elanous 0.2.25 → 0.2.28

package/src/task-agent/remote-rejudge-bind.ts

@@ -0,0 +1,62 @@
+/** Bind remote TA parents from the HQ ledger mirror before `rejudge --all` selects PR cards. */
+import { dirname } from 'node:path';
+import { debug } from '../debug/log.js';
+import { loadRunLedger } from '../self-implement/run-ledger.js';
+import { bindCardEvidence, podChildRunIds, readCardRunSnapshot, refreshCardRunBinding } from './card-evidence.js';
+import { remoteLedgerMirrorDir } from './parent-host.js';
+import { cardPrNumber, type TaskCard } from './task-hand.js';
+
+/**
+ * A remote child PR can appear after the last HQ card refresh. A card without a PR is otherwise absent from
+ * `rejudgeCandidates`, so the normal rejudge tick never reaches `mirrorRemoteCardLedger` or the binding replay.
+ * Only an existing, launched TA-owned parent with a parent→child edge in its own host mirror is admitted. The
+ * launch registry (including foreign/test universes) and child-only ledgers are never scanned or adopted here.
+ */
+export async function bindMirroredRemoteRejudgeCards(
+  tasks: Readonly<Record<string, TaskCard>>, statePath: string,
+): Promise<{ scanned: number; bound: number; skipped: number }> {
+  const root = dirname(statePath);
+  let scanned = 0;
+  let bound = 0;
+  let skipped = 0;
+  for (const card of Object.values(tasks)) {
+    if (card.status !== 'launched' || card.taLand !== true || !card.parentHost || !card.runId
+      || cardPrNumber(card) !== undefined || card.refSource === 'manual') continue;
+    scanned++;
+    const dir = remoteLedgerMirrorDir(root, card.parentHost.host);
+    try {
+      const snapshot = await readCardRunSnapshot(card, {
+        loadLedger: (id) => loadRunLedger(id, dir),
+        podFinishes: () => [],
+      });
+      const parent = snapshot.host;
+      const evidence = bindCardEvidence(card, snapshot);
+      const childRunId = evidence.childRunId;
+      const pr = evidence.pr;
+      const child = childRunId ? snapshot.children[childRunId] : null;
+      // A PR event alone is not a completed remote run. The rejudge candidate must have the same exact
+      // child PR and terminal status that remoteBoundRunTerminal will later require.
+      if (snapshot.readErrors?.length || !parent || !childRunId || !pr?.url || !child
+        || !podChildRunIds(parent, card.runId).includes(childRunId)
+        || !child.some((entry) => entry.event === 'pr-opened' && entry.data?.number === pr.number
+          && entry.data?.url === pr.url)
+        || !child.some((entry) => entry.event === 'run-status'
+          && ['completed', 'failed', 'cancelled'].includes(String(entry.data?.runStatus)))) { skipped++; continue; }
+      const result = await refreshCardRunBinding(card.id, statePath, {
+        // Reuse the verified snapshot so a second mirror read cannot silently change the selected PR.
+        loadLedger: (id) => id === card.runId ? [...parent] : snapshot.children[id] ? [...snapshot.children[id]!] : null,
+        // The remote mirror is the sole evidence for this prepass. Host logs can contain unrelated child receipts.
+        podFinishes: () => [],
+      });
+      if (result.card?.runId === card.runId && cardPrNumber(result.card) !== undefined
+        && result.card.runChildId && podChildRunIds(parent, card.runId).includes(result.card.runChildId)) bound++;
+      else skipped++;
+    } catch (error) {
+      skipped++;
+      try { debug.log('task-agent', 'remote-rejudge-bind-failed', {
+        card: card.id, runId: card.runId, host: card.parentHost.host, reason: error instanceof Error ? error.message : String(error),
+      }); } catch { /* observation must not stop the other cards */ }
+    }
+  }
+  return { scanned, bound, skipped };
+}

package/src/task-agent/repair-branch-cas.ts

@@ -0,0 +1,182 @@
+/** Apply a Pod repair commit to the already bound PR branch after exact-head checks. */
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+const SHA40 = /^[0-9a-f]{40}$/i;
+const SHA256 = /^[0-9a-f]{64}$/i;
+export const REPAIR_BUNDLE_REF = 'refs/elanous/repair/result';
+
+export interface RepairCommitResult {
+  pr: number;
+  baseHead: string;
+  /** Parent repair run binding; required by the HQ worker before CAS. */
+  runId?: string;
+  commit: string;
+  bundleSha256: string;
+}
+
+export interface RepairCasRequest {
+  repo: string;
+  pr: number;
+  expectedHead: string;
+  bundlePath: string;
+  result: RepairCommitResult;
+  /** A previous push succeeded. Confirmation may inspect the remote and PR, but must never push again. */
+  confirmationOnly?: boolean;
+  branch?: string;
+  /** Persist a single-use push intent after bundle/ancestry checks and before the push side effect. */
+  claimBeforePush?: () => boolean;
+}
+
+export interface RepairCasDeps {
+  git(cwd: string, args: string[]): { status: number | null; stdout: string; stderr: string };
+  prView(cwd: string, pr: number): { state: string; head: string; branch: string; crossRepository: boolean; headRepo: string } | null;
+  originRepo(cwd: string): string | null;
+  sleep?(ms: number): void;
+}
+
+export type RepairCasOutcome = { ok: true; fromHead: string; toHead: string; branch: string }
+  | { ok: false; reason: string; unconfirmed?: true };
+
+const CONFIRM_DELAYS_MS = [0, 150, 350, 700] as const;
+const sleep = (ms: number): void => { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); };
+
+const defaultDeps: RepairCasDeps = {
+  git(cwd, args) {
+    const r = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: 120_000 });
