elanous 0.2.24 → 0.2.25

package/src/task-agent/parent-host.ts

@@ -192,9 +192,9 @@ export function remoteParentAlive(parentHost: { host: string; pid?: number; runI
 }
 
 /** 발사 전 점검 결과 — `gaps` 가 비어야 원격으로 띄운다. */
-export interface ParentHostPreflight { ok: boolean; gaps: string[]; facts: Record<string, string> }
+export interface ParentHostPreflight { ok: boolean; gaps: string[]; warnings: string[]; facts: Record<string, string> }
 
-/** 원격 사실 한 번에 — key=value 줄. */
+/** 원격 사실 한 번에 — key=value 줄. LLM 자격은 «존재·개수»만 센다(값을 읽지도 찍지도 않는다). */
 export function preflightScript(target: ParentHostConfig): string {
   const elanous = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
   const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
@@ -204,6 +204,9 @@ export function preflightScript(target: ParentHostConfig): string {
     `grep -Eq '"podPool"[[:space:]]*:[[:space:]]*"[^"[:space:]]+' ${configDir}/config.json 2>/dev/null && echo podPool=1`,
     `(cd ${shellQuote(target.cwd)} 2>/dev/null && git rev-parse --is-inside-work-tree >/dev/null 2>&1) && echo repo=1`,
     `command -v kubectl >/dev/null 2>&1 && echo kubectl=1`,
+    `n=$(grep -Ec '^[[:space:]]*"openai-codex(:[^"]*)?"[[:space:]]*:[[:space:]]*\\{' ${configDir}/auth.json 2>/dev/null); echo "codexAccounts=\${n:-0}"`,
+    `{ grep -Eq '"key"[[:space:]]*:[[:space:]]*"[^"]+"' "$HOME/.grok/auth.json" 2>/dev/null || [ -n "\${XAI_API_KEY:-}\${GROK_API_KEY:-}\${GROK_CODE_XAI_API_KEY:-}" ]; } && echo grok=1`,
+    `{ [ -s "\${ELANOUS_KEY_CACHE_DIR:-$HOME/.cache}/openrouter_api_key" ] || [ -n "\${OPENROUTER_API_KEY:-}" ]; } && echo openrouter=1`,
     `true`,
   ].join('; ');
 }
@@ -242,6 +245,16 @@ export function judgeParentHostFacts(facts: Record<string, string>, input: Omit<
   return gaps;
 }
 
+/** 순수 판정 — 원격 LLM 자격 사실 → 경고 목록(막지 않는다 · gaps 와 별개). 못 닿은 호스트는 사실이 없으므로 경고도 없다. */
+export function judgeParentHostCredentials(facts: Record<string, string>): string[] {
+  if (facts.unreachable) return [];
+  const warnings: string[] = [];
+  if (!(Number(facts.codexAccounts) > 1)) warnings.push('codex-accounts-low');
+  if (facts.grok !== '1') warnings.push('grok-credential-missing');
+  if (facts.openrouter !== '1') warnings.push('openrouter-key-missing');
+  return warnings;
+}
+
 export function preflightParentHost(input: PreflightInput): ParentHostPreflight {
   const ssh = input.ssh ?? defaultSshRunner;
   const facts: Record<string, string> = {};
@@ -252,7 +265,18 @@ export function preflightParentHost(input: PreflightInput): ParentHostPreflight
     if (at > 0) facts[line.slice(0, at).trim()] = line.slice(at + 1).trim();
   }
   const gaps = judgeParentHostFacts(facts, { localVersion: input.localVersion, launchHoldActive: input.launchHoldActive, podPoolOverride: Boolean(input.target.podPool) });
-  return { ok: gaps.length === 0, gaps, facts };
+  const warnings = judgeParentHostCredentials(facts);
+  if (warnings.length) {
+    try {
+      debug.log('task-agent.parent-host', 'credential-warning', {
+        host: input.target.host,
+        codexAccounts: Number(facts.codexAccounts) || 0,
+        grok: facts.grok === '1' ? 1 : 0,
+        openrouter: facts.openrouter === '1' ? 1 : 0,
+      });
+    } catch { /* fail-soft */ }
+  }
+  return { ok: gaps.length === 0, gaps, warnings, facts };
 }
 
