elanous 0.2.23 → 0.2.24

package/src/images/image-ledger.ts

@@ -0,0 +1,179 @@
+/**
+ * IMAGE-LEDGER-TAGS (RFC-adaptive-graph-ops §9.11) — first slice: the image ledger.
+ *
+ * The registry tag itself carries only the 12-char commit (docker/harness/build.sh:276), so the
+ * identity of an image (why it exists, how long to keep it) lives in a small append-only ledger
+ * next to the config that pins it (`<config dir>/image-ledger.jsonl`). Writers append events;
+ * readers fold them per tag. A registry tag with no ledger row is `transient` (RFC §9.11).
+ *
+ * Writers in this slice: the baseline pin (`config set harness.imageCommit <commit>` — the rail
+ * pins through that command). Launch · gate · release writers and `image tag` are later slices.
+ *
+ * Unreadable is never "none": a ledger line that fails to parse is counted, and a registry that
+ * cannot be read is reported as `null` (not as an empty tag list).
+ */
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { hostname } from 'node:os';
+import { dirname, join } from 'node:path';
+import { getElanousConfigDir } from '../elanous-config-dir.js';
+
+export const IMAGE_ROLES = ['baseline', 'release', 'gate', 'demo', 'candidate', 'transient'] as const;
+export type ImageRole = typeof IMAGE_ROLES[number];
+export const IMAGE_KEEPS = ['pin', 'long', 'short', 'gc'] as const;
+export type ImageKeep = typeof IMAGE_KEEPS[number];
+export const IMAGE_ORIGIN_REASONS = ['rail', 'launch', 'gate', 'release', 'manual', 'config-set'] as const;
+export type ImageOriginReason = typeof IMAGE_ORIGIN_REASONS[number];
+
+export interface ImageLedgerEvent {
+  readonly v: 1;
+  readonly ts: string;
+  /** Registry tag = first 12 hex chars of the commit (build.sh:276). */
+  readonly tag: string;
+  readonly commit: string;
+  readonly role: ImageRole;
+  readonly keep: ImageKeep;
+  readonly origin: { readonly host: string; readonly reason: ImageOriginReason };
+}
+
+export interface ImageLedgerRead {
+  readonly path: string;
+  readonly exists: boolean;
+  readonly events: readonly ImageLedgerEvent[];
+  /** Lines that were present but did not parse as a ledger event. */
+  readonly unreadableLines: number;
+}
+
+export interface ImageLedgerRow {
+  readonly tag: string;
+  readonly commit: string;
+  readonly role: ImageRole;
+  readonly keep: ImageKeep;
+  /** Origin of the first event for this tag · null for a registry-only (unledgered) tag — its origin is unknown. */
+  readonly origin: { readonly host: string; readonly reason: ImageOriginReason } | null;
+  readonly firstTs: string;
+  readonly lastTs: string;
+  /** For `baseline`: true only for the most recently pinned baseline. */
+  readonly current: boolean;
+  /** true when the tag is on the registry · false when not · null when the registry was not read. */
+  readonly inRegistry: boolean | null;
+  /** true when the row comes only from the registry (no ledger event) — always role `transient`. */
+  readonly unledgered: boolean;
+}
+
+const HEX = /^[0-9a-f]{12,40}$/u;
+
+export function imageLedgerPath(configDir: string = getElanousConfigDir()): string {
+  return join(configDir, 'image-ledger.jsonl');
+}
+
+export function imageTag(commit: string): string {
+  return commit.trim().toLowerCase().slice(0, 12);
+}
+
+function isEvent(value: unknown): value is ImageLedgerEvent {
+  if (!value || typeof value !== 'object') return false;
+  const e = value as Record<string, unknown>;
+  const origin = e.origin as Record<string, unknown> | undefined;
+  return e.v === 1 && typeof e.ts === 'string' && typeof e.tag === 'string' && /^[0-9a-f]{12}$/u.test(e.tag)
+    && typeof e.commit === 'string' && HEX.test(e.commit)
+    && (IMAGE_ROLES as readonly unknown[]).includes(e.role) && (IMAGE_KEEPS as readonly unknown[]).includes(e.keep)
+    && !!origin && typeof origin.host === 'string' && (IMAGE_ORIGIN_REASONS as readonly unknown[]).includes(origin.reason);
+}
+
+export function readImageLedger(path: string = imageLedgerPath()): ImageLedgerRead {
+  if (!existsSync(path)) return { path, exists: false, events: [], unreadableLines: 0 };
+  const events: ImageLedgerEvent[] = [];
+  let unreadableLines = 0;
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    if (line.trim() === '') continue;
+    try {
+      const parsed: unknown = JSON.parse(line);
+      if (isEvent(parsed)) events.push(parsed); else unreadableLines += 1;
+    } catch { unreadableLines += 1; }
+  }
+  return { path, exists: true, events, unreadableLines };
+}
+
+export function appendImageLedgerEvent(event: ImageLedgerEvent, path: string = imageLedgerPath()): void {
+  if (!isEvent(event)) throw new Error(`invalid image ledger event: ${JSON.stringify(event)}`);
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+}
+
+/** The baseline pin event — what `config set harness.imageCommit <commit>` records. */
+export function baselinePinEvent(commit: string, deps: { now?: () => Date; host?: string } = {}): ImageLedgerEvent {
+  const c = commit.trim().toLowerCase();
+  if (!HEX.test(c)) throw new Error(`not a commit (hex 12~40): ${commit}`);
+  return {
+    v: 1,
+    ts: (deps.now?.() ?? new Date()).toISOString(),
+    tag: imageTag(c),
+    commit: c,
+    role: 'baseline',
+    keep: 'pin',
+    origin: { host: deps.host ?? hostname(), reason: 'config-set' },
+  };
+}
+
+/**
+ * Fold events per tag (the last event decides role and keep), then add registry tags that have no
+ * ledger event as `transient`. `registryTags === null` means the registry was not read.