+    return { status: r.status, stdout: String(r.stdout ?? ''), stderr: String(r.stderr ?? '') };
+  },
+  prView(cwd, pr) {
+    const r = spawnSync('gh', ['pr', 'view', String(pr), '--json', 'state,headRefOid,headRefName,isCrossRepository,headRepository'], { cwd, encoding: 'utf8', timeout: 30_000 });
+    if (r.status !== 0) return null;
+    try {
+      const v = JSON.parse(String(r.stdout)) as Record<string, unknown>;
+      const headRepo = v.headRepository && typeof v.headRepository === 'object'
+        ? (v.headRepository as Record<string, unknown>).nameWithOwner : undefined;
+      if (typeof v.state !== 'string' || typeof v.headRefOid !== 'string' || typeof v.headRefName !== 'string' || typeof headRepo !== 'string'
+        || typeof v.isCrossRepository !== 'boolean') return null;
+      return { state: v.state, head: v.headRefOid, branch: v.headRefName, crossRepository: v.isCrossRepository, headRepo };
+    } catch { return null; }
+  },
+  originRepo(cwd) {
+    const r = spawnSync('git', ['remote', 'get-url', 'origin'], { cwd, encoding: 'utf8', timeout: 30_000 });
+    if (r.status !== 0) return null;
+    const url = String(r.stdout).trim();
+    const match = /^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https:\/\/github\.com\/)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/.exec(url);
+    return match?.[1]?.toLowerCase() ?? null;
+  },
+};
+
+/** Bundle verification and fetch use an isolated ref: concurrent FETCH_HEAD writers cannot substitute another commit. */
+export function applyRepairBundle(request: RepairCasRequest, deps: RepairCasDeps = defaultDeps): RepairCasOutcome {
+  const { repo, pr, expectedHead, bundlePath, result } = request;
+  const fail = (reason: string): RepairCasOutcome => ({ ok: false, reason });
+  if (!Number.isSafeInteger(pr) || pr < 1 || result.pr !== pr || !SHA40.test(expectedHead) || !SHA40.test(result.baseHead)
+    || !SHA40.test(result.commit) || !SHA256.test(result.bundleSha256) || result.baseHead.toLowerCase() !== expectedHead.toLowerCase()) {
+    return fail('repair result identity or head mismatch');
+  }
+  if (result.commit.toLowerCase() === expectedHead.toLowerCase()) return fail('repair produced no new commit');
+  const git = (args: string[]) => deps.git(repo, args);
+  const initial = deps.prView(repo, pr);
+  const originRepo = deps.originRepo(repo);
+  const pending = (reason: string): RepairCasOutcome => ({ ok: false, unconfirmed: true, reason });
+  if (request.confirmationOnly) {
+    if (!request.branch || git(['check-ref-format', '--branch', request.branch]).status !== 0) return fail('confirmed repair branch name invalid');
+    if (!originRepo) return pending('repair origin identity unavailable; PR head confirmation pending');
+    if (!initial) return pending('PR head unavailable; confirmation pending');
+    if (initial.state !== 'OPEN' || initial.crossRepository || initial.headRepo.toLowerCase() !== originRepo || initial.branch !== request.branch)
+      return pending('repair PR identity not yet stable; confirmation pending');
+    const remoteRef = `refs/heads/${request.branch}`;
+    const remote = git(['ls-remote', '--exit-code', 'origin', remoteRef]);
+    const [remoteHead, remoteName] = remote.stdout.trim().split('\t');
+    if (remote.status !== 0 || remoteName !== remoteRef || remoteHead?.toLowerCase() !== result.commit.toLowerCase())
+      return pending('repair remote head differs from pushed commit; confirmation pending');
+    if (initial.head.toLowerCase() !== result.commit.toLowerCase()) return pending('repair commit is on the remote branch; PR head confirmation pending');
+    return { ok: true, fromHead: expectedHead, toHead: result.commit, branch: request.branch };
+  }
+  let bytes: Buffer;
+  try { bytes = readFileSync(bundlePath); } catch { return fail('repair bundle unreadable'); }
+  if (createHash('sha256').update(bytes).digest('hex') !== result.bundleSha256.toLowerCase()) return fail('repair bundle sha256 mismatch');
+  if (!initial || !originRepo || initial.headRepo.toLowerCase() !== originRepo) return fail('PR head repository differs from git origin');
+  const alreadyApplied = initial?.head.toLowerCase() === result.commit.toLowerCase();
+  if (!initial || initial.state !== 'OPEN' || initial.crossRepository || (!alreadyApplied && initial.head.toLowerCase() !== expectedHead.toLowerCase()))
+    return fail('PR head CAS mismatch or PR unavailable');
+  if (!initial.branch || git(['check-ref-format', '--branch', initial.branch]).status !== 0) return fail('PR branch name invalid');
+  const initialRemoteRef = `refs/heads/${initial.branch}`;
+  const verifyImportedCommit = (): string | null => {
+    if (git(['cat-file', '-e', `${expectedHead}^{commit}`]).status !== 0 || git(['bundle', 'verify', bundlePath]).status !== 0)
+      return 'repair base or bundle unavailable';
+    const localRef = `refs/elanous/repair/import/${pr}-${expectedHead.slice(0, 12)}-${result.commit.slice(0, 12)}`;
+    if (git(['fetch', bundlePath, `${REPAIR_BUNDLE_REF}:${localRef}`]).status !== 0
+      || git(['rev-parse', localRef]).stdout.trim().toLowerCase() !== result.commit.toLowerCase()
+      || git(['merge-base', '--is-ancestor', expectedHead, result.commit]).status !== 0)
+      return 'repair commit verification failed';
+    return null;
+  };
+  // A successful push can be visible on origin before gh pr view catches up. Never issue a
+  // second leased push for that same commit while the PR API is still reporting the old head.
