @@ nodes:
 
   - node_id: credential-refresh
     group: dispatch-pod
+    journey_stage: dispatch
     kind: gate
     recipe: pod-credential-prerefresh   # self-implement-pod.ts podCodexCredentialWithPrerefresh
     max_visits: 4
@@ -301,6 +322,7 @@ nodes:
   # ───────── 착지: 동결 검사 → (보류) → 병합 → 회수 ─────────
   - node_id: freeze-check
     group: land
+    journey_stage: land
     kind: gate
     recipe: landing-freeze-admission    # src/self-implement/frozen-merges.ts admitLandingMerge (병합 직전 한 곳)
     max_visits: 4
@@ -312,6 +334,7 @@ nodes:
 
   - node_id: hold
     group: land
+    journey_stage: land
     kind: hitl
     recipe: frozen-merge-queue          # frozen-merges.ts queueFrozenMerge → sweepFrozenMerges 가 해제 뒤 재개
     max_visits: 4
@@ -323,6 +346,7 @@ nodes:
 
   - node_id: cleanup
     group: land
+    journey_stage: land
     kind: git
     recipe: post-merge-cleanup          # src/self-implement/orchestrator.ts (워크트리 ⊕ 브랜치 회수)
     max_visits: 1
@@ -335,6 +359,7 @@ nodes:
   # ───────── 실패 쪽: 결과 해석 → 수확 → heal → 다음 한 수 ─────────
   - node_id: result-parse
     group: recover
+    journey_stage: recover
     kind: observe
     recipe: pod-failure-reason          # src/task-orchestrator/surfaces/pod-failure-reason.ts
     max_visits: 4
@@ -346,6 +371,7 @@ nodes:
 
   - node_id: salvage
     group: recover
+    journey_stage: recover
     kind: git
     recipe: salvage-branch              # salvage/si-task-<job>/… (Pod Job 이 push · salvage-branches.ts 가 읽는다)
     max_visits: 4
@@ -355,8 +381,11 @@ nodes:
       tools: git-write
       outputs: [salvage_ref]
 
+  # 🩹 멈춤 갈래(stop_class)별 처방 노드는 «여기 없다» — 런타임 오버레이 `graphs/overlays/stop-heal-ladder.yaml` 이
+  #   `heal` 에서 `on: stop_class` 간선으로 갈라지는 노드(id = 처방 이름)를 얹는다. 읽는 쪽 = `stop-autoheal.ts`.
   - node_id: heal
     group: recover
+    journey_stage: recover
     kind: judge
     recipe: heal-intake                 # src/self-implement/heal-intake.ts (호스트에서만)
     max_visits: 4
@@ -368,6 +397,7 @@ nodes:
 
   - node_id: next-move
     group: recover
+    journey_stage: recover
     kind: judge
     recipe: task-agent-judge            # src/task-agent/judge.ts (판단부 → 실행부)
     max_visits: 4
@@ -379,6 +409,7 @@ nodes:
 
   - node_id: stopped
     group: end
+    journey_stage: end
     kind: observe
     recipe: journey-stopped             # 거절·포기 — 종결
     max_visits: 1

package/graphs/ops/harness-gc.yaml

@@ -0,0 +1,17 @@
+graph_id: harness-gc
+loop:
+  title: Harness GC
+  description: Reclaim only ladder-safe harness worktrees and merged branch-only refs in bounded ticks
+  owner: OP
+  trigger:
+    cron: '*/10 * * * *'
+    events: [manual]
+version: 1
+entry_node: tick
+terminal_nodes: [done, failed]
+nodes:
+  - { node_id: tick, kind: agent, recipe: 'cmd:harness-gc-tick', max_visits: 1 }
+  - { node_id: done, kind: gate, max_visits: 1 }
+  - { node_id: failed, kind: gate, max_visits: 1 }
+edges:
+  - { from: tick, on: outcome, map: { ok: done, skipped: done, fail: failed, error: failed } }

package/graphs/ops/recipes.yaml

@@ -12,3 +12,6 @@ secret-exposure-scan:
 guardian-shadow:
   command: 'bun "$ELANOUS_GRAPH_DIR/../../bin/elanous.mjs" guardian tick'
   timeout_ms: 120000
+harness-gc-tick:
+  command: 'bun "$ELANOUS_GRAPH_DIR/../../src/harness/harness-gc.ts" --json'
+  timeout_ms: 300000