 /** 원격이 «확실히 안 띄웠다»고 답했다 — 호출부가 로컬로 돌아가도 중복 발사가 아니다. */

package/src/task-agent/rejudge-on-head.ts

@@ -19,6 +19,10 @@
  *   거절되면 그 시도는 `base-stale` 갈래로 적히고(judgement 1회 규칙과 섞이지 않는다), 다음 틱이 «같은 머리»를 새 base 위에서 한 번 더
  *   재게이트한다(`staleBase` = 낡은 base · 멱등 키 = 머리 ⊕ staleBase · 상한에 포함). 그 재게이트가 통과하고 base 가 실제로 바뀌었을 때만
  *   새 baseCommit 으로 증거를 다시 써 land 한다(`gateAt` 으로 앞 base-stale 시도를 소비) — 관측 `rejudge-on-head {step:'regate', reason:'base-stale-overlap …'}`.
+ * - TA-REJUDGE-REBASE-LOOP: 그 1회가 «같은 base» 로 돌아오거나 stale 재게이트에 `baseCommit` 이 없으면 needs-owner 로 멈추지 않는다. origin/main 을
+ *   fetch 한 뒤 PR 가지에 3-way merge(rerere 켬 · ⛔ rebase/force-push/reset/파일째 checkout) 하고 일반 push 로 새 머리를 만든 다음, 그 머리는 기존
+ *   ①②③ 사슬을 탄다. 머리마다 1회 · 카드당 `CATCH_UP_CAP`(기본 2)회. 충돌이면 `merge --abort` ⊕ needs-owner(`main 따라잡기 충돌 · 파일 …`).
+ *   관측 `rejudge-on-head {step:'catch-up', decision: pushed|conflict|cap-reached, fromBase, toBase, newHead}`.
  * - 대상: 카드에 묶인 PR(URL 로 저장소 확인) ⊕ 그 PR 로 TA 가 이미 리뷰를 요청한 카드(= 런이 멈춰 TA 판단이 시작됐다).
  * - 사람의 hold(draft PR)는 뒤집지 않는다 — 재게이트(`noMerge`)와 land 관문이 draft 를 거부한다.
  * - 허용: 설정 `taskAgent.liveMoves` 그대로 — 재게이트·land 는 `propose-land`, 리뷰 재요청은 `review` 가 있을 때만(없으면 «했을 수»).
@@ -26,7 +30,8 @@
  *   한 줄(`event:'rejudge-on-head'` · 같은 머리·같은 단계·같은 판단은 한 번).
  */
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import type { DetachedSpawn } from '../cli/tasks-cli.js';
@@ -39,18 +44,37 @@ import { cardPrNumber, readTaskCard, taskAgentStatePath, updateTaskCard, type Ta
 export const REJUDGE_ON_HEAD_EVENT = 'rejudge-on-head';
 /** 카드·PR 당 재게이트하는 머리 수 상한(머리가 바뀔 때마다 하나) — 넘으면 멈추고 사람에게 넘긴다. */
 export const REJUDGE_HEAD_CAP = 3;
+/** 카드당 origin/main 따라잡기(merge⊕push) 상한 — 넘으면 멈추고 사람에게 넘긴다. 머리마다 1회. */
+export const CATCH_UP_CAP = 2;
 /** 떼어 띄운 재게이트 결과를 기다리는 상한 — 지나도 파일이 없으면 «결과 없음»으로 적는다(같은 머리는 다시 안 돌린다). */
 export const REGATE_RESULT_WAIT_MS = 90 * 60_000;
 
-export type RejudgeStep = 'regate' | 'review' | 'land' | 'target';
-export interface RejudgeOutcome { card: string; pr: number | null; fromHead: string | null; toHead: string | null; step: RejudgeStep; decision: string; reason: string }
+export type RejudgeStep = 'regate' | 'review' | 'land' | 'target' | 'catch-up';
+export type CatchUpDecision = 'pushed' | 'conflict' | 'cap-reached' | 'failed';
+export interface RejudgeOutcome {
+  card: string; pr: number | null; fromHead: string | null; toHead: string | null; step: RejudgeStep; decision: string; reason: string;
+  fromBase?: string; toBase?: string; newHead?: string;
+}
 
 export interface RegateRequest { card: string; pr: number; head: string; repoRoot: string; resultPath: string }
+export interface CatchUpRequest { cwd: string; pr: number; head: string; branch?: string; fromBase?: string; worktreePath?: string }
+export interface CatchUpResult {
+  decision: Exclude<CatchUpDecision, 'cap-reached'>;
+  reason: string;
+  fromBase?: string;
+  toBase?: string;
+  newHead?: string;
+  files?: string[];
+  pushArgs?: string[];
+}
+export type CatchUpGit = (cwd: string, args: string[]) => { status: number | null; stdout: string; stderr: string };
 export interface RejudgeDeps {
   live?: LiveMoveDeps;
   liveMoves: ReadonlySet<TaskAgentLiveMove>;
   /** 재게이트를 떼어 띄운다 — 시험은 주입한다. 기본은 `tasks regate-run` 자식(stdio ignore · 결과는 파일). */
   requestRegate?: (request: RegateRequest) => Promise<void>;
+  /** TA-REJUDGE-REBASE-LOOP — origin/main 을 PR 가지에 3-way merge 하고 일반 push. 시험은 주입한다. */
+  catchUpMain?: (request: CatchUpRequest) => Promise<CatchUpResult>;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
   /** 시험 seam — 결과 파일 읽기(없으면 ENOENT). */
   readFile?: (path: string) => string;
@@ -104,6 +128,83 @@ export function parseRegateResult(text: string, pr: number, head: string): Regat
 const sameUrl = (a: string, b: string) => a.trim().replace(/\/+$/, '').toLowerCase() === b.trim().replace(/\/+$/, '').toLowerCase();
 const sameHead = (a: string, b: string) => a.toLowerCase() === b.toLowerCase();
 