+ * Non-commit registry tags (`latest`) are moving aliases and are not rows.
+ */
+export function foldImageLedger(events: readonly ImageLedgerEvent[], registryTags: readonly string[] | null): ImageLedgerRow[] {
+  const byTag = new Map<string, { first: ImageLedgerEvent; last: ImageLedgerEvent }>();
+  // Events for one tag may carry the 12-char tag or the full 40-char commit; the row keeps the longest one seen.
+  const fullCommit = new Map<string, string>();
+  for (const e of events) {
+    const seen = byTag.get(e.tag);
+    if (!seen) byTag.set(e.tag, { first: e, last: e });
+    else if (e.ts >= seen.last.ts) seen.last = e;
+    if (e.commit.length > (fullCommit.get(e.tag)?.length ?? 0)) fullCommit.set(e.tag, e.commit);
+  }
+  let currentBaseline: string | null = null;
+  let currentTs = '';
+  for (const e of events) if (e.role === 'baseline' && e.ts >= currentTs) { currentBaseline = e.tag; currentTs = e.ts; }
+  const registry = registryTags === null ? null : new Set(registryTags.filter((t) => /^[0-9a-f]{12}$/u.test(t)));
+  const rows: ImageLedgerRow[] = [...byTag.values()].map(({ first, last }) => ({
+    tag: last.tag,
+    commit: fullCommit.get(last.tag) ?? last.commit,
+    role: last.role,
+    keep: last.keep,
+    origin: first.origin,
+    firstTs: first.ts,
+    lastTs: last.ts,
+    current: last.role === 'baseline' && last.tag === currentBaseline,
+    inRegistry: registry === null ? null : registry.has(last.tag),
+    unledgered: false,
+  }));
+  if (registry) for (const tag of [...registry].sort()) {
+    if (byTag.has(tag)) continue;
+    rows.push({ tag, commit: tag, role: 'transient', keep: 'short', origin: null, firstTs: '', lastTs: '', current: false, inRegistry: true, unledgered: true });
+  }
+  return rows.sort((a, b) => (b.lastTs || '').localeCompare(a.lastTs || '') || a.tag.localeCompare(b.tag));
+}
+
+export type RegistryRead = { readonly ok: true; readonly tags: readonly string[] } | { readonly ok: false; readonly reason: string };
+
+/**
+ * Read `elanous-harness` tags from the registry the way the rail does (`/v2/elanous-harness/tags/list`
+ * on the registry node's localhost port). `sshHost` runs it on that node; otherwise on this machine.
+ */
+export function readRegistryTags(opts: { port: string; sshHost?: string; run?: (cmd: string, args: readonly string[]) => { status: number | null; stdout: string; stderr?: string } }): RegistryRead {
+  const url = `http://localhost:${opts.port}/v2/elanous-harness/tags/list`;
+  const run = opts.run ?? ((cmd, args) => {
+    const r = spawnSync(cmd, [...args], { encoding: 'utf8', timeout: 25_000 });
+    return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? (r.error ? String(r.error) : '') };
+  });
+  const r = opts.sshHost
+    ? run('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', opts.sshHost, `curl -fsS --max-time 15 ${url}`])
+    : run('curl', ['-fsS', '--max-time', '15', url]);
+  if (r.status !== 0) return { ok: false, reason: `registry read failed (exit ${r.status ?? 'timeout'})${r.stderr ? `: ${r.stderr.trim().slice(0, 200)}` : ''}` };
+  try {
+    const tags = (JSON.parse(r.stdout) as { tags?: unknown }).tags;
+    if (tags === null) return { ok: true, tags: [] };
+    if (!Array.isArray(tags) || !tags.every((t) => typeof t === 'string')) return { ok: false, reason: 'registry answered without a tags list' };
+    return { ok: true, tags };
+  } catch { return { ok: false, reason: 'registry answered non-JSON' }; }
+}

package/src/index.ts

@@ -7,6 +7,7 @@ import type { SelfDevRunParticipant, SelfDevRunState } from './self-dev/run-stor
 import { applyConfigDirFlagFromArgv } from './cli/config-dir-flag.js';
 import { LOGS_SINCE_OPTION, registerLogsCommands } from './cli/logs-cli.js';
 import { registerDocsCommands } from './cli/docs-cli.js';
+import { registerBenchCommands } from './cli/bench-cli.js';
 import { registerRetroCommands } from './cli/retro-cli.js';
 import { registerA2ACommands } from './cli/a2a-cli.js';
 import { registerPluginCommands } from './cli/plugin-cli.js';
@@ -51,6 +52,7 @@ import { registerPublishCommands } from './cli/publish-cli.js';
 import { registerAutopilotCommands } from './cli/autopilot-cli.js';
 import { registerRoleCommands } from './cli/role-cli.js';
 import { registerMachineCommands } from './cli/machine-cli.js';
+import { recordImagePinFromConfigSet, registerImageCommands } from './cli/image-cli.js';
 import { registerAgentEnvCommands } from './cli/agent-env-cli.js';
 import { registerScheduleCommands } from './cli/schedule-cli.js';
 import { registerGuardianCommands } from './cli/guardian-cli.js';
@@ -899,9 +901,11 @@ registerPrCommands(program);
 registerRepoCommands(program);
 registerRoleCommands(program);
 registerMachineCommands(program);
+registerImageCommands(program);
 registerAgentEnvCommands(program);
 // CLI entry: where action → resolveCurrentInstance → resolveInstance (instance universe).