+  if (!alreadyApplied) {
+    const remote = git(['ls-remote', '--exit-code', 'origin', initialRemoteRef]);
+    const [remoteHead, remoteName] = remote.stdout.trim().split('\t');
+    if (remote.status === 0 && remoteName === initialRemoteRef && remoteHead?.toLowerCase() === result.commit.toLowerCase()) {
+      const invalid = verifyImportedCommit();
+      return invalid ? fail(invalid) : pending('repair commit is on the remote branch; PR head confirmation pending');
+    }
+  }
+  if (alreadyApplied) {
+    // A prior process may have pushed and died before recording the card result. Recheck the artifact
+    // and exact remote ref before returning the same success; never push a second time.
+    const advertised = git(['ls-remote', '--exit-code', 'origin', initialRemoteRef]);
+    const [remoteHead, remoteName] = advertised.stdout.trim().split('\t');
+    if (advertised.status !== 0 || remoteName !== initialRemoteRef || remoteHead?.toLowerCase() !== result.commit.toLowerCase()) return fail('already-applied PR head remote mismatch');
+    const invalid = verifyImportedCommit();
+    if (invalid) return fail(`already-applied ${invalid}`);
+    return { ok: true, fromHead: expectedHead, toHead: result.commit, branch: initial.branch };
+  }
+  // The HQ checkout need not have fetched this PR before. Pin its source commit in an isolated ref;
+  // never use FETCH_HEAD, which another concurrent worker may replace.
+  const baseRef = `refs/elanous/repair/base/${pr}-${expectedHead.slice(0, 12)}`;
+  if (git(['fetch', 'origin', `refs/heads/${initial.branch}:${baseRef}`]).status !== 0
+    || git(['rev-parse', baseRef]).stdout.trim().toLowerCase() !== expectedHead.toLowerCase()) return fail('reviewed PR head fetch mismatch');
+  if (git(['bundle', 'verify', bundlePath]).status !== 0) return fail('repair bundle verification failed');
+  const localRef = `refs/elanous/repair/import/${pr}-${expectedHead.slice(0, 12)}-${result.commit.slice(0, 12)}`;
+  if (git(['fetch', bundlePath, `${REPAIR_BUNDLE_REF}:${localRef}`]).status !== 0) return fail('repair bundle fetch failed');
+  const imported = git(['rev-parse', localRef]).stdout.trim();
+  if (imported.toLowerCase() !== result.commit.toLowerCase()) return fail('repair bundle commit mismatch');
+  if (git(['merge-base', '--is-ancestor', expectedHead, result.commit]).status !== 0) return fail('repair commit is not a descendant of reviewed PR head');
+  if (expectedHead.toLowerCase() === result.commit.toLowerCase()) return fail('repair produced no new commit');
+  const view = deps.prView(repo, pr);
+  if (!view || view.headRepo.toLowerCase() !== originRepo || view.state !== 'OPEN' || view.crossRepository || view.head.toLowerCase() !== expectedHead.toLowerCase()
+    || view.branch !== initial.branch) return fail('PR head CAS mismatch or PR unavailable');
+  if (!view.branch || git(['check-ref-format', '--branch', view.branch]).status !== 0) return fail('PR branch name invalid');
+  const remoteRef = `refs/heads/${view.branch}`;
+  const advertised = git(['ls-remote', '--exit-code', 'origin', remoteRef]);
+  const [remoteHead, remoteName] = advertised.stdout.trim().split('\t');
+  if (advertised.status !== 0 || remoteName !== remoteRef || remoteHead?.toLowerCase() !== expectedHead.toLowerCase()) return fail('remote branch CAS mismatch');
+  if (request.claimBeforePush) {
+    try { if (!request.claimBeforePush()) return fail('repair push intent claim refused'); }
+    catch (error) { return fail(`repair push intent claim failed: ${error instanceof Error ? error.message : String(error)}`); }
+  }
+  // OP 2026-10-13 #1109, RFC §6a D3: the contract is "do not overwrite another commit".
+  // Two conditions enforce it: result.commit descends from expectedHead (checked above), and
+  // the exact-head lease rejects any intervening remote move. No '+' refspec is retained for clarity,
+  // but --force-with-lease can force non-FF even without '+': it is NOT a separate safety condition.