package/graphs/overlays/README.md

@@ -18,7 +18,7 @@
 ```yaml
 overlay_id: patient-research
 target: default-loop
-stage: launch            # launch | runtime
+stage: launch            # launch | runtime | heal(멈춤 갈래 사다리 전용 · stop-autoheal 만 읽는다)
 patch:
   - op: replace
     path: /nodes/2/max_visits

package/graphs/overlays/stop-heal-ladder.yaml

@@ -0,0 +1,105 @@
+# 멈춤 갈래 사다리(STOP-AUTOHEAL)를 «선언»으로 — 0.2.24 GRAPH-HEAL-NODES 첫 조각.
+#
+# 한 문서(`---` 로 나눈다) = 멈춤 갈래 하나 = 처방 노드 하나. 조건은 실행기가 이미 주는 `stop_class` 다.
+#   stop_class == env-unrelated      → clean-workspace-regate
+#   stop_class == main-sync          → rebase-regate
+#   stop_class == pod-died           → resume-from-salvage
+#   stop_class == evidence-uncovered → derive-evidence-rejudge
+# ⛔ 이 넷 밖의 갈래(review-repeat · review-out-of-scope · fabric · launch-failed · unclassified)는 선언이 «없다» —
+#   처방은 `needs-owner` 이고 그것은 코드 기본(`AUTOHEAL_ACTION_BY_CLASS`)이 말한다.
+#
+# 🔑 노드 id 가 곧 처방 이름이다. `src/self-implement/stop-autoheal.ts` 는 그 갈래에 얹힌 오버레이가 «더한 노드 id» 로
+#   처방을 고르고, 선언이 없거나 못 읽으면 코드 표로 간다(원장·관측의 `source` = graph | code-default).
+#   ⇒ 이 파일과 코드 표가 «같은 답»을 내는지는 시험이 문다(stop-autoheal.test.ts).
+# ⚠️ 이 조각은 표를 선언으로 «옮기기만» 한다 — 노드의 recipe 는 주입 seam 이름(`stopAutohealActions`)이다.
+#   새 처방 노드(예: strategy-switch)는 다음 조각이다.
+#
+# 🚨 경로·값은 «파싱된 스펙» 키(camelCase)다 — `nodeId`·`maxVisits`.
+# ⛔ stage 는 `heal` 이다 — `runtime` 이면 실행기가 라운드마다 원장의 stop 줄로 `stop_class` 를 채워 이 노드들을
+#   «실행 그래프»에 얹는다(버전 해시·원장 값이 바뀐다). `heal` 은 `stop-autoheal.ts` 만 고른다.
+# 📌 한 번만 시도한다(원장 가드와 같은 규율) — 그래서 maxVisits 1 이다.
+# 📌 들어오는 간선 = `heal` 이 stop_class 로 가른다 · 나가는 간선 = 처방 결과(healed → 재발사 · needs-owner → 종결).
+---
+overlay_id: stop-heal-ladder-env-unrelated
+target: self-implement
+stage: heal
+applies_when: stop_class == env-unrelated
+patch:
+  - op: add
+    path: /nodes/-
+    value:
+      nodeId: clean-workspace-regate
+      kind: gate
+      recipe: stop-autoheal:clean-workspace-regate
+      maxVisits: 1
+      journeyStage: recover
+      contract: { inputs: [worktree], tools: read-and-run-tests, outputs: [passed, gate-log] }
+  - op: add
+    path: /edges/-
+    value: { from: heal, on: stop_class, map: { env-unrelated: clean-workspace-regate } }
+  - op: add
+    path: /edges/-
+    value: { from: clean-workspace-regate, on: outcome, map: { healed: dispatch, needs-owner: stopped } }
+---
+overlay_id: stop-heal-ladder-main-sync
+target: self-implement
+stage: heal
+applies_when: stop_class == main-sync
+patch:
+  - op: add
+    path: /nodes/-
+    value:
+      nodeId: rebase-regate
+      kind: git
+      recipe: stop-autoheal:rebase-regate
+      maxVisits: 1
+      journeyStage: recover
+      contract: { inputs: [worktree, base-branch], tools: git-write, outputs: [synced, passed] }
+  - op: add
+    path: /edges/-
+    value: { from: heal, on: stop_class, map: { main-sync: rebase-regate } }
+  - op: add
+    path: /edges/-
+    value: { from: rebase-regate, on: outcome, map: { healed: dispatch, needs-owner: stopped } }
+---
+overlay_id: stop-heal-ladder-pod-died
+target: self-implement
+stage: heal
+applies_when: stop_class == pod-died
+patch:
+  - op: add
+    path: /nodes/-
+    value:
+      nodeId: resume-from-salvage
+      kind: git
+      recipe: stop-autoheal:resume-from-salvage
+      maxVisits: 1