+const defaultCatchUpGit: CatchUpGit = (cwd, args) => {
+  const r = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: 120_000 });
+  return { status: r.status, stdout: String(r.stdout ?? ''), stderr: String(r.stderr ?? '') };
+};
+
+export function catchUpWorktreePath(statePath: string, cardId: string, pr: number, head: string): string {
+  return join(dirname(statePath), 'catch-up-worktrees', `${safe(cardId)}-${pr}-${safe(head.slice(0, 12))}`);
+}
+
+const gitSha = (text: string): string | null => {
+  const value = text.trim();
+  return /^[0-9a-f]{40}$/i.test(value) ? value : null;
+};
+
+const catchUpFail = (reason: string, extra: Partial<CatchUpResult> = {}): CatchUpResult => ({ decision: 'failed', reason, ...extra });
+
+/**
+ * origin/main 을 PR 머리에 3-way merge(rerere 켬) 하고 일반 push 한다.
+ * ⛔ rebase · force-push · reset · 남의 가지 파일째 checkout — 충돌이면 merge --abort.
+ */
+export async function defaultCatchUpMain(request: CatchUpRequest, git: CatchUpGit = defaultCatchUpGit): Promise<CatchUpResult> {
+  const repo = request.cwd;
+  const work = request.worktreePath ?? join(tmpdir(), `ta-catch-up-${request.pr}-${safe(request.head.slice(0, 12))}-${process.pid}`);
+  const gitRepo = (args: string[]) => git(repo, args);
+  const gitWork = (args: string[]) => git(work, args);
+  const fromBase = request.fromBase;
+  if (!request.branch) return catchUpFail('PR head branch name unknown', { fromBase });
+
+  const fetchMain = gitRepo(['fetch', 'origin', 'refs/heads/main']);
+  if (fetchMain.status !== 0) return catchUpFail(`origin/main fetch failed: ${(fetchMain.stderr || fetchMain.stdout).trim().slice(-200)}`, { fromBase });
+  const toBase = gitSha(gitRepo(['rev-parse', 'FETCH_HEAD']).stdout);
+  if (!toBase) return catchUpFail('origin/main sha unreadable', { fromBase });
+
+  const fetchPr = gitRepo(['fetch', 'origin', `pull/${request.pr}/head`]);
+  if (fetchPr.status !== 0) return catchUpFail(`fetch pull/${request.pr}/head failed: ${(fetchPr.stderr || fetchPr.stdout).trim().slice(-200)}`, { fromBase, toBase });
+  const fetchedHead = gitSha(gitRepo(['rev-parse', 'FETCH_HEAD']).stdout);
+  if (!fetchedHead || !sameHead(fetchedHead, request.head)) {
+    return catchUpFail(`fetched PR head ${(fetchedHead ?? '?').slice(0, 12)} ≠ ${request.head.slice(0, 12)}`, { fromBase, toBase });
+  }
+
+  const added = gitRepo(['worktree', 'add', '--detach', work, request.head]);
+  if (added.status !== 0) return catchUpFail(`worktree add failed: ${(added.stderr || added.stdout).trim().slice(-200)}`, { fromBase, toBase });
+  const cleanup = () => { gitRepo(['worktree', 'remove', '--force', work]); };
+
+  gitWork(['config', 'rerere.enabled', 'true']);
+  const merge = gitWork(['merge', '--no-ff', toBase, '-m', `catch-up: merge origin/main into PR #${request.pr}`]);
+  if (merge.status !== 0) {
+    const files = gitWork(['diff', '--name-only', '--diff-filter=U']).stdout.split('\n').map((line) => line.trim()).filter(Boolean);
+    gitWork(['merge', '--abort']);
+    cleanup();
+    return {
+      decision: 'conflict',
+      reason: `main 따라잡기 충돌 · 파일 ${files.join(', ') || '(unknown)'}`,
+      fromBase, toBase, files,
+    };
+  }
+  const newHead = gitSha(gitWork(['rev-parse', 'HEAD']).stdout);
+  if (!newHead) { cleanup(); return catchUpFail('merge produced no head sha', { fromBase, toBase }); }
+  const pushArgs = ['push', 'origin', `HEAD:${request.branch}`];
+  const push = gitWork(pushArgs);
+  cleanup();
+  if (push.status !== 0) return catchUpFail(`push failed: ${(push.stderr || push.stdout).trim().slice(-200)}`, { fromBase, toBase, newHead, pushArgs });
+  return {
+    decision: 'pushed',
+    reason: `merged origin/main ${toBase.slice(0, 12)} → head ${newHead.slice(0, 12)}`,
+    fromBase, toBase, newHead, pushArgs,
+  };
+}
+
+/** 실제로 «시도한» 따라잡기 기록(pushed·conflict·failed) — `cap-reached`·`would-catch-up` 표지는 시도가 아니다. */
+const CATCH_UP_ATTEMPT_EFFECTS: ReadonlySet<string> = new Set(['pushed', 'conflict', 'failed']);
+
+function catchUpHistory(card: Pick<TaskCard, 'history'>, pr: number) {
+  return (card.history ?? []).filter((item) => item.event === REJUDGE_ON_HEAD_EVENT && item.kind === 'catch-up' && item.pr === pr
+    && typeof item.effect === 'string' && CATCH_UP_ATTEMPT_EFFECTS.has(item.effect));
+}
+
 /** 카드의 PR URL 과 같은 PR 을 돌려주는 후보 저장소 — 못 찾으면 이유. */
 async function resolveCardPr(card: TaskCard, pr: number, url: string, deps: LiveMoveDeps): Promise<{ cwd: string; view: PrHeadView } | { reason: string }> {
   let candidates: readonly ReviewRepoCandidate[];
@@ -195,7 +296,50 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const { cwd, view } = found;
   const toHead = view.head;
   if (view.state !== 'OPEN') return target('pr-not-open', `PR #${pr} is ${view.state}`, pr, fromHead, toHead);
-  const step = (s: RejudgeStep, decision: string, reason: string, record: boolean) => emit({ card: card!.id, pr, fromHead, toHead, step: s, decision, reason }, record);
+  const step = (s: RejudgeStep, decision: string, reason: string, record: boolean, extra: Partial<RejudgeOutcome> = {}) =>
+    emit({ card: card!.id, pr, fromHead, toHead, step: s, decision, reason, ...extra }, record);
+
+  const tryCatchUp = async (fromBase: string | undefined, why: string): Promise<boolean> => {
+    const prior = catchUpHistory(card!, pr);
+    // 상한은 «실제 push» 만 센다 — 충돌·실패 뒤 사람이 새 머리를 올리면 다시 시도할 수 있어야 한다.
+    const pushed = prior.filter((item) => item.effect === 'pushed').length;
+    if (pushed >= CATCH_UP_CAP) {
+      step('catch-up', 'cap-reached', `${why} · catch-up pushed ${pushed} times already (cap ${CATCH_UP_CAP}) — needs owner`, true, { fromBase });
+      return true;
+    }
+    if (prior.some((item) => item.head && sameHead(item.head, toHead))) {
+      step('catch-up', 'cap-reached', `${why} · already catch-up on this head — needs owner`, true, { fromBase });
+      return true;
+    }
+    if (!deps.liveMoves.has('propose-land')) {
+      step('catch-up', 'would-catch-up', `${why} · propose-land not enabled in taskAgent.liveMoves — shadow`, false, { fromBase });
+      return true;
+    }
+    let result: CatchUpResult;
+    try {
+      result = await (deps.catchUpMain ?? defaultCatchUpMain)({
+        cwd, pr, head: toHead, branch: view.branch, fromBase,
+        worktreePath: catchUpWorktreePath(statePath, card!.id, pr, toHead),
+      });
+    } catch (error) {
+      result = { decision: 'failed', reason: `catch-up threw: ${(error instanceof Error ? error.message : String(error)).slice(-200)}`, fromBase };
+    }
+    const extra: Partial<RejudgeOutcome> = {
+      ...(result.fromBase ? { fromBase: result.fromBase } : fromBase ? { fromBase } : {}),
+      ...(result.toBase ? { toBase: result.toBase } : {}),
+      ...(result.newHead ? { newHead: result.newHead } : {}),
+    };
+    if (result.decision === 'pushed') {
+      step('catch-up', 'pushed', result.reason, true, extra);
+      return true;
+    }
+    if (result.decision === 'conflict') {
+      step('catch-up', 'conflict', result.reason, true, extra);
+      return true;
+    }
+    step('catch-up', result.decision, `${why} · ${result.reason} — needs owner`, true, extra);
+    return true;
+  };
 