+  const push = git(['push', `--force-with-lease=${remoteRef}:${expectedHead}`, 'origin', `${result.commit}:${remoteRef}`]);
+  if (push.status !== 0) {
+    const reason = `exact-head fast-forward push result uncertain: ${(push.stderr || push.stdout).trim().slice(-200)}`;
+    return request.claimBeforePush ? pending(reason) : fail(`exact-head fast-forward push rejected: ${(push.stderr || push.stdout).trim().slice(-200)}`);
+  }
+  for (const delay of CONFIRM_DELAYS_MS) {
+    if (delay) (deps.sleep ?? sleep)(delay);
+    const after = deps.prView(repo, pr);
+    if (after?.state === 'OPEN' && !after.crossRepository && after.headRepo.toLowerCase() === originRepo
+      && after.head.toLowerCase() === result.commit.toLowerCase() && after.branch === view.branch) {
+      const remote = git(['ls-remote', '--exit-code', 'origin', remoteRef]);
+      const [remoteHead, remoteName] = remote.stdout.trim().split('\t');
+      if (remote.status === 0 && remoteName === remoteRef && remoteHead?.toLowerCase() === result.commit.toLowerCase())
+        return { ok: true, fromHead: expectedHead, toHead: result.commit, branch: view.branch };
+    }
+  }
+  return { ok: false, unconfirmed: true, reason: 'push succeeded; PR head confirmation pending' };
+}

package/src/task-agent/repair-cycle.ts

@@ -0,0 +1,275 @@
+/** HQ same-PR repair launch and result collection; the reviewed head is the sole source of truth. */
+import { spawn } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+import { mintRunId } from '../harness/harness-space.js';
+import { spawnElanousSync } from '../instance/spawn-elanous.js';
+import { passJourneyNode } from '../self-dev/graph-journey-nodes.js';
+import { recordJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { checklistHistory, listChecklist, parseOwner } from '../release-loop/checklist.js';
+import { applyRepairBundle, type RepairCasOutcome, type RepairCasRequest } from './repair-branch-cas.js';
+import { repairNextMove } from './repair-next-move.js';
+import { parseRepairWorkerResult } from './repair-worker.js';
+import { TASK_SEATS, readTaskCard, updateTaskCard, type TaskCard, type TaskChildLlm, type TaskSeat } from './task-hand.js';
+
+const WAIT_MS = 90 * 60_000;
+const safe = (value: string) => value.replace(/[^A-Za-z0-9._-]/g, '_');
+
+export interface RepairLaunchRequest {
+  card: string; pr: number; head: string; repo: string; resultPath: string;
+  goalFile: string; runId: string; model: TaskChildLlm; seat?: string;
+}
+
+export interface RepairCycleInput {
+  card: TaskCard; statePath: string; repo: string; pr: number; head: string; branch: string;
+  mustFix: readonly string[]; liveMoves: ReadonlySet<string>; now: Date;
+  readFile?: (path: string) => string;
+  request?: (input: RepairLaunchRequest) => Promise<void>;
+  apply?: (input: RepairCasRequest) => RepairCasOutcome;
+  notify?: (seat: string, body: string) => void;
+  observeLaunch?: (move: string, runId: string) => void;
+  resolveOwner?: (card: TaskCard) => RepairOwner;
+}
+
+export type RepairCycleOutcome = { decision: 'would-repair' | 'repair-requested' | 'repair-pending' | 'repair-applied' | 'repair-failed' | 'repair-stopped'; reason: string };
+export type RepairOwner = { seat?: TaskSeat; source: string; reason?: string };
+
+/** A missing card seat may use only a uniquely identified checklist cell's valid seat. */
+export function resolveRepairOwner(card: TaskCard, deps: {
+  history?: (id: string) => readonly { version: string }[];
+  checklist?: (version: string) => { items: readonly { id: string; owner?: string }[] };
+} = {}): RepairOwner {
+  if (card.seat) return { seat: card.seat, source: 'card' };
+  if (!card.checklistId) return { source: 'none', reason: 'checklist id missing' };
+  const history = deps.history ?? checklistHistory;
+  const checklist = deps.checklist ?? listChecklist;
+  let versions: string[];
+  try {
+    versions = card.checklistVersion ? [card.checklistVersion]
+      : [...new Set(history(card.checklistId).map((entry) => entry.version))];
+  } catch (error) { return { source: 'none', reason: `checklist history unavailable: ${String(error).slice(0, 160)}` }; }
+  if (!versions.length) return { source: 'none', reason: 'checklist version unavailable' };
+  let cells: Array<{ version: string; owner?: string }>;
+  try {
+    cells = versions.flatMap((version) => checklist(version).items
+      .filter((row) => row.id === card.checklistId)
+      .map((item) => ({ version, owner: item.owner })));
+  } catch (error) { return { source: 'none', reason: `checklist lookup unavailable: ${String(error).slice(0, 160)}` }; }
+  if (cells.length !== 1) return { source: 'none', reason: cells.length ? `checklist cell ambiguous: ${cells.length} matches` : 'checklist cell absent' };
+  const cell = cells[0]!;
+  if (!cell.owner) return { source: 'none', reason: `checklist owner missing: ${cell.version}/${card.checklistId}` };
+  try {
+    const seat = parseOwner(cell.owner).seat;