+      journeyStage: recover
+      contract: { inputs: [salvage_ref], tools: git-write, outputs: [resumed] }
+  - op: add
+    path: /edges/-
+    value: { from: heal, on: stop_class, map: { pod-died: resume-from-salvage } }
+  - op: add
+    path: /edges/-
+    value: { from: resume-from-salvage, on: outcome, map: { healed: dispatch, needs-owner: stopped } }
+---
+overlay_id: stop-heal-ladder-evidence-uncovered
+target: self-implement
+stage: heal
+applies_when: stop_class == evidence-uncovered
+patch:
+  - op: add
+    path: /nodes/-
+    value:
+      nodeId: derive-evidence-rejudge
+      kind: judge
+      recipe: stop-autoheal:derive-evidence-rejudge
+      maxVisits: 1
+      journeyStage: recover
+      contract: { inputs: [diff, review-summary], tools: read-only, outputs: [verdict] }
+  - op: add
+    path: /edges/-
+    value: { from: heal, on: stop_class, map: { evidence-uncovered: derive-evidence-rejudge } }
+  - op: add
+    path: /edges/-
+    value: { from: derive-evidence-rejudge, on: outcome, map: { healed: dispatch, needs-owner: stopped } }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "elanous",
   "mcpName": "io.github.ElanvitalAI/elanous",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "description": "Self-healing coding harness where eyes, hands, and memory all turn on one sentence — it authors its own goals, implements them in isolated worktrees, and reviews its own work.",
   "license": "Apache-2.0",
   "author": "Elanvital AI",

package/scripts/add-api-key.sh

@@ -121,7 +121,7 @@ REFRESH="$(dirname "$LOADER")/refresh_api_key_cache.sh"
 if [ -f "$REFRESH" ] && ! grep -q "\"$ENV_NAME\"" "$REFRESH"; then
   echo ""
   echo "   🔲 ⓷ 다른 기계에도 퍼뜨리려면 — ⛔ «자동으로 안 넣었다»"
-  echo "      먼저 AWS Secrets Manager 에 비밀 «$ENV_NAME» 을 만들고, 그 «뒤»에:"
+  echo "      먼저 AWS Secrets Manager 에 비밀 «${ENV_NAME}» 을 만들고, 그 «뒤»에:"
   echo "        fetch_secret \"$ENV_NAME\" \"\${CACHE_DIR}/$FILE_NAME\""
   echo "      ⚠️ 비밀이 «없는» 상태로 넣으면 그 스크립트가 set -e 라 다른 키 갱신까지 멈춘다."
 fi

package/scripts/ci-typecheck-changed.ts

@@ -13,7 +13,16 @@ import {
   type TypecheckError,
 } from '../src/typecheck-ratchet.js';
 import { debug } from '../src/debug/log.js';
-import { tscEnv } from '../src/typecheck-ratchet.js';
+import {
+  ROOT_PLACEHOLDER,
+  baselineCacheEnabled,
+  computeBaselineCacheKey,
+  lookupBaselineCache,
+  storeBaselineCache,
+  toPlaceholderPaths,
+  type BaselineCacheOptions,
+} from './tsc-baseline-cache.js';
+import { TSC_OOM_RETRY_HEAP_MB, TSC_HEAP_MB, tscEnv } from '../src/typecheck-ratchet.js';
 
 /** Inherited GIT_DIR / GIT_WORK_TREE would make `--cwd <other tree>` still read the launcher's repo. */
 function gitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
@@ -40,19 +49,26 @@ function sh(cmd: string, cwd = process.cwd()): string {
 
 export type TscRun = { out: string; ran: boolean; why?: string };
 
-export { TSC_HEAP_MB, tscEnv } from '../src/typecheck-ratchet.js';
+export { TSC_HEAP_MB, TSC_OOM_RETRY_HEAP_MB, tscEnv } from '../src/typecheck-ratchet.js';
 /** V8 힙 부족의 얼굴 — 「타입 에러」와 «다른 값»이다. */
 const OOM = /heap out of memory|Ineffective mark-compacts near heap limit/;
 
 /** tsc 실행 결과 — 실행 여부와 진단 출력을 분리한다. */
 export function runTsc(cmd: string, exec = execSync): TscRun {
-  try {