 registerWhereCommand(program);
+registerBenchCommands(program);
 registerShadowCommand(program);
 registerLlmDetectCommand(program);
 registerStorageDetectCommand(program);
@@ -4713,7 +4717,7 @@ const selfOrchestrateCmd = selfCmd
   .option('--no-pod-rebuild', 'pod: 이미지 판(elanous.commit)이 HEAD 와 달라도 다시 굽지 않는다 — 측정은 «이미지 판»을 잰다')
   .option('--pod-pass-env <keys>', 'pod: 호스트 env 에서 Pod 로 넘길 키(쉼표) — 예 OPENROUTER_API_KEY,ANTHROPIC_API_KEY(벤치마크 과금 경로)')
   .option('--bench-arms <spec>', 'pod 벤치마크: 골 1개를 팔마다 «라벨 한 줄만 다르게» 복제해 동시에 — "id=provider[:model][@KEY+KEY];…" (예 codex=openai-codex;or-kimi=openrouter:openrouter/moonshotai/kimi-k3@OPENROUTER_API_KEY) · --auto-merge 거부 · RFC fleet 슈퍼바이저 §A3')
-  .addOption(new Option('--child-llm-provider <id>', 'pod: 구현 자식 LLM provider(openai-codex|grok|openrouter|anthropic) — 하니스 --child-llm-provider 가 이 자리로 온다(10-05)').hideHelp())
+  .addOption(new Option('--child-llm-provider <id>', 'pod: 구현 자식 LLM provider(openai-codex|grok|openrouter|anthropic|bedrock|glm) — 하니스 --child-llm-provider 가 이 자리로 온다(10-05)').hideHelp())
   .addOption(new Option('--child-llm-model <id>', 'pod: 구현 자식 LLM model(--child-llm-provider 와 함께)').hideHelp())
   .addOption(new Option('--child-llm-effort <level>', 'pod: 구현 자식 추론 노력(--child-llm-provider 와 함께)').hideHelp())
   .option('--help-all', '모든 orchestrate 옵션 표시')
@@ -5000,6 +5004,33 @@ const selfOrchestrateCmd = selfCmd
         let rotationAccounts: readonly string[] | undefined;
         let podProvider: import('./task-orchestrator/surfaces/pod-child-providers.js').PodChildProvider = 'openai-codex';
         let grokApiKeyOptIn = false;
+        {
+          // SUBSCRIPTION-EXHAUST-REROUTE (0.2.24): a Pod launch with no child model gets the configured default
+          // (tools.selfImplement.podChildDefault · default openrouter/z-ai/glm-5.3) instead of falling to codex.
+          // It fills the same flags a named launch carries, so every check below runs unchanged.
+          const child = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
+          const { resolvePodChildDefault } = await import('./task-orchestrator/surfaces/pod-child-default.js');
+          const { homedir: defaultKeyHome } = await import('node:os');
+          const childDefault = resolvePodChildDefault({
+            flags: { provider: child.childLlmProvider, model: child.childLlmModel, effort: child.childLlmEffort },
+            benchArms: Boolean(benchArms),
+            explicitPodAccount: (opts as { podAccount?: string }).podAccount,
+            config: (launchPolicy.tools?.selfImplement as { podChildDefault?: unknown } | undefined)?.podChildDefault,
+            openrouterKeyPresent: () => {
+              if (process.env.OPENROUTER_API_KEY?.trim()) return true;
+              try { return Boolean(readFileSync(_joinPath(defaultKeyHome(), '.cache', 'openrouter_api_key'), 'utf8').trim()); } catch { return false; }
+            },
+          });
+          if (childDefault.apply) {
+            child.childLlmProvider = childDefault.provider;
+            if (childDefault.model) child.childLlmModel = childDefault.model;
+            debug.log('self-implement.pod', 'child-default-applied', { provider: childDefault.provider, model: childDefault.model ?? null, source: childDefault.source, ...(childDefault.invalidConfig !== undefined ? { invalidConfig: String(JSON.stringify(childDefault.invalidConfig)) } : {}) });
+            if (!opts.json) ui.info(`[pod] child 기본 모델 = ${childDefault.provider}${childDefault.model ? `/${childDefault.model}` : ''} (${childDefault.source === 'config' ? 'tools.selfImplement.podChildDefault' : '기본값'}) — --child-llm-* 로 바꾼다`);
+          } else if (childDefault.reason !== 'flag') {
+            debug.log('self-implement.pod', 'child-default-skipped', { reason: childDefault.reason, provider: childDefault.provider ?? null, model: childDefault.model ?? null, ...(childDefault.invalidConfig !== undefined ? { invalidConfig: String(JSON.stringify(childDefault.invalidConfig)) } : {}) }, { level: childDefault.reason === 'no-openrouter-key' ? 'warn' : 'debug' });
+            if (childDefault.reason === 'no-openrouter-key' && !opts.json) ui.warn('[pod] child 기본 모델(openrouter)을 못 쓴다 — 호스트에 OpenRouter 키 없음 · 종전 codex 경로로 간다');
+          }
+        }
         {
           // 10-05 PODPROVIDER: refuse child choices this Pod launch cannot honour instead of dropping them.
           const child = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
@@ -5008,7 +5039,7 @@ const selfOrchestrateCmd = selfCmd
             ? 'pod: --child-llm-model/--child-llm-effort 는 --child-llm-provider 와 함께'
             : named && benchArms
               ? 'pod: --child-llm-provider 는 --bench-arms 와 함께 못 쓴다(팔마다 모델이 하나다)'
-              : (named === 'grok' || named === 'openrouter' || named === 'anthropic') && explicitPodAccount
+              : (named === 'grok' || named === 'openrouter' || named === 'anthropic' || named === 'bedrock' || named === 'glm') && explicitPodAccount
                 ? `pod: --child-llm-provider ${named} 은 --pod-account 와 함께 못 쓴다(그것은 codex 계정을 고정한다)`
                 : undefined;
           if (refuse) { ui.error(refuse); debug.log('self-implement.pod', 'child-provider-refused', { provider: named ?? null, reason: refuse }); process.exit(2); }
@@ -5026,6 +5057,12 @@ const selfOrchestrateCmd = selfCmd
           const { normalizeFallbackChain } = await import('./oauth/fallback-chain.js');
           const fallbackEnabled = codexPolicyAllowsFallback(quotaPolicy)
             && normalizeFallbackChain(launchPolicy.llm?.fallbackChain).chain.includes('grok');
+          // CODEX-CREDITS-STEP — 체인 마지막 칸(크레딧). 켜져 있을 때만 grok 잔량을 잰다(발사 관문과 같은 80% 상한).