+    if (!(TASK_SEATS as readonly string[]).includes(seat)) return { source: 'none', reason: `checklist owner seat unknown: ${cell.version}/${card.checklistId}` };
+    return { seat: seat as TaskSeat, source: `checklist ${cell.version}/${card.checklistId}` };
+  } catch { return { source: 'none', reason: `checklist owner invalid: ${cell.version}/${card.checklistId}` }; }
+}
+
+export function alternateRepairModel(card: TaskCard): { from: string; to: TaskChildLlm } {
+  const last = card.repairs?.at(-1);
+  const from = last?.toModel ?? (card.childLlm ? `${card.childLlm.provider}/${card.childLlm.model}` : 'unknown');
+  const to = from.includes('openrouter/') || from.includes('glm')
+    ? { provider: 'openai-codex', model: 'gpt-6-sol' }
+    : { provider: 'openrouter', model: 'openrouter/z-ai/glm-5.3' };
+  return { from, to };
+}
+
+export function repairResultPath(statePath: string, card: string, pr: number, head: string, number: number, runId: string): string {
+  return join(dirname(statePath), 'repair-results', `${safe(card)}-${pr}-${safe(head.slice(0, 12))}-${number}-${safe(runId)}.json`);
+}
+
+/** Spawn the same installed CLI in the same config universe; its hidden worker writes an atomic result file. */
+export async function defaultRequestRepair(input: RepairLaunchRequest): Promise<void> {
+  const { spawnDetachedConfirmed, ELANOUS_CLI_ENTRY } = await import('../cli/tasks-cli.js');
+  const { getElanousConfigDirOverride } = await import('../elanous-config-dir.js');
+  const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+  const configDir = getElanousConfigDirOverride() ?? effectiveInstanceRoot();
+  const args = [ELANOUS_CLI_ENTRY, '--config-dir', configDir, 'tasks', 'repair-run',
+    '--card', input.card, '--pr', String(input.pr), '--head', input.head, '--repo', input.repo,
+    '--out', input.resultPath, '--goal-file', input.goalFile, '--run-id', input.runId,
+    '--model-provider', input.model.provider, '--model-id', input.model.model,
+    ...(input.seat ? ['--seat', input.seat] : [])];
+  await spawnDetachedConfirmed(spawn as never, process.execPath, args, undefined, input.repo);
+}
+
+function defaultNotify(seat: string, body: string): void {
+  const result = spawnElanousSync(['msg', 'post', '--from', 'TA', '--to', seat, '--kind', 'incident', '--body', body],
+    { encoding: 'utf8', timeout: 15_000 });
+  if (result.status !== 0) throw new Error(`owner message failed: ${String(result.stderr || result.stdout).slice(-200)}`);
+}
+
+export async function runRepairCycle(input: RepairCycleInput): Promise<RepairCycleOutcome> {
+  const { card, statePath, pr, head, branch, repo, now } = input;
+  const read = input.readFile ?? ((path: string) => readFileSync(path, 'utf8'));
+  const boundPr = card.repairs?.[0]?.pr ?? (typeof card.pr === 'number' ? card.pr : card.pr?.number);
+  if (boundPr !== undefined && boundPr !== pr) {
+    const reason = `repair source PR changed: card ${card.id} bound to #${boundPr}, received #${pr}; launch refused`;
+    updateTaskCard(statePath, card.id, (current) => current && current.status === 'launched'
+      ? { ...current, status: 'failed', history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-source-pr-changed', pr, head, detail: reason }] } : undefined);
+    return { decision: 'repair-stopped', reason };
+  }
+  const attempts = card.repairs ?? [];
+  const latest = attempts.at(-1);
+  if (latest?.status === 'unconfirmed') {
+    if (!latest.commit || !latest.bundleSha256 || !latest.bundlePath)
+      return { decision: 'repair-pending', reason: `repair run ${latest.runId} confirmation evidence missing; no repush` };
+    const applied = (input.apply ?? applyRepairBundle)({ repo, pr, expectedHead: latest.head,
+      bundlePath: latest.bundlePath, result: { pr, baseHead: latest.head, runId: latest.runId,
+        commit: latest.commit, bundleSha256: latest.bundleSha256 }, confirmationOnly: true, branch: latest.branch });
+    if (!applied.ok && applied.unconfirmed) return { decision: 'repair-pending', reason: applied.reason };
+    const status = applied.ok ? 'applied' : 'failed';
+    try {
+      updateTaskCard(statePath, card.id, (current) => current?.repairs?.some((entry) => entry.runId === latest.runId && entry.status === 'unconfirmed' && entry.commit === latest.commit)
+        ? { ...current, repairs: current.repairs.map((entry) => entry.runId === latest.runId
+          ? { ...entry, status, detail: applied.ok ? `same PR #${pr} fast-forward ${latest.head.slice(0, 12)} → ${applied.toHead.slice(0, 12)}` : applied.reason } : entry),
+          history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-result', pr, head: latest.head,
+            runId: latest.runId, effect: status, detail: applied.ok ? applied.toHead : applied.reason }] } : undefined);
+    } catch (error) { return { decision: 'repair-pending', reason: `repair confirmation card write failed: ${String(error).slice(-200)}` }; }