-    const out = exec(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], env: tscEnv(), maxBuffer: 64 * 1024 * 1024 }) as unknown as string;
-    return { out: String(out ?? ''), ran: true };
-  } catch (error: unknown) {
-    const e = error as { status?: number | null; signal?: string | null; stdout?: string; stderr?: string; code?: string };
-    const out = `${e.stdout ?? ''}${e.stderr ?? ''}`;
-    if (OOM.test(out)) return { out, ran: false, why: `tsc 가 V8 힙 부족(OOM)으로 죽었다 — 타입 에러가 아니다 (NODE_OPTIONS=${tscEnv().NODE_OPTIONS})` };
+  type Attempt = { out: string; error?: { status?: number | null; signal?: string | null; code?: string } };
+  const run = (env: NodeJS.ProcessEnv): Attempt => {
+    try {
+      const out = exec(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], env, maxBuffer: 64 * 1024 * 1024 }) as unknown as string;
+      return { out: String(out ?? '') };
+    } catch (error: unknown) {
+      const e = error as { status?: number | null; signal?: string | null; stdout?: string; stderr?: string; code?: string };
+      return { out: `${e.stdout ?? ''}${e.stderr ?? ''}`, error: e };
+    }
+  };
+  const result = (attempt: Attempt, env: NodeJS.ProcessEnv): TscRun => {
+    const { out, error: e } = attempt;
+    if (OOM.test(out)) return { out, ran: false, why: `tsc 가 V8 힙 부족(OOM)으로 죽었다 — 타입 에러가 아니다 (NODE_OPTIONS=${env.NODE_OPTIONS})` };
+    if (!e) return { out, ran: true };
     if (e.signal || e.code === 'ENOENT' || e.status === null || e.status === undefined) {
       return { out, ran: false, why: `tsc 실행 실패 (signal=${String(e.signal)} code=${String(e.code)} status=${String(e.status)})` };
     }
@@ -64,7 +80,23 @@ export function runTsc(cmd: string, exec = execSync): TscRun {
       return { out, ran: false, why: `tsc 가 종료코드 ${e.status} 로 끝났는데 TS 진단이 한 건도 없다(래퍼 실패로 본다)` };
     }
     return { out, ran: true };
-  }
+  };
+
+  const initialEnv = tscEnv();
+  const initial = run(initialEnv);
+  if (!OOM.test(initial.out)) return result(initial, initialEnv);
+
+  const retryEnv = {
+    ...initialEnv,
+    NODE_OPTIONS: `${(initialEnv.NODE_OPTIONS ?? '').replace(/--max-old-space-size(?:=|\s+)\d+/g, '').trim()} --max-old-space-size=${TSC_OOM_RETRY_HEAP_MB}`.trim(),
+  };
+  const retryResult = result(run(retryEnv), retryEnv);
+  debug.log('harness.host-regate', 'tsc-oom-retry', {
+    heapFrom: TSC_HEAP_MB,
+    heapTo: TSC_OOM_RETRY_HEAP_MB,
+    result: retryResult,
+  });
+  return retryResult;
 }
 
 export type ChangedTsFiles = {
@@ -784,7 +816,27 @@ export function rebaseWorktreePaths(diagnostics: readonly TypecheckError[], work
   return diagnostics.map((diagnostic) => ({ ...diagnostic, line: rebase(diagnostic.line), file: rebase(diagnostic.file) }));
 }
 
-export function readMergeBaseDiagnostics(base: string, command: string, cwd = process.cwd(), run = runTsc): BaselineDiagnostics {
+export type BaselineCacheIo = BaselineCacheOptions & { log?: (message: string) => void };
+
+/**
+ * 같은 base 커밋 ⊕ 같은 명령 ⊕ 같은 설정 해시면 저장된 진단을 재사용한다(워크트리·tsc 0회).
+ * 캐시의 어떤 실패도 던지지 않는다 — miss 로 떨어져 아래 측정이 그대로 돈다.
+ */
+function lookupCachedBaseline(key: string, command: string, cwd: string, cacheIo: BaselineCacheIo): BaselineDiagnostics | undefined {
+  const lookup = lookupBaselineCache(key, cacheIo);
+  const result = lookup.result === 'hit' ? 'hit' : lookup.result === 'corrupt' ? 'corrupt' : 'miss';