+          //   Pod 는 «grok 뒤» 순서(문서화된 배치)만 따른다 — grok 앞에 둔 체인은 Pod 계획에서 크레딧 칸을 쓰지 않는다.
+          const launchChain = normalizeFallbackChain(launchPolicy.llm?.fallbackChain).chain;
+          const codexCreditsStep = codexPolicyAllowsFallback(quotaPolicy)
+            && launchChain.includes('codex-credits')
+            && (!launchChain.includes('grok') || launchChain.indexOf('codex-credits') > launchChain.indexOf('grok'));
           // POL1 — say which policy this launch uses and where it came from; warn when a test universe disagrees with production.
           const { effectiveInstanceRoot, prodInstanceRoot } = await import('./instance/resolve.js');
           const root = effectiveInstanceRoot();
@@ -5074,7 +5111,7 @@ const selfOrchestrateCmd = selfCmd
           if (namedChildDecision.refuse) { ui.error(namedChildDecision.refuse); debug.log('self-implement.pod', 'child-provider-refused', { provider: namedChild, reason: namedChildDecision.refuse }); process.exit(2); }
           // A named codex child must stay codex — the plan may not fall back to grok (post-review must-fix).
           const namedCodex = namedChildDecision.provider === 'openai-codex';
-          const plan: import('./task-orchestrator/surfaces/pod-account-broker.js').PodProviderPlan | null = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' ? null : namedChildDecision.provider === 'grok'
+          const plan: import('./task-orchestrator/surfaces/pod-account-broker.js').PodProviderPlan | null = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' || namedChildDecision.provider === 'bedrock' || namedChildDecision.provider === 'glm' ? null : namedChildDecision.provider === 'grok'
             ? { provider: 'grok', excluded: [], grokSubscriptionEligible: credential?.kind === 'subscription' }
             : planPodProvider({
             codexCandidates: inspectCodexRotation().candidates,
@@ -5082,18 +5119,28 @@ const selfOrchestrateCmd = selfCmd
             thresholdPercentByAccount: launchPolicy.llm?.codexAccountRotationThresholdPercentByAccount,
             // 대표 한도 정책 한 값(`llm.codexQuotaPolicy`) — 크레딧·폴백을 같이 정한다.
             creditsAllowed: codexPolicyAllowsCredits(quotaPolicy),
+            // SUBSCRIPTION-EXHAUST-REROUTE — 예비분 이하 잔액(«알려진» 값)의 계정은 크레딧으로 쓰지 않는다.
+            creditReserve: typeof launchPolicy.llm?.codexCreditReserve === 'number' && Number.isFinite(launchPolicy.llm.codexCreditReserve) && launchPolicy.llm.codexCreditReserve >= 0
+              ? launchPolicy.llm.codexCreditReserve : (await import('./oauth/codex-account-store.js')).DEFAULT_CODEX_CREDIT_RESERVE,
             ...podFallbackCredentials(namedChildDecision.provider, {
               grokSubscription: fallbackEnabled && grokSubscriptionUsable,
               grokApiKey: fallbackEnabled && credential?.kind === 'api_key',
             }),
             grokApiKeyOptIn,
+            ...(codexCreditsStep ? { codexCreditsStep: true, grokQuota: await (async () => {
+              const { readLiveGrokUsedPercent } = await import('./self-implement/budget-gate.js');
+              const { LAUNCH_GROK_USED_PERCENT_CAP } = await import('./user-config.js');
+              const used = await readLiveGrokUsedPercent();
+              return used === undefined ? 'unknown' as const : used >= LAUNCH_GROK_USED_PERCENT_CAP ? 'exhausted' as const : 'usable' as const;
+            })() } : {}),
           });
           if (plan?.provider === null) { ui.error(`pod: 쓸 codex 계정이 없다 — ${plan.reasons.join(' · ')}${namedCodex ? ' · child provider 를 openai-codex 로 지정해 grok 으로 넘기지 않는다' : ''} · 계정을 명시하려면 --pod-account <이름>`); process.exit(2); }
-          podProvider = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' ? namedChildDecision.provider : plan!.provider!;
+          podProvider = namedChildDecision.provider === 'openrouter' || namedChildDecision.provider === 'anthropic' || namedChildDecision.provider === 'bedrock' || namedChildDecision.provider === 'glm' ? namedChildDecision.provider : plan!.provider!;
           if (plan?.provider === 'openai-codex') {
             accountBroker = makePodAccountBroker({ usable: plan.accounts, excluded: plan.excluded });
             rotationAccounts = plan.accounts;
             debug.log('self-implement.pod', 'account-plan', { usable: plan.accounts, excluded: plan.excluded });
+            if (plan.codexCreditsStep) debug.log('self-implement.pod', 'codex-credits-step', { outcome: 'credits', accounts: plan.accounts, skipped: plan.skipped ?? [] }, { level: 'warn' });
             { const { emitDecision } = await import('./live/detail-switch.js');
               emitDecision({ kind: 'ROUTE', what: `Pod 계정 배분 ${plan.accounts.join(' → ')}`, reason: plan.excluded.length ? `뺌 ${plan.excluded.map((x) => `${x.name}(${x.why})`).join(', ')}` : '모든 계정 여유', purpose: plan.creditAccounts ? '구독 잔량 0 — 정책상 크레딧으로 병렬 조각을 돌린다' : '병렬 조각이 한 계정에 몰리지 않게 잔량 순으로 돌려 준다', phase: 'dispatch', target: `Pod ${plan.accounts.length}계정`, paths: plan.accounts.length + plan.excluded.length }); }
             if (!opts.json) ui.info(`[pod] 계정 배분(잔량 순 · 돌려 가며): ${plan.accounts.join(' → ')}${plan.creditAccounts ? ' · 💳 크레딧(구독 잔량 0 · 허가됨)' : ''}${plan.excluded.length ? ` · 뺌 ${plan.excluded.map((x) => `${x.name}(${x.why})`).join(', ')}` : ''}`);
@@ -5106,6 +5153,17 @@ const selfOrchestrateCmd = selfCmd
             // ⓔ 과금 관측 — anthropic 은 API 키 과금(구독 아님). 새 예산 체계는 없다 · 관측 한 줄만.