+    const recorded = readTaskCard(card.id, statePath)?.repairs?.find((entry) => entry.runId === latest.runId)?.status === status;
+    return recorded ? { decision: applied.ok ? 'repair-applied' : 'repair-failed', reason: applied.ok ? `same PR #${pr} fast-forward ${latest.head.slice(0, 12)} → ${applied.toHead.slice(0, 12)}` : applied.reason }
+      : { decision: 'repair-pending', reason: 'repair confirmation card changed concurrently' };
+  }
+  if (latest?.status === 'requested') {
+    let text: string | null = null;
+    try { text = read(latest.resultPath); } catch { /* worker still running */ }
+    const result = text === null ? null : parseRepairWorkerResult(text, pr, latest.head, latest.runId);
+    if (!result && now.getTime() - Date.parse(latest.at) < WAIT_MS)
+      return { decision: 'repair-pending', reason: `repair run ${latest.runId} pending` };
+    let detail = result?.reason ?? 'repair worker produced no valid result before timeout';
+    let applied: RepairCasOutcome | null = null;
+    let claimedThisCycle = false;
+    if (result?.ok && result.artifactDir && result.result) {
+      const expectedRoot = resolve(dirname(statePath), 'pod-artifacts');
+      const artifactDir = resolve(result.artifactDir);
+      const inside = artifactDir === join(expectedRoot, result.job ?? '', 'repair') && artifactDir.startsWith(`${expectedRoot}${sep}`);
+      let artifact: unknown = null;
+      if (inside) try { artifact = JSON.parse(read(join(artifactDir, 'result.json'))); } catch { /* unreadable */ }
+      const a = artifact && typeof artifact === 'object' && !Array.isArray(artifact) ? artifact as Record<string, unknown> : null;
+      if (!inside) detail = 'repair artifact outside the HQ instance root';
+      else if (!a || a.runId !== latest.runId || a.runId !== result.result.runId || a.pr !== result.result.pr || a.baseHead !== result.result.baseHead
+        || a.commit !== result.result.commit || a.bundleSha256 !== result.result.bundleSha256) detail = 'repair result artifact differs from stdout marker';
+      else {
+        const bundlePath = join(artifactDir, 'commit.bundle');
+        let pushClaimed = false;
+        applied = (input.apply ?? applyRepairBundle)({ repo, pr, expectedHead: latest.head,
+          bundlePath, result: result.result,
+          claimBeforePush: () => {
+            let claimed = false;
+            updateTaskCard(statePath, card.id, (current) => current?.repairs?.some((entry) => entry.runId === latest.runId && entry.status === 'requested')
+              ? (claimed = true, { ...current, repairs: current.repairs.map((entry) => entry.runId === latest.runId
+                ? { ...entry, status: 'unconfirmed' as const, commit: result.result!.commit,
+                  bundleSha256: result.result!.bundleSha256, bundlePath, detail: 'verified repair push intent recorded' } : entry) }) : undefined);
+            pushClaimed = claimed;
+            return claimed;
+          } });
+        detail = applied.ok ? `same PR #${pr} fast-forward ${latest.head.slice(0, 12)} → ${applied.toHead.slice(0, 12)}` : applied.reason;
+        if (!applied.ok && applied.reason.startsWith('repair push intent claim'))
+          return { decision: 'repair-pending', reason: detail };
+        if (!pushClaimed && readTaskCard(card.id, statePath)?.repairs?.some((entry) => entry.runId === latest.runId && entry.status === 'unconfirmed'))
+          return { decision: 'repair-pending', reason: `repair run ${latest.runId} already has another collector's push intent` };
+        claimedThisCycle = pushClaimed;
+      }
+    }
+    const status = applied?.ok ? 'applied' : applied?.unconfirmed ? 'unconfirmed' : 'failed';
+    try {
+      updateTaskCard(statePath, card.id, (current) => current?.repairs?.some((entry) => entry.runId === latest.runId
+        && (entry.status === 'requested' || (claimedThisCycle && entry.status === 'unconfirmed' && entry.commit === result?.result?.commit)))
+        ? { ...current, repairs: current.repairs.map((entry) => entry.runId === latest.runId
+          ? { ...entry, status, detail, ...(result?.result && status === 'unconfirmed' ? { commit: result.result.commit,
+            bundleSha256: result.result.bundleSha256, bundlePath: join(resolve(result.artifactDir!), 'commit.bundle') } : {}),
+            ...(applied?.ok ? { commit: applied.toHead } : {}) } : entry),
+          history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-result', pr, head: latest.head,
+            runId: latest.runId, effect: status, detail }] } : undefined);
+    } catch (error) { return { decision: 'repair-pending', reason: `repair card write failed after CAS: ${String(error).slice(-200)}` }; }
+    const recorded = readTaskCard(card.id, statePath)?.repairs?.find((entry) => entry.runId === latest.runId)?.status === status;
+    return recorded ? { decision: applied?.ok ? 'repair-applied' : applied?.unconfirmed ? 'repair-pending' : 'repair-failed', reason: detail }