   // 머리가 런 멈춤 때 그대로면 재판정하지 않는다 — 그 머리의 재게이트·리뷰·land 판단은 멈춤 때의 판단(슈퍼바이저 틱)이 이미 했다.
   //   TA-LAND-RETRY-ON-INFRA — 단, 그 머리의 land 가 TA 쪽 인프라 결손으로 실패해 재시도가 남았으면 아래 ①②③ 을 그대로 탄다
@@ -208,7 +352,7 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
   const stale = regate?.passed === true ? baseStaleAttemptAfter(card, pr, toHead, regate.at) : undefined;
   const staleBase = stale ? regate?.baseCommit : undefined;
   if (stale && !staleBase) {
-    step('regate', 'not-regating', `base-stale-overlap on head ${toHead.slice(0, 12)} but the stale regate has no baseCommit — needs owner`, true);
+    await tryCatchUp(undefined, `base-stale-overlap on head ${toHead.slice(0, 12)} but the stale regate has no baseCommit`);
     return outcomes;
   }
   if (!regate || staleBase) {
@@ -282,9 +426,9 @@ export async function rejudgeCardOnHead(cardId: string, deps: RejudgeDeps): Prom
     step('land', 'not-landing', regate ? (regate.passed === false ? `host regate not passed: ${regate.detail ?? regate.status ?? 'unknown'}` : 'host regate still running') : 'no host regate for this head', regate?.passed === false);
     return outcomes;
   }
-  // REJUDGE base-stale — 새 base 위 재게이트가 «같은» base 로 돌아왔다 — 증거가 또 낡았다고 거절될 것이므로 land 하지 않는다(재게이트도 멱등 키로 0).
+  // REJUDGE base-stale — 새 base 위 재게이트가 «같은» base 로 돌아왔다 → origin/main 따라잡기(merge⊕push) 후 새 머리 재게이트.
   if (regate.staleBase && regate.baseCommit && sameHead(regate.baseCommit, regate.staleBase)) {
-    step('land', 'not-landing', `base-stale-overlap — re-gate on head ${toHead.slice(0, 12)} returned the same base ${regate.staleBase.slice(0, 12)} (did not advance) — no land, no further re-gate on this base; needs owner`, true);
+    await tryCatchUp(regate.staleBase, `base-stale-overlap — re-gate on head ${toHead.slice(0, 12)} returned the same base ${regate.staleBase.slice(0, 12)} (did not advance)`);
     return outcomes;
   }
   if (!deps.liveMoves.has('propose-land')) { step('land', 'would-land', 'propose-land not enabled in taskAgent.liveMoves — shadow', false); return outcomes; }

package/src/task-agent/review-result-capture.ts

@@ -12,6 +12,7 @@
  */
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { isNoneSentinelFinding } from '../agent-substrate/pr-reviewer.js';
 import { debug } from '../debug/log.js';
 import { LIVE_MOVE_RESULT_EVENT, readTaskAgentState, updateTaskCard, type TaskCard, type TaskCardEvent } from './task-hand.js';
 