             debug.log('self-implement.pod', 'provider-named', { provider: 'anthropic', model, anthropicKeyPresent: true, billing: 'api-key' });
             if (!opts.json) ui.info(`[pod] child provider = anthropic(모델 ${model ?? '기본'}) — 발사 인자로 지정됨 · 💳 API 키 과금(구독 아님)`);
+          } else if (namedChildDecision.provider === 'bedrock') {
+            const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || null;
+            // BEDROCK-PROVIDER ② — 자격은 클러스터의 이름 있는 AWS Secret(발사 전 판정 · 없으면 apply 0 으로 거부). 과금 = AWS 계정.
+            debug.log('self-implement.pod', 'provider-named', { provider: 'bedrock', model, billing: 'aws-account' });
+            if (!opts.json) ui.info(`[pod] child provider = bedrock(모델 ${model ?? '기본'}) — 발사 인자로 지정됨 · 💳 AWS 계정 과금(구독 아님)`);
+          } else if (namedChildDecision.provider === 'glm') {
+            const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || null;
+            // ZAI-POD-CHILD — 자격은 클러스터의 이름 있는 ZAI Secret(발사 전 판정 · 없으면 apply 0 으로 거부) · 과금 = GLM Coding Plan 정액.
+            //   동시 상한(llm.zaiCodingPlan.maxConcurrent)을 넘는 Pod 는 정책(overage)대로 — openrouter·balance 면 OpenRouter GLM · stop 이면 거부.
+            debug.log('self-implement.pod', 'provider-named', { provider: 'glm', model, billing: 'zai-coding-plan' });
+            if (!opts.json) ui.info(`[pod] child provider = glm(모델 ${model ?? '기본'}) — 발사 인자로 지정됨 · GLM Coding Plan(정액) · 동시 상한을 넘는 Pod 는 llm.zaiCodingPlan.overage 대로`);
           } else if (namedChildDecision.provider === 'grok') {
             const model = (opts as { childLlmModel?: string }).childLlmModel?.trim() || defaultGrokModel().id;
             debug.log('self-implement.pod', 'provider-named', { provider: 'grok', model, credential: credential?.kind ?? null });
@@ -5140,7 +5198,9 @@ const selfOrchestrateCmd = selfCmd
         const childFlags = opts as { childLlmProvider?: string; childLlmModel?: string; childLlmEffort?: string };
         const podChildLlm = childFlags.childLlmProvider?.trim() ? { childProviderExplicit: true, ...(childFlags.childLlmModel?.trim() ? { childModel: childFlags.childLlmModel.trim() } : {}), ...(childFlags.childLlmEffort?.trim() ? { childEffort: childFlags.childLlmEffort.trim() } : {}) } : {};
         if (childFlags.childLlmProvider?.trim()) debug.log('self-implement.pod', 'child-provider-named', { provider: childFlags.childLlmProvider.trim(), model: childFlags.childLlmModel ?? null, podProvider });
-        const podBase = { hostSupervised: opts.supervise === true, ...podChildLlm, ...(remoteOnlyPool ? { imageCommit: image.imageCommit } : {}), account: podProvider === 'grok' ? 'grok' : podProvider === 'openrouter' ? 'openrouter' : podProvider === 'anthropic' ? 'anthropic' : explicitPodAccount ?? 'team', ...(accountBroker ? { accountBroker, rotationAccounts } : {}), ...(podProvider === 'grok' ? { provider: 'grok' as const, grokApiKeyOptIn } : podProvider === 'openrouter' ? { provider: 'openrouter' as const } : podProvider === 'anthropic' ? { provider: 'anthropic' as const } : {}), passEnv, ...(pool ? { pool } : {}), ...((opts as { podSkillEnv?: boolean }).podSkillEnv ? { skillEnv: true } : {}), ...(podSource ? { source: podSource } : {}) };
+        // BEDROCK-POD-PROVIDER-DROP — provider·account 는 한 곳(podLaunchProviderOptions)에서 — 손 나열이 bedrock 을 떨궈 codex(team)로 돌았다(10-11).
+        const podProviderOptions = (await import('./task-orchestrator/surfaces/pod-child-providers.js')).podLaunchProviderOptions(podProvider, { explicitPodAccount, grokApiKeyOptIn });
+        const podBase = { hostSupervised: opts.supervise === true, ...podChildLlm, ...(remoteOnlyPool ? { imageCommit: image.imageCommit } : {}), ...podProviderOptions, ...(accountBroker ? { accountBroker, rotationAccounts } : {}), passEnv, ...(pool ? { pool } : {}), ...((opts as { podSkillEnv?: boolean }).podSkillEnv ? { skillEnv: true } : {}), ...(podSource ? { source: podSource } : {}) };
         if (benchArms) {
           const { benchPodSpawn } = await import('./task-orchestrator/surfaces/self-implement-pod.js');
           podSpawn = benchPodSpawn(benchArms, podBase);
@@ -5151,7 +5211,7 @@ const selfOrchestrateCmd = selfCmd
           ? poolMembers.map(({ context }) => ({ context, namespace: 'elanous-test' }))
           : [{ context: defaultKubectl(['config', 'current-context']).stdout.trim(), namespace: 'elanous-test' }];
         // ⭐ 팔 선언은 «runId 가 붙는» 이 줄에 싣는다 — 위의 `bench-arms` 줄은 runId 해석 «전»이라 비어 있다(09-25 실측) · 보고서(scripts/bench-report.ts)가 이 줄로 잇는다.