+      : { decision: 'repair-pending', reason: 'repair result card changed concurrently' };
+  }
+  if (latest?.status === 'applied' && latest.head.toLowerCase() === head.toLowerCase())
+    return { decision: 'repair-pending', reason: `repair pushed; await PR head ${latest.commit?.slice(0, 12) ?? '?'}` };
+  const judged = repairNextMove({ pr, head, branch, mustFix: input.mustFix,
+    priorNarrowAttempts: attempts.filter((entry) => entry.move === 'narrow-relaunch' || entry.move === 'salvage-relaunch').length,
+    priorAlternativeAttempts: attempts.filter((entry) => entry.move === 'alternative').length });
+  if (judged.kind === 'stop') {
+    if (attempts.length >= 2) {
+      const detail = `수리 수렴 실패: PR #${pr} head ${head.slice(0, 12)} · ${attempts.length}회 재발사 · ${judged.reason}`;
+      updateTaskCard(statePath, card.id, (current) => {
+        if (!current || current.status !== 'launched' || (current.repairs ?? []).filter((entry) => entry.pr === pr).length < 2) return undefined;
+        return { ...current, status: 'failed', history: [...(current.history ?? []),
+          { at: now.toISOString(), event: 'repair-convergence-failed', pr, head, detail }] };
+      });
+      const current = readTaskCard(card.id, statePath);
+      const exhausted = current?.history?.some((entry) => entry.event === 'repair-convergence-failed' && entry.pr === pr);
+      const notified = current?.history?.some((entry) => entry.event === 'repair-owner-notified' && entry.pr === pr);
+      if (exhausted && !notified && current) {
+        const owner = (input.resolveOwner ?? resolveRepairOwner)(current);
+        if (!owner.seat) {
+          const reason = `repair exhaustion owner unresolved: ${owner.reason ?? 'owner unresolved'}; notification refused`;
+          updateTaskCard(statePath, card.id, (latestCard) => latestCard && !latestCard.history?.some((entry) => entry.event === 'repair-owner-missing' && entry.pr === pr)
+            ? { ...latestCard, history: [...(latestCard.history ?? []), { at: now.toISOString(), event: 'repair-owner-missing', pr, head, detail: reason }] } : undefined);
+          return { decision: 'repair-stopped', reason };
+        }
+        try {
+          (input.notify ?? defaultNotify)(owner.seat, `${detail} · card ${card.id} · owner ${owner.seat} via ${owner.source}`);
+          updateTaskCard(statePath, card.id, (latestCard) => latestCard && !latestCard.history?.some((entry) => entry.event === 'repair-owner-notified' && entry.pr === pr)
+            ? { ...latestCard, history: [...(latestCard.history ?? []), { at: now.toISOString(), event: 'repair-owner-notified', pr, head, detail }] } : undefined);
+        } catch (error) {
+          const reason = error instanceof Error ? error.message : String(error);
+          updateTaskCard(statePath, card.id, (latestCard) => latestCard
+            ? { ...latestCard, history: [...(latestCard.history ?? []), { at: now.toISOString(), event: 'repair-owner-notify-failed', pr, head, detail: reason }] } : undefined);
+        }
+      }
+    }
+    return { decision: 'repair-stopped', reason: judged.reason };
+  }
+  if (!input.liveMoves.has(judged.judgement.move)) return { decision: 'would-repair', reason: `${judged.judgement.move} via graph next-move → dispatch (shadow)` };
+  const owner = (input.resolveOwner ?? resolveRepairOwner)(card);
+  if (!owner.seat) {
+    const reason = `repair owner seat missing: card ${card.id}; ${owner.reason ?? 'owner unresolved'}; launch refused`;
+    updateTaskCard(statePath, card.id, (current) => current && current.status === 'launched'
+      ? { ...current, status: 'failed', history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-owner-missing', pr, head, detail: reason }] } : undefined);
+    return { decision: 'repair-stopped', reason };
+  }
+  const next = attempts.length + 1;
+  const runId = mintRunId();
+  const { from, to } = alternateRepairModel(card);
+  const resultPath = repairResultPath(statePath, card.id, pr, head, next, runId);
+  const goalFile = resultPath.replace(/\.json$/, '.goal.txt');
+  const goal = `기존 PR #${pr}의 리뷰 때 head ${head}를 같은 가지에서 수리한다. 새 PR을 열지 말고 아래 must-fix 원문만 고쳐 commit-only 결과를 반환한다.\n\n${input.mustFix.map((item, i) => `${i + 1}. ${item}`).join('\n')}`;
+  mkdirSync(dirname(goalFile), { recursive: true });
+  writeFileSync(goalFile, goal);
+  let claimed = false;
+  updateTaskCard(statePath, card.id, (current) => {
+    if (!current || current.status !== 'launched' || (current.repairs ?? []).length !== (card.repairs ?? []).length) return undefined;
+    claimed = true;
+    return { ...current, repairs: [...(current.repairs ?? []), { pr, head, branch, at: now.toISOString(),
+      move: judged.judgement.move, runId, resultPath, fromModel: from, toModel: `${to.provider}/${to.model}`, status: 'requested' }],
+      history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-launched', pr, head, runId,