@@ -63,7 +64,8 @@ export function parseReviewResultOutput(text: string): ParsedReviewResult | null
       ...(Number.isSafeInteger(prRaw) && prRaw > 0 ? { pr: prRaw } : {}),
       verdict: typeof v.verdict === 'string' ? v.verdict : null,
       reviewed: typeof v.reviewed === 'boolean' ? v.reviewed : null,
-      mustFix: Array.isArray(v.mustFix) && v.mustFix.every((fix) => typeof fix === 'string') ? v.mustFix.length : null,
+      // PR-LAND-MUSTFIX-NONE — 저장된 결과(옛 판 리뷰 · 다른 경로)에 «(없음 — …)» 표지 줄이 남아 있어도 리뷰 출력과 «같은» 판정으로 0 으로 센다.
+      mustFix: Array.isArray(v.mustFix) && v.mustFix.every((fix) => typeof fix === 'string') ? v.mustFix.filter((fix) => !isNoneSentinelFinding(fix)).length : null,
       reviewRoute: typeof v.reviewRoute === 'string' ? v.reviewRoute : null,
       head: typeof v.headCommit === 'string' && SHA40.test(v.headCommit) ? v.headCommit : null,
       error: typeof v.error === 'string' ? v.error : null,

package/src/task-agent/shadow.ts

@@ -17,6 +17,7 @@ import type { SupervisorJobResult, SupervisorStopReason } from '../self-dev/run-
 import { executeNextAction, type DeliveryKind, type NextAction } from './actions.js';
 import { judgeNextMove, type TaskJudgeInput, type TaskJudgement } from './judge.js';
 import { HARNESS_RUN_ID_ENV } from '../harness/harness-space.js';
+import { collectWiringEvidence, type WiringEvidenceDeps } from './card-evidence.js';
 import { recordLiveMoveHistory } from './live-move-history.js';
 import { capturedSelfReview, captureReviewResults, hasCapturedPass } from './review-result-capture.js';
 import { configuredTaskAgentLiveMoves, defaultPrHead, executeLiveGreenProposal, executeLiveLand, executeLiveReview, type LiveMoveDeps, type LiveMoveResult, type TaskAgentLiveMove } from './live-moves.js';
@@ -60,6 +61,8 @@ export interface TaskAgentShadowDeps {
   live?: LiveMoveDeps;
   /** 카드 조회 상태 파일(시험 주입 · 운영 파일을 건드리지 않게). 기본 = `live.statePath` ⊕ `taskAgentStatePath()`. */
   statePath?: string;
+  /** TA-WIRING-CHECK — 배선 근거 수집 의존(시험 주입 · 기본 = gh pr diff 한 번 ⊕ 카드 런 원장). */
+  wiring?: Omit<WiringEvidenceDeps, 'card'>;
   /** Process env for the launched-run id (`ELANOUS_RUN_ID`) — test seam; default process.env. */
   env?: NodeJS.ProcessEnv;
 }
@@ -325,6 +328,15 @@ export async function recordTaskAgentShadowMove(input: TaskAgentShadowInput, dep
     ...move, completion: shadowCompletion(card, cardLookupFailed), card: liveCard?.id ?? null, live, liveExecuted: liveMove?.executed ?? false, ...(liveMove ? { liveOk: liveMove.ok } : {}),
     ...(reviewFromCapture ? { reviewSource: 'captured-review-result' } : {}),
   });
+  // TA-WIRING-CHECK — 병합 PR 은 판단한 «뒤» 배선 근거를 관측만 한다(move 불변 · 실패는 unknown 으로 남기고 던지지 않는다).
+  if (judgeInput.prState === 'MERGED' && typeof judgeInput.pr === 'number' && !delivery && liveCard) {
+    try {
+      const wiring = await collectWiringEvidence(judgeInput.pr, { ...deps.wiring, card: liveCard });
+      (deps.log ?? ((category, event, data) => debug.log(category, event, data)))('task-agent', 'wiring-shadow', {
+        card: liveCard.id, pr: judgeInput.pr, required: wiring.required, liveRunRecorded: wiring.liveRunRecorded, unknown: wiring.unknown,
+      });
+    } catch { /* fail-soft — 관측일 뿐 판단을 막지 않는다 */ }
+  }
   // TA-LIVE-MOVE-CARD-HISTORY — live-move 수(review·propose-green·propose-land)는 실행이든 그림자든 그 카드 history 에 한 줄.
   // 결정·실행이 끝난 «뒤»에 덧붙이기만 한다(반환값·관측 무변경) · 실패는 관측만(live-move 를 막지 않는다).
   if (liveKind !== null) recordLiveMoveOnCard({

package/src/task-agent/task-hand.ts

@@ -487,7 +487,10 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   if (!opts.launcher) throw new Error('--live 인데 launcher 가 없다');
   const runId = mintRunId();
   const launchId = `tl-${randomBytes(6).toString('hex')}`;
-  const context: TaskLaunchContext = { runId, launchId, env: { [HARNESS_RUN_ID_ENV]: runId, ELANOUS_TASK_CARD_ID: card.id, ...(card.taLand ? { [TA_LAND_ENV]: '1' } : {}) }, cardLabelContext: taskCardLabelContext(card) };
+  const context: TaskLaunchContext = { runId, launchId, env: { [HARNESS_RUN_ID_ENV]: runId, ELANOUS_TASK_CARD_ID: card.id,
+    ...(card.checklistId ? { ELANOUS_POD_SLOT_ID: card.checklistId } : {}),
+    ...(card.seat ? { ELANOUS_POD_OWNER_KIND: 'seat', ELANOUS_POD_OWNER_ID: card.seat } : {}),
+    ...(card.taLand ? { [TA_LAND_ENV]: '1' } : {}) }, cardLabelContext: taskCardLabelContext(card) };
   let receipt: void | TaskLaunchReceipt;
   try {
     receipt = await opts.launcher(move.command!, project?.target, context);