-        debug.log('self-dev.orchestrate', 'substrate', { substrate, account: podProvider === 'grok' ? 'grok' : podProvider === 'openrouter' ? 'openrouter' : (opts as { podAccount?: string }).podAccount ?? 'team', passEnv, context: ready.reason, imageCommit: image.imageCommit, imageFresh: image.fresh, ...(benchArms ? { benchArms: benchArms.map((a) => ({ id: a.id, provider: a.provider, model: a.model ?? null, modelSource: a.modelSource ?? null, passEnv: a.passEnv })) } : {}) });
+        debug.log('self-dev.orchestrate', 'substrate', { substrate, account: podProviderOptions.account, passEnv, context: ready.reason, imageCommit: image.imageCommit, imageFresh: image.fresh, ...(benchArms ? { benchArms: benchArms.map((a) => ({ id: a.id, provider: a.provider, model: a.model ?? null, modelSource: a.modelSource ?? null, passEnv: a.passEnv })) } : {}) });
       } else if (substrate !== 'local') {
         ui.error(`--substrate: local | pod (받은 값: ${substrate})`); process.exit(2);
       }
@@ -5763,19 +5823,21 @@ selfCmd
     const { spawnSync } = await import('node:child_process');
     const { reviewPullRequest, renderReview } = await import('./agent-substrate/pr-reviewer.js');
     const { createRepositoryReferencedFileReader } = await import('./self-implement/goal-file-reader.js');
-    const { streamLLM } = await import('./llm.js');
+    const { streamLLM, getProvider } = await import('./llm.js');
     const { registerStandaloneLogSink } = await import('./domains/standalone-log-sink.js');
     const { debug } = await import('./debug/log.js');
     const { runSelfReviewCliCommand, reviewerContextArgs, selfReviewJsonLine } = await import('./agent-substrate/self-review-cli.js');
     const { subscriptionReviewerAvailability } = await import('./self-dev/review-provider-fallback.js');
     const { makeLazyAcpReviewLLM: makeRoleAcpReviewLLM } = await import('./agent-substrate/acp-reviewer.js');
+    const { getOpenRouterApiKey: getOpenRouterApiKeyForReview } = await import('./config.js');
+    const { ROLE_REVIEWER_FALLBACK_MODEL } = await import('./agent-substrate/self-review-cli.js');
     const contextOrder = reviewerContextArgs(process.argv.slice(2));
     const configuredAcpBackend = getUserConfig().acp.reviewBackend;
     // ⭐ Same reviewer row the harness reads (`dev-pipeline` → `resolveSubscriptionReviewer`).
     //    The seam decides whether it applies (only without an explicit reviewer flag).
     const { loadLlmPolicy, resolveSubscriptionReviewer } = await import('./policy/llm-policy.js');
     const roleReviewerSelection = resolveSubscriptionReviewer(loadLlmPolicy(), getUserConfig().roleLlm);
-    const { results } = await runSelfReviewCliCommand(prArgs, {
+    const { results, failed } = await runSelfReviewCliCommand(prArgs, {
       ...opts,
       ...(configuredAcpBackend ? { configuredAcpBackend } : {}),
       ...(roleReviewerSelection ? { roleReviewer: roleReviewerSelection.spec } : {}),
@@ -5797,10 +5859,16 @@ selfCmd
       renderReview,
       // ⛔⭐ 하드코딩 금지(🩸 2026-09-23 실측: 여기 'medium' 이 박혀 있었다) — 무인 리뷰와 «같은» 규칙.
       //   대표 결정: 리뷰는 high. 역할 티어의 effort 를 쓰고, 티어가 없으면 high.
-      makeApiLlm: (model) => {
+      //   명시 `--model` 이면 provider 를 그 모델의 것으로 «고정»한다 — 라우터 폴백(grok 등)으로 조용히 넘어가지 않고 오류로 낸다.
+      makeApiLlm: (model, o) => {
         const effort = reviewReasoningEffort(resolveRoleLlm('review'));
         return (prompt: string) =>
-          streamLLM([{ role: 'user', content: prompt }], () => {}, { model, ...(effort ? { reasoningEffort: effort } : {}) });
+          streamLLM([{ role: 'user', content: prompt }], () => {}, {
+            model,
+            ...(o?.pinProvider ? { provider: getProvider(model) } : {}),
+            ...(o?.onResolved ? { onResolvedProvider: o.onResolved } : {}),
+            ...(effort ? { reasoningEffort: effort } : {}),
+          });
       },
       makeAcpLlm: (o) => {
         // ⚠️ 동기 팩토리라 여기서 동적 import 를 쓸 수 없다 — 지연 로드해 첫 호출에 붙인다.
@@ -5829,6 +5897,9 @@ selfCmd
           llm: makeRoleAcpReviewLLM({ cwd: process.cwd(), backend: 'claude', backendSpec: spawn.backendSpec, env: spawn.env, timeoutMs: o.timeoutMs }),
         };
       },
+      // SUBSCRIPTION-EXHAUST-REROUTE — role reviewer unavailable ⇒ GLM on OpenRouter (the review policy's first
+      //   fallback · same pin as POD_OPENROUTER_REVIEWER_PINS.glm), not the codex ladder. No key ⇒ today's default.