+  cacheIo.log?.(`[tsc-gate] typecheck baseline-cache ${result === 'hit' ? 'hit' : 'miss'} ${key.slice(0, 12)}`);
+  debug.log('typecheck.gate', 'baseline-cache', { result, key, command });
+  if (lookup.result !== 'hit') return undefined;
+  return { diagnostics: rebaseWorktreePaths(lookup.diagnostics, ROOT_PLACEHOLDER, cwd) };
+}
+
+export function readMergeBaseDiagnostics(base: string, command: string, cwd = process.cwd(), run = runTsc, cacheIo: BaselineCacheIo = {}): BaselineDiagnostics {
+  const cacheKey = baselineCacheEnabled(cacheIo.env ?? process.env) ? computeBaselineCacheKey(base, command, cwd, cacheIo) : undefined;
+  if (cacheKey) {
+    const cached = lookupCachedBaseline(cacheKey, command, cwd, cacheIo);
+    if (cached) return cached;
+  }
   const workspace = mkdtempSync(join(tmpdir(), 'ci-typecheck-baseline-'));
   const worktree = join(workspace, 'base');
   try {
@@ -798,7 +850,11 @@ export function readMergeBaseDiagnostics(base: string, command: string, cwd = pr
       execSync(cmd, { ...options, cwd: worktree, maxBuffer: 64 * 1024 * 1024, env: tscEnv() }) as string) as typeof execSync;
     const result = run(command, baselineExec);
     if (!result.ran) return { unavailable: result.why ?? '기준 worktree tsc 실행 실패' };
-    return { diagnostics: rebaseWorktreePaths(parseTypecheckErrors(result.out), worktree, cwd) };
+    const measured = parseTypecheckErrors(result.out);
+    if (cacheKey && !storeBaselineCache(cacheKey, command, toPlaceholderPaths(measured, worktree), cacheIo)) {
+      debug.log('typecheck.gate', 'baseline-cache', { result: 'store-failed', key: cacheKey, command });
+    }
+    return { diagnostics: rebaseWorktreePaths(measured, worktree, cwd) };
   } catch (error) {
     return { unavailable: error instanceof Error ? error.message : String(error) };
   } finally {
@@ -889,8 +945,9 @@ function inspectTscResult(tsc: TscRun, changed: ReadonlySet<string>, baseline: R
 export function runGate(io: Partial<GateIo> = {}): void {
   const cwd = io.cwd ?? process.cwd();
   const defaultChanged = () => changedTsFiles((cmd) => sh(cmd, cwd), process.env, cwd, io.baseRef);
-  const { changedTsFiles: getChanged = defaultChanged, runTscCmd = (cmd: string) => runTsc(cmd, ((command, options) => execSync(command, { ...options, cwd, env: tscExecEnv(options?.env) })) as typeof execSync), log = (message: string) => console.log(message), warn = (message: string) => console.warn(message), error = (message: string) => console.error(message), exit = ((code: number) => process.exit(code)) as GateIo['exit'] } = io;
-  const readBaselineDiagnostics = io.readBaselineDiagnostics ?? ((base: string, command: string) => readMergeBaseDiagnostics(base, command, cwd));
+  const defaultRunTsc = (cmd: string) => runTsc(cmd, ((command, options) => execSync(command, { ...options, cwd, env: tscExecEnv(options?.env) })) as typeof execSync);
+  const { changedTsFiles: getChanged = defaultChanged, runTscCmd = defaultRunTsc, log = (message: string) => console.log(message), warn = (message: string) => console.warn(message), error = (message: string) => console.error(message), exit = ((code: number) => process.exit(code)) as GateIo['exit'] } = io;