package/src/task-orchestrator/surfaces/pod-command-job.ts

@@ -371,6 +371,12 @@ export interface RunPodCommandOptions {
   runId?: string;
   name?: string;
   pollMs?: number;
+  /**
+   * GATE-MULTI-HOST — throw once the Job's status has been unreadable (`kubectl get job` failing) this long, instead of
+   * polling forever: a pool member that died mid-Job (host off · tailnet drop) then frees its caller to place the work
+   * elsewhere. Omitted = poll without a bound (unchanged for every caller but the release gate).
+   */
+  statusUnreadableMs?: number;
   kubectl?: Kubectl;
   /** A caller-owned scheduler is self-capped: acquires count only its own Jobs, never cluster occupancy (POOLGLOBAL-REG). */
   poolScheduler?: PodPoolScheduler;
@@ -536,10 +542,18 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       throw new Error(applied.stderr.trim() || 'pod command: Job 적용 실패');
     }
     let state: 'complete' | 'failed' = 'failed';
+    let unreadableSince: number | null = null;
     for (;;) {
       const got = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
       const finished = jobFinished(got.stdout);
       if (finished) { state = finished; break; }
+      if (got.status !== 0 && options.statusUnreadableMs !== undefined) {
+        unreadableSince ??= Date.now();
+        if (Date.now() - unreadableSince >= options.statusUnreadableMs) {
+          log('pod.command', 'job-status-unreadable', { job: name, context, unreadableMs: Date.now() - unreadableSince, error: (got.stderr ?? '').trim().slice(0, 300) });
+          throw new Error(`pod command: Job 상태를 ${Math.round(options.statusUnreadableMs / 1000)}초 동안 못 읽었다(${context}) — ${(got.stderr ?? '').trim().split('\n').pop()?.slice(0, 200) ?? ''}`);
+        }
+      } else unreadableSince = null;
       await sleep(options.pollMs ?? 15_000);
     }
     const logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);