+      roleFallbackModel: () => (getOpenRouterApiKeyForReview()?.trim() ? ROLE_REVIEWER_FALLBACK_MODEL : undefined),
       registerSink: async (surface) => { await registerStandaloneLogSink(surface); },
       log: (event, data, o) => debug.log('self-review', event, data, o ?? {}),
       info: (t) => ui.info(t),
@@ -5838,6 +5909,7 @@ selfCmd
       envModel: () => process.env.ELANOUS_PR_REVIEW_MODEL,
     });
     if (opts.json) await writeStdoutJson(selfReviewJsonLine(results));
+    if (failed >= 1) process.exitCode = 1;
   });
 
 selfCmd
@@ -7868,6 +7940,8 @@ configCmd
     } else if (credential?.source === 'none' && !isKeylessProvider(nextProvider)) {
       ui.warn(`provider credential unavailable: ${parsed}; keeping existing llm.apiKey (subscription or OAuth may be normal)`);
     }
+    // IMAGE-LEDGER-TAGS: the baseline pin (the rail sets it through this command) goes into the image ledger.
+    if (recordImagePinFromConfigSet(path, parsed) === 'recorded') ui.info(`image ledger: baseline ${String(parsed).slice(0, 12)} · keep=pin`);
     ui.info(`set ${path} = ${JSON.stringify(parsed)}`);
   });
 
@@ -11768,7 +11842,7 @@ async function main(): Promise<void> {
   if (needsFirstRun(cfg)) {
     if (cfg.onboarding.webFirst !== false) {
       const { runWebFirstSetup } = await import('./onboarding/web-first.js');
-      if (await runWebFirstSetup({ config: cfg, startedAt: firstRunStartedAt }) === 'link-shown') return;
+      if (await runWebFirstSetup({ config: cfg, startedAt: firstRunStartedAt, startIfMissing: false }) === 'link-shown') return;
     }
     const { runFirstRun } = await import('./onboarding/first-run.js');
     if ((await runFirstRun({ config: cfg })).outcome !== 'ready') return;
@@ -11778,6 +11852,14 @@ async function main(): Promise<void> {
   // answer their first prompt. Printed above the dashboard altscreen
   // so it stays visible on quit (scrolls back into the terminal).
   console.log(`[elanous] ${oneLineProvider()}`);
+  const noticeConfig = getUserConfig();
+  // Only a run that will draw the dashboard (stdin TTY) counts as a person having seen the notice;
+  // a piped/CI run that stops at the TTY gate must not mark it shown.
+  const noticeSeen = (await import('./dashboard/tty-required.js')).dashboardCanUseTty();
+  if (noticeSeen && noticeConfig.errorReports?.enabled !== false && noticeConfig.errorReports?.noticeShown !== true) {
+    console.log((await import('./error-report/report.js')).errorReportNoticeLine(noticeConfig.errorReports));
+    saveUserConfig({ ...noticeConfig, errorReports: { ...noticeConfig.errorReports, noticeShown: true } }, userConfigPath());
+  }
   if (remote) {
     const authNote = remote.token ? 'token' : 'no-auth';
     console.log(`[elanous] remote daemon: ${remote.url} (${authNote})`);

package/src/instance/child-scope.ts

@@ -2,7 +2,7 @@ import { debug } from '../debug/log.js';
 import { getUserConfig, type SelfImplementChildInstanceMode } from '../user-config.js';
 import { readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from './resolve.js';
+import { effectiveInstanceRoot, prodInstanceRoot, measureUniverse, treeDerivedRootFor, universeMismatch, type UniverseMeasure } from './resolve.js';
 
 interface ChildInstanceScope {
   configDir?: string;
@@ -69,6 +69,33 @@ function instanceScopeLog(event: string, data: Record<string, unknown>, warn = f
   debug.log('instance.identity', event, data, warn ? { level: 'warn' } : undefined);
 }
 
+/**
+ * 부모가 도장(`ELANOUS_STATE_DIR`)으로 물려준 우주와 이 프로세스가 실제로 쓰는 우주를 대조한다.
+ * 다르면 `instance.identity universe-mismatch` 경고 한 줄을 남긴다 — 막지 않고 적기만 한다.
+ * 도장이 없으면(사람이 직접 띄운 입구) 비교할 부모가 없으므로 조용하다.
+ */
+export function observeUniverseMismatch(
+  deps: { stamp?: string | undefined; effectiveRoot?: () => string; log?: ChildInstanceScopeDeps['log'] } = {},
+): { parentRoot: string; childRoot: string } | null {
+  const stamp = 'stamp' in deps ? deps.stamp : process.env.ELANOUS_STATE_DIR;
+  const mismatch = universeMismatch(stamp, (deps.effectiveRoot ?? effectiveInstanceRoot)());
+  if (mismatch) (deps.log ?? instanceScopeLog)('universe-mismatch', { ...mismatch, why: 'child resolved a different universe than the one its parent stamped' }, true);
+  return mismatch;
+}
+
+/**
+ * 읽을 우주가 비어 있으면 «0» 이 아니라 «측정 불가(빈 우주)» 라고 `instance.identity universe-unmeasurable` 로 적는다.
+ * 새 test 우주는 늘 비어 있으므로 경고(warn)가 아니라 정보 한 줄이다 — 막지 않고 적기만 한다.