+  const readBaselineDiagnostics = io.readBaselineDiagnostics ?? ((base: string, command: string) => readMergeBaseDiagnostics(base, command, cwd, runTsc, { log }));
   // Set 주입은 기존 테스트 심이며 기준 revision이 없다. 실제 ChangedTsFiles 경로만 Git 관측을 요구한다.
   const requiredExportFields = io.requiredExportFields ?? ((changed: ReadonlySet<string>, base: string) => base === 'injected test seam'
     ? { fields: [], removedSymbols: [], parameterIncreases: [] }

package/scripts/fleet/bedrock-pod-secret.ts

@@ -0,0 +1,122 @@
+#!/usr/bin/env bun
+/**
+ * BEDROCK-PROVIDER ② (0.2.24) — 호스트 `~/.aws` 프로필 → 풀 클러스터의 bedrock Pod 전용 Secret(`elanous-bedrock-aws`).
+ *
+ * ⛔ 값은 터미널·로그·파일 어디에도 안 낸다 — 자격은 메모리에서 바로 `kubectl apply -f -` 의 stdin 으로만 간다.
+ *   출력은 «키 이름 · 리전 · 대상» 뿐이다.
+ * ⛔ 기본은 «계획만»(dry-run · 클러스터 접촉 0). 실제로 만들려면 `--apply` — 대표·OP 승인 뒤에만 친다.
+ * ⛔ 임시 자격(세션 토큰 · SSO/역할)은 기본 거부 — Pod 수명 중 만료되면 자식이 403 으로 죽는다. Pod 용 정적 키(IAM 사용자 · bedrock-mantle:CreateInference 만)를 쓴다.
+ *
+ * 사용:
+ *   bun scripts/fleet/bedrock-pod-secret.ts --context k3d-elanous-pool                      # 계획만(키 이름)
+ *   bun scripts/fleet/bedrock-pod-secret.ts --context k3d-elanous-pool --apply              # 만든다/갱신한다
+ *   옵션: --profile <이름>(기본 elanous-bedrock) · --namespace <ns>(기본 elanous-test) · --region <r>(기본 프로필 region)
+ *         --allow-session-token(임시 자격을 알고 싣는다)
+ * 짝: docker/h1/policy-bedrock.yaml(이그레스) · src/task-orchestrator/surfaces/pod-bedrock-child.ts(발사 전 판정)
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { BEDROCK_POD_SECRET_NAME } from '../../src/task-orchestrator/surfaces/pod-bedrock-child.js';
+import { regionFromAwsConfigText, validBedrockRegion, type BedrockCredentials } from '../../src/llm/bedrock.js';
+
+export interface BedrockSecretArgs {
+  context?: string;
+  namespace: string;
+  profile: string;
+  region?: string;
+  apply: boolean;
+  allowSessionToken: boolean;
+}
+
+export function parseArgs(argv: readonly string[]): BedrockSecretArgs | { error: string } {
+  const out: BedrockSecretArgs = { namespace: 'elanous-test', profile: 'elanous-bedrock', apply: false, allowSessionToken: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]!;
+    const value = () => { const v = argv[++i]; if (!v || v.startsWith('--')) throw new Error(`${a} 에 값이 없다`); return v; };
+    try {
+      if (a === '--context') out.context = value();
+      else if (a === '--namespace') out.namespace = value();
+      else if (a === '--profile') out.profile = value();
+      else if (a === '--region') out.region = value();
+      else if (a === '--apply') out.apply = true;
+      else if (a === '--allow-session-token') out.allowSessionToken = true;
+      else return { error: `모르는 인자: ${a}` };
+    } catch (e) { return { error: (e as Error).message }; }
+  }
+  if (!out.context) return { error: '--context <풀 문맥> 이 필요하다 — 어느 클러스터에 둘지 명시한다(기본 문맥에 조용히 쓰지 않는다)' };
+  return out;
+}
+
+/** Secret 매니페스트 — 값은 이 객체 안에만 있고, 호출자는 stdin 으로만 넘긴다. */
+export function bedrockPodSecretManifest(input: { namespace: string; region: string; credentials: BedrockCredentials; name?: string }): Record<string, unknown> {
+  return {
+    apiVersion: 'v1', kind: 'Secret', type: 'Opaque',
+    metadata: { name: input.name ?? BEDROCK_POD_SECRET_NAME, namespace: input.namespace, labels: { 'elanous.secret': 'bedrock-aws' } },
+    stringData: {
+      AWS_ACCESS_KEY_ID: input.credentials.accessKeyId,