package/src/task-orchestrator/surfaces/pod-host-acp-review.ts

@@ -0,0 +1,122 @@
+// REVIEW-ACP-POD (0.2.25 · REVIEW-ACP-DEFAULT ② 조각) — Pod 런이 낸 merge-ready PR 을 «호스트»가 Claude ACP(구독)로 다시 본다.
+//
+// S  Pod 안 하니스 리뷰는 api 리뷰어(codex 기본 gpt-6-sol · OR Pod 는 glm 고정)로 돈다 — Pod 엔 Claude 구독도 정책 파일도 없어
+//    `roleLlm.reviewer = claude-acp`(운영에 이미 켜져 있다)가 Pod 안에선 «안 닿는다». 호스트 레인 런만 ACP 로 리뷰받는다.
+// C  Pod 가 호스트로 돌려보내는 유일한 문은 merge-ready → 호스트 재게이트 → 병합이다. 여기에 리뷰가 없다.
+// Q  Pod 런의 리뷰를 구독(ACP)으로 옮기려면 어디서 하나?
+// A  호스트 병합 직전 한 자리에서, 하니스 레인과 «같은» 정책 행(`resolveSubscriptionReviewer`)·같은 가용성 검사
+//    (`subscriptionReviewerAvailability` — 구독 확인 · 상한 · 프록시)·같은 ACP 리뷰어(`makeAcpReviewLLM`)로 PR 을 본다.
+//    ⛔ 못 쓰면(설정 없음·구독 확인 실패·상한·프록시 없음·리뷰 미완) «refused» 로 돌려주고 호출자는 종전 길(Pod 리뷰 결과로 재게이트)을 그대로 간다.
+//       조용히 다른 공급자로 새지 않는다 — 이 함수 안엔 api 폴백이 «없다».
+//    ⛔ 기본 꺼짐(opt-in): 옵션 → env `ELANOUS_POD_HOST_ACP_REVIEW` → config `llm.podHostAcpReview` 순.
+//    📌 남은 조각(②-b): 이 문이 켜진 런에서 Pod 안 api 리뷰를 «끄는» 것은 Pod 이미지 쪽 변경이라 따로 간다.
+import { spawnSync } from 'node:child_process';
+import { debug } from '../../debug/log.js';
+import type { ReviewResult } from '../../agent-substrate/pr-reviewer.js';
+import type { SubscriptionReviewerSpec } from '../../user-config.js';
+import type { SubscriptionReviewerDeps, subscriptionReviewerSpawn } from '../../self-dev/review-provider-fallback.js';
+
+export const POD_HOST_ACP_REVIEW_ENV = 'ELANOUS_POD_HOST_ACP_REVIEW';
+
+export type PodHostAcpReviewEnable = { enabled: boolean; source: 'option' | 'env' | 'config' | 'default' };
+
+/** 켜는 순서: 옵션 → env(`1`/`true` 켬 · `0`/`false` 끔) → config `llm.podHostAcpReview === true` → 꺼짐. 읽기 실패는 꺼짐(종전). */
+export function resolvePodHostAcpReview(
+  option: boolean | undefined,
+  env: NodeJS.ProcessEnv,
+  readConfig: () => unknown,
+): PodHostAcpReviewEnable {
+  if (typeof option === 'boolean') return { enabled: option, source: 'option' };
+  const raw = env[POD_HOST_ACP_REVIEW_ENV]?.trim().toLowerCase();
+  if (raw === '1' || raw === 'true') return { enabled: true, source: 'env' };
+  if (raw === '0' || raw === 'false') return { enabled: false, source: 'env' };
+  try {
+    const cfg = readConfig() as { llm?: { podHostAcpReview?: unknown } } | undefined;
+    if (cfg?.llm?.podHostAcpReview === true) return { enabled: true, source: 'config' };
+  } catch { /* 읽기 실패 = 꺼짐(종전 길) */ }
+  return { enabled: false, source: 'default' };
+}
+
+export type PodHostAcpReviewOutcome =
+  | { status: 'clean'; mustFix: 0; shouldFix: number }
+  | { status: 'must-fix'; mustFix: number; findings: string[]; verdict: ReviewResult['verdict'] }
+  | { status: 'refused'; reason: string };
+
+export interface PodHostAcpReviewDeps {
+  /** `{ spec, cap }` — 기본은 하니스 레인과 같은 정책 행(`resolveSubscriptionReviewer`). */
+  resolveReviewer?: () => { spec: SubscriptionReviewerSpec; cap: number } | undefined;
+  /** 구독·상한·프록시 확인 — 기본은 `subscriptionReviewerAvailability`. */
+  availability?: (spec: SubscriptionReviewerSpec, cap: number) => { spawn?: ReturnType<typeof subscriptionReviewerSpawn>; reason?: string };
+  subscriptionReviewerDeps?: SubscriptionReviewerDeps;
+  /** PR 머리 sha·제목·본문·diff. 기본은 `gh`. */
+  readPr?: (prNumber: number, repoRoot: string) => { headRefOid: string; title: string; body: string; diff: string } | undefined;
+  /** ACP 리뷰어(prompt→text). 기본은 `makeAcpReviewLLM({ backend: 'claude', backendSpec, env })`. */
+  makeAcpReviewLLM?: (spawn: ReturnType<typeof subscriptionReviewerSpawn>, repoRoot: string) => (prompt: string) => Promise<string>;
+  reviewPullRequest?: (input: { prDiff: string; phaseIntent: string }, llm: (prompt: string) => Promise<string>) => Promise<ReviewResult>;
+  env?: NodeJS.ProcessEnv;
+}
+
+function defaultReadPr(prNumber: number, repoRoot: string): { headRefOid: string; title: string; body: string; diff: string } | undefined {
+  const view = spawnSync('gh', ['pr', 'view', String(prNumber), '--json', 'headRefOid,title,body'], { cwd: repoRoot, encoding: 'utf8', timeout: 60_000 });
+  if (view.status !== 0) return undefined;
+  const diff = spawnSync('gh', ['pr', 'diff', String(prNumber)], { cwd: repoRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 64 * 1024 * 1024 });
+  if (diff.status !== 0) return undefined;
+  try {
+    const parsed = JSON.parse(view.stdout) as { headRefOid?: unknown; title?: unknown; body?: unknown };
+    if (typeof parsed.headRefOid !== 'string') return undefined;
+    return { headRefOid: parsed.headRefOid, title: typeof parsed.title === 'string' ? parsed.title : '', body: typeof parsed.body === 'string' ? parsed.body : '', diff: diff.stdout };
+  } catch { return undefined; }
+}
+
+function refused(reason: string, data: Record<string, unknown>): PodHostAcpReviewOutcome {
+  try { debug.log('self-implement.pod', 'acp-review-refused', { ...data, reason }, { level: 'warn' }); } catch { /* 관측은 결과를 안 바꾼다 */ }
+  return { status: 'refused', reason };
+}
+
+/** Pod merge-ready PR 을 호스트 Claude ACP 로 리뷰한다. ⛔ 던지지 않는다 — 모든 실패는 `refused`(호출자는 종전 길). */
+export async function runPodHostAcpReview(
+  input: { prNumber: number; headCommit: string; repoRoot: string; job?: string },
+  deps: PodHostAcpReviewDeps = {},
+): Promise<PodHostAcpReviewOutcome> {
+  const obs = { job: input.job ?? null, pr: input.prNumber, head: input.headCommit };
+  try {
+    const env = deps.env ?? process.env;
+    // 지연 import — 이 문이 꺼진 런은 정책·설정을 안 읽는다.
+    const picked = deps.resolveReviewer ? deps.resolveReviewer() : await (async () => {
+      const { loadLlmPolicy, resolveSubscriptionReviewer } = await import('../../policy/llm-policy.js');
+      const { getUserConfig } = await import('../../user-config.js');
+      return resolveSubscriptionReviewer(loadLlmPolicy(), getUserConfig().roleLlm);
+    })();
+    if (!picked) return refused('no-subscription-reviewer', obs);
+    const avail = deps.availability
+      ? deps.availability(picked.spec, picked.cap)
+      : (await import('../../self-dev/review-provider-fallback.js')).subscriptionReviewerAvailability(picked.spec, picked.cap, env, deps.subscriptionReviewerDeps);
+    if (!avail.spawn) return refused(`unavailable: ${avail.reason ?? 'unknown'}`, { ...obs, cap: picked.cap });
+    const pr = (deps.readPr ?? defaultReadPr)(input.prNumber, input.repoRoot);
+    if (!pr) return refused('pr-unreadable', obs);
+    if (pr.headRefOid.toLowerCase() !== input.headCommit.toLowerCase()) return refused('head-moved', { ...obs, prHead: pr.headRefOid });
+    if (!pr.diff.trim()) return refused('empty-diff', obs);
+    const llm = deps.makeAcpReviewLLM
+      ? deps.makeAcpReviewLLM(avail.spawn, input.repoRoot)
+      : await (async () => {
+        const { makeAcpReviewLLM } = await import('../../agent-substrate/acp-reviewer.js');
+        const spawn = avail.spawn!;
+        return makeAcpReviewLLM({ cwd: input.repoRoot, backend: 'claude', backendSpec: spawn.backendSpec, env: spawn.env });
+      })();
+    const review = deps.reviewPullRequest ?? (await import('../../agent-substrate/pr-reviewer.js')).reviewPullRequest;
+    const phaseIntent = [`Pod 런 PR #${input.prNumber} 의 호스트 Claude ACP 리뷰(병합 전 관문).`, pr.title, pr.body.slice(0, 4000)].filter((s) => s.trim()).join('\n\n');
+    const rr = await review({ prDiff: pr.diff, phaseIntent }, llm);
+    // ⛔ reviewed=false(파싱 실패·ACP 오류를 리뷰어가 흡수) 는 «리뷰 완료»가 아니다 — 통과로 읽지 않는다.
+    if (!rr.reviewed) return refused('acp-review-not-completed', obs);
+    const mustFix = rr.mustFix.length;
+    if (rr.verdict === 'fail' || mustFix > 0) {
+      debug.log('self-implement.pod', 'host-acp-review', { ...obs, status: 'must-fix', verdict: rr.verdict, mustFix, shouldFix: rr.shouldFix.length });
+      return { status: 'must-fix', mustFix, findings: rr.mustFix.slice(0, 10), verdict: rr.verdict };
+    }
+    debug.log('self-implement.pod', 'host-acp-review', { ...obs, status: 'clean', verdict: rr.verdict, mustFix: 0, shouldFix: rr.shouldFix.length });
+    return { status: 'clean', mustFix: 0, shouldFix: rr.shouldFix.length };
+  } catch (error) {
+    // 원문은 싣지 않는다 — 계정·프록시 문면이 섞일 수 있다(하니스 레인과 같은 규율).
+    return refused(/handshake timeout/i.test(error instanceof Error ? error.message : String(error)) ? 'acp-handshake-timeout' : 'acp-error', obs);
+  }
+}