+ */
+export function observeEmptyUniverse(
+  root: string,
+  deps: { entries?: (dir: string) => string[]; log?: ChildInstanceScopeDeps['log'] } = {},
+): UniverseMeasure {
+  const measure = measureUniverse(root, deps.entries);
+  if (!measure.measurable) (deps.log ?? instanceScopeLog)('universe-unmeasurable', { root, reason: measure.reason, why: '읽을 우주가 비어 있어 0 이 아니라 측정 불가로 취급한다' });
+  return measure;
+}
+
 /** Resolve the current universe once; operational parents derive an isolated child universe by default. */
 export function childInstanceScope(deps: ChildInstanceScopeDeps = {}): ChildInstanceScope {
   const elanousBinRoot = resolve(import.meta.dir, '../..');
@@ -77,6 +104,10 @@ export function childInstanceScope(deps: ChildInstanceScopeDeps = {}): ChildInst
   const parentIsProduction = root === prodRoot;
   const mode = (deps.childInstanceMode ?? configuredChildInstanceMode)();
   const log = deps.log ?? instanceScopeLog;
+  if (!deps.effectiveRoot) {
+    observeUniverseMismatch({ effectiveRoot: () => root, log });
+    observeEmptyUniverse(root, { log });
+  }
 
   const readProvider = deps.rawProviderAt ?? rawLlmProviderAt;
   /** 자식이 갈 우주의 provider 가 운영과 어긋나는지 «한 칸»으로 남긴다. 판정하지 않고 적기만 한다. */

package/src/instance/dev-project.ts

@@ -0,0 +1,133 @@
+import { execFileSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+
+export interface DevProjectDeps {
+  git?: (dir: string, args: readonly string[]) => string | null;
+  stateDir?: string;
+}
+
+interface DevProjectRegistry {
+  projects: Record<string, string>;
+}
+
+interface DevProjectCache {
+  identityKey: string;
+  devProject: string;
+}
+
+const ULID_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+
+export function resolveDevProject(dir: string, deps: DevProjectDeps = {}): string {
+  const suppliedDir = resolve(dir);
+  const git = deps.git ?? runGit;
+  const gitRoot = git(suppliedDir, ['rev-parse', '--show-toplevel'])?.trim();
+  const root = gitRoot ? resolve(gitRoot) : suppliedDir;
+  let identityKey: string;
+  // A repo with no commit yet (`git init` only) has no first commit to anchor on — it falls back to
+  // the path identity like a plain folder until its first commit exists.
+  const rootCommits = gitRoot
+    ? git(root, ['rev-list', '--max-parents=0', 'HEAD'])?.trim().split(/\s+/).filter(Boolean) ?? []
+    : [];
+
+  if (rootCommits.length > 0) {
+    const firstCommit = rootCommits.length === 1 ? rootCommits[0]! : rootCommits
+      .map((commit) => ({
+        commit,
+        timestamp: Number(git(root, ['show', '-s', '--format=%ct', commit])?.trim()),
+      }))
+      .filter(({ timestamp }) => Number.isFinite(timestamp))
+      .sort((left, right) => left.timestamp - right.timestamp || left.commit.localeCompare(right.commit))[0]?.commit;
+    if (!firstCommit) throw new Error(`Unable to resolve oldest root commit for git project at ${root}`);
+    const remote = git(root, ['remote', 'get-url', 'origin']);
+    identityKey = `git:${firstCommit}:${normalizeRemoteUrl(remote ?? '')}`;
+  } else {
+    identityKey = `path:${createHash('sha256').update(root).digest('hex')}`;
+  }
+
+  const stateDir = resolve(deps.stateDir ?? elanousStateRoot());
+  const registryPath = join(stateDir, 'dev-projects.json');
+  const registry = readRegistry(registryPath);
+  const id = registry.projects[identityKey] ?? newDevProjectId();
+  if (!registry.projects[identityKey]) {
+    registry.projects[identityKey] = id;
+    writeJsonAtomically(registryPath, registry);
+  }
+
+  // The cache is disposable (RFC §4f): a read-only root must not stop the id from resolving.
+  try {
+    writeJsonAtomically(join(root, '.elanous', 'project.json'), { identityKey, devProject: id } satisfies DevProjectCache);
+  } catch { /* cache only */ }
+  return id;
+}
+
+function runGit(dir: string, args: readonly string[]): string | null {
+  try {
+    return execFileSync('git', ['-C', dir, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch {
+    return null;
+  }
+}
+
+function normalizeRemoteUrl(remote: string): string {
+  const value = remote.trim();
+  if (!value) return '';
+
+  const scp = /^(?![a-z][a-z0-9+.-]*:\/\/)(?:[^@/]+@)?([^:/]+):(.+)$/.exec(value);
+  if (scp) return normalizeRemotePath(`${scp[1]!.toLowerCase()}/${scp[2]}`);
+
+  try {
+    const url = new URL(value);
+    return normalizeRemotePath(`${url.hostname.toLowerCase()}${url.pathname}`);
+  } catch {
+    return normalizeRemotePath(resolve(value));
+  }
+}
+
+function normalizeRemotePath(value: string): string {
+  return value.replace(/\\/g, '/').replace(/\/+$/, '').replace(/\.git$/i, '');
+}
+
+/**
+ * The registry is the source of truth for prj- ids. A missing file starts a fresh registry; an
+ * existing but unreadable/corrupt one throws instead of silently re-issuing every project a new id.
+ */
+function readRegistry(path: string): DevProjectRegistry {
+  let raw: string;
+  try {
+    raw = readFileSync(path, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { projects: {} };
+    throw error;
+  }
+  let parsed: Partial<DevProjectRegistry> | undefined;
+  try { parsed = JSON.parse(raw) as Partial<DevProjectRegistry>; } catch { parsed = undefined; }
+  if (parsed?.projects && typeof parsed.projects === 'object' && !Array.isArray(parsed.projects)) {
+    return { projects: parsed.projects as Record<string, string> };
+  }
+  throw new Error(`dev-projects registry is corrupt: ${path}`);
+}
+
+function writeJsonAtomically(path: string, value: unknown): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporaryPath = join(dirname(path), `.${basename(path)}.${process.pid}.${newDevProjectId()}.tmp`);
+  writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { flag: 'wx' });
+  renameSync(temporaryPath, path);
+}
+
+function newDevProjectId(): string {
+  const now = BigInt(Date.now());
+  let timestamp = '';
+  for (let index = 9; index >= 0; index -= 1) {
+    timestamp += ULID_ALPHABET[Number((now >> BigInt(index * 5)) & 31n)];
+  }
+
+  const entropy = BigInt(`0x${randomBytes(10).toString('hex')}`);
+  let random = '';
+  for (let index = 15; index >= 0; index -= 1) {
+    random += ULID_ALPHABET[Number((entropy >> BigInt(index * 5)) & 31n)];
+  }
+  return `prj-${timestamp}${random}`;
+}