+      AWS_SECRET_ACCESS_KEY: input.credentials.secretAccessKey,
+      ...(input.credentials.sessionToken ? { AWS_SESSION_TOKEN: input.credentials.sessionToken } : {}),
+      AWS_REGION: input.region,
+    },
+  };
+}
+
+/** 사람에게 보이는 계획 — 키 «이름»만. */
+export function describePlan(args: BedrockSecretArgs, region: string, manifest: Record<string, unknown>): string {
+  const keys = Object.keys((manifest as { stringData: Record<string, string> }).stringData);
+  return [
+    `대상: --context ${args.context} · ${args.namespace}/${BEDROCK_POD_SECRET_NAME}`,
+    `출처: ~/.aws 프로필 ${args.profile} · 리전 ${region}`,
+    `키: ${keys.join(', ')} (값은 출력하지 않는다)`,
+  ].join('\n');
+}
+
+export interface Deps {
+  resolve: (profile: string) => Promise<BedrockCredentials>;
+  readConfig: () => string | undefined;
+  kubectl: (args: string[], stdin: string) => { status: number | null; stdout: string; stderr: string };
+  print: (line: string) => void;
+}
+
+const defaultDeps: Deps = {
+  resolve: async (profile) => {
+    const { defaultProvider } = await import('@aws-sdk/credential-provider-node');
+    const c = await defaultProvider({ profile })();
+    return { accessKeyId: c.accessKeyId, secretAccessKey: c.secretAccessKey, ...(c.sessionToken ? { sessionToken: c.sessionToken } : {}) };
+  },
+  readConfig: () => {
+    const p = process.env.AWS_CONFIG_FILE?.trim() || join(homedir(), '.aws', 'config');
+    try { return existsSync(p) ? readFileSync(p, 'utf8') : undefined; } catch { return undefined; }
+  },
+  kubectl: (args, stdin) => {
+    const r = spawnSync('kubectl', args, { input: stdin, encoding: 'utf8', timeout: 60_000 });
+    return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
+  },
+  print: (line) => console.log(line),
+};
+
+export async function run(argv: readonly string[], deps: Deps = defaultDeps): Promise<number> {
+  const args = parseArgs(argv);
+  if ('error' in args) { deps.print(`⛔ ${args.error}`); return 2; }
+  const region = validBedrockRegion(args.region ?? regionFromAwsConfigText(deps.readConfig() ?? '', args.profile));
+  if (!region) { deps.print(`⛔ 리전 없음 — --region 또는 ~/.aws/config 의 [profile ${args.profile}] region`); return 2; }
+  let credentials: BedrockCredentials;
+  try { credentials = await deps.resolve(args.profile); }
+  catch (e) { deps.print(`⛔ 프로필 ${args.profile} 자격을 못 풀었다 (${(e as { name?: string })?.name ?? 'Error'})`); return 2; }   // ⛔ 메시지 원문은 싣지 않는다
+  if (credentials.sessionToken && !args.allowSessionToken) {
+    deps.print('⛔ 임시 자격(세션 토큰)이다 — Pod 수명 중 만료된다. Pod 용 정적 키를 쓰거나, 알고 싣는다면 --allow-session-token');
+    return 2;
+  }
+  const manifest = bedrockPodSecretManifest({ namespace: args.namespace, region, credentials });
+  deps.print(describePlan(args, region, manifest));
+  if (!args.apply) { deps.print('계획만(dry-run) — 클러스터에 쓰지 않았다. 만들려면 --apply(승인 뒤)'); return 0; }
+  const r = deps.kubectl(['--context', args.context!, 'apply', '-f', '-'], JSON.stringify(manifest));
+  // kubectl apply 의 출력은 «secret/<이름> created|configured» 뿐이다 — stderr 는 원문 대신 rc 만.
+  if (r.status !== 0) { deps.print(`⛔ kubectl apply 실패 rc=${r.status}`); return 1; }
+  deps.print(`✅ ${r.stdout.trim().split('\n')[0] ?? 'applied'}`);
+  return 0;
+}
+
+if (import.meta.main) process.exit(await run(process.argv.slice(2)));