package/src/task-orchestrator/surfaces/pod-manifest-test-normalize.ts

@@ -0,0 +1,23 @@
+import { BUDGET_SNAPSHOT_ENV } from '../../execution-loop/launch-gate.js';
+
+// Preserve the manifest contract except for two values generated per launch.
+export function stablePodManifestText(applied: Array<Record<string, any>>): string {
+  const manifests = structuredClone(applied.filter((entry) => entry.kind === 'Job' || entry.kind === 'Secret'));
+  let snapshots = 0;
+  for (const manifest of manifests) {
+    if (manifest.kind !== 'Job') continue;
+    for (const container of manifest.spec?.template?.spec?.containers ?? []) {
+      for (const entry of container.env ?? []) {
+        if (entry.name !== BUDGET_SNAPSHOT_ENV) continue;
+        snapshots++;
+        // Keep every original byte except this one volatile numeric value.
+        const measuredAt = /("measuredAt"\s*:\s*)\d+/g;
+        const matches = [...entry.value.matchAll(measuredAt)];
+        if (matches.length !== 1) throw new Error('budget snapshot must have exactly one numeric measuredAt');
+        entry.value = entry.value.replace(measuredAt, (_match: string, prefix: string) => `${prefix}0`);
+      }
+    }
+  }
+  if (snapshots === 0) throw new Error('manifest comparison requires a budget snapshot');
+  return JSON.stringify(manifests).replace(/run-[0-9a-f-]{36}/g, 'run-<id>');
+}

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -154,6 +154,59 @@ export function parsePodPool(spec: string): PodPoolMember[] {
  */
 export type PodPlacementKind = 'lite' | 'standard';
 
+/** Identity carried by a launched pool Job and its Pod; absent source fields stay absent. */
+export interface PodWorkIdentity {
+  ownerKind?: 'seat' | 'steward' | 'orchestrator' | 'external';
+  ownerId?: string;
+  taskCard?: string;
+  slotId?: string;
+  work?: 'harness' | 'authoring' | 'lite';
+}
+
+/** Kubernetes label values cannot exceed 63 characters or contain arbitrary card/owner text. */
+export function podWorkLabels(identity: PodWorkIdentity): Record<string, string> {
+  const value = (raw: string | undefined): string | undefined => {
+    const cleaned = (raw ?? '').replace(/[^A-Za-z0-9._-]+/g, '-').slice(0, 63).replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, '');
+    return cleaned || undefined;
+  };
+  const ownerId = identity.ownerId && value(identity.ownerId) === identity.ownerId ? identity.ownerId : undefined;
+  const taskCard = identity.taskCard && value(identity.taskCard) === identity.taskCard ? identity.taskCard : undefined;
+  const slotId = identity.slotId && value(identity.slotId) === identity.slotId ? identity.slotId : undefined;
+  return {
+    ...(identity.ownerKind && ownerId ? { 'elanous.owner-kind': identity.ownerKind, 'elanous.owner-id': ownerId } : {}),
+    ...(taskCard ? { 'elanous.task-card': taskCard } : {}),
+    ...(slotId ? { 'elanous.checklist': slotId } : {}),
+    ...(identity.work ? { 'elanous.work': identity.work } : {}),
+  };
+}
+
+/** Minih standard-Job policy, independent of the configured pool member capacity. Not wired into allocation. */
+export type MinihLocation = 'home' | 'external';
+
+export function minihStandardCapacity(location: MinihLocation): number {
+  return location === 'home' ? 1 : 2;
+}
+
+/** A drain withholds new slots until occupancy falls to the target; it never evicts Running Pods. */
+export function decideMinihDrain(location: MinihLocation, runningPods: number, pendingPods = 0): {
+  capacity: number;
+  runningPods: number;
+  drainNewAdmissions: boolean;
+  availableSlots: number;
+} {
+  if (![runningPods, pendingPods].every((count) => Number.isSafeInteger(count) && count >= 0)) {
+    throw new RangeError('node-c occupancy must be non-negative whole Pods');
+  }
+  const capacity = minihStandardCapacity(location);
+  const occupied = runningPods + pendingPods;
+  return {
+    capacity,
+    runningPods,
+    drainNewAdmissions: occupied > capacity,
+    availableSlots: Math.max(0, capacity - occupied),
+  };
+}
+
 export interface PodPlacement {
   readonly member: string;
   readonly kind: PodPlacementKind | null;