+        effect: judged.judgement.move, detail: `source pr:${pr} · owner ${owner.seat} via ${owner.source} · must-fix ${input.mustFix.length} · childLlm ${from} → ${to.provider}/${to.model}` }] };
+  });
+  if (!claimed) return { decision: 'repair-pending', reason: 'another tick claimed repair launch' };
+  try {
+    await (input.request ?? defaultRequestRepair)({ card: card.id, pr, head, repo, resultPath, goalFile,
+      runId, model: to, seat: owner.seat });
+  } catch (error) {
+    const reason = `repair launch failed: ${error instanceof Error ? error.message : String(error)}`;
+    updateTaskCard(statePath, card.id, (current) => current?.repairs?.some((entry) => entry.runId === runId && entry.status === 'requested')
+      ? { ...current, repairs: current.repairs.map((entry) => entry.runId === runId ? { ...entry, status: 'failed' as const, detail: reason } : entry) } : undefined);
+    return { decision: 'repair-failed', reason };
+  }
+  try {
+    if (input.observeLaunch) input.observeLaunch(judged.judgement.move, runId);
+    else {
+      passJourneyNode('next-move', { provenance: 'task-agent-repair', outcome: judged.judgement.move, runId,
+        data: { card: card.id, source: `pr:${pr}`, pr, head, branch, mustFix: input.mustFix } });
+      recordJourneyEdge(judged.route, 'dispatch');
+    }
+  } catch (error) {
+    const detail = `repair observation failed after worker launch: ${error instanceof Error ? error.message : String(error)}`;
+    try { updateTaskCard(statePath, card.id, (current) => current
+      ? { ...current, history: [...(current.history ?? []), { at: now.toISOString(), event: 'repair-observation-failed', pr, head, runId, detail }] } : undefined); }
+    catch { /* launch remains requested even if its diagnostic cannot be persisted */ }
+    return { decision: 'repair-requested', reason: `${judged.judgement.move} → dispatch · run ${runId} · ${detail}` };
+  }
+  return { decision: 'repair-requested', reason: `${judged.judgement.move} → dispatch · run ${runId} · ${from} → ${to.provider}/${to.model}` };
+}

package/src/task-agent/repair-next-move.ts

@@ -0,0 +1,31 @@
+/** Existing TA retry judgement, routed through the declared recover → dispatch graph edge. */
+import { judgeNextMove, type TaskJudgement } from './judge.js';
+import { readJourneyEdge, type JourneyRoute } from '../self-dev/graph-journey-route.js';
+
+export interface RepairNextMoveInput {
+  pr: number;
+  head: string;
+  branch: string;
+  mustFix: readonly string[];
+  priorNarrowAttempts: number;
+  priorAlternativeAttempts: number;
+}
+
+export type RepairNextMove = { kind: 'dispatch'; judgement: TaskJudgement; route: JourneyRoute; source: `pr:${number}` }
+  | { kind: 'stop'; judgement: TaskJudgement; route: JourneyRoute; reason: string };
+
+export function repairNextMove(input: RepairNextMoveInput): RepairNextMove {
+  const judged = judgeNextMove({ stopReason: 'needs-human', pr: input.pr, prState: 'OPEN', review: 'fail', mustFix: input.mustFix,
+    failures: { 'narrow-relaunch': input.priorNarrowAttempts, alternative: input.priorAlternativeAttempts } });
+  const route = readJourneyEdge('next-move', judged.move, { move: judged.move, source: `pr:${input.pr}`, head: input.head, branch: input.branch });
+  if (!input.mustFix.length) return { kind: 'stop', judgement: judged, route, reason: 'review must-fix text unavailable' };
+  // RFC §6a D4 is a tighter cap for same-PR repair than the general retry vocabulary.
+  if (input.priorNarrowAttempts + input.priorAlternativeAttempts >= 2) {
+    return { kind: 'stop', judgement: judged, route, reason: 'repair convergence failed after two relaunches' };
+  }
+  if (route.source !== 'graph' || route.to !== 'dispatch') return { kind: 'stop', judgement: judged, route, reason: `graph next-move ${judged.move} routes to ${route.to ?? 'none'}` };
+  if (judged.move !== 'narrow-relaunch' && judged.move !== 'salvage-relaunch' && judged.move !== 'alternative') {
+    return { kind: 'stop', judgement: judged, route, reason: `next move ${judged.move} is not a repair launch` };
+  }
+  return { kind: 'dispatch', judgement: judged, route, source: `pr:${input.pr}` };
+}

package/src/task-agent/repair-review.ts

@@ -0,0 +1,24 @@
+/** Recover the exact must-fix text from the captured self-review stdout. */
+import { isNoneSentinelFinding } from '../agent-substrate/pr-reviewer.js';
+import { createHash } from 'node:crypto';
+
+const SHA40 = /^[0-9a-f]{40}$/i;
+export const repairReviewDigest = (text: string): string => createHash('sha256').update(text).digest('hex');
+
+export function repairMustFixFromReview(text: string, pr: number, head: string): string[] | null {
+  if (!Number.isSafeInteger(pr) || pr < 1 || !SHA40.test(head)) return null;
+  for (const line of text.split(/\r?\n/).reverse()) {
+    if (!line.trimStart().startsWith('{')) continue;
+    let value: unknown;
+    try { value = JSON.parse(line); } catch { continue; }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const v = value as Record<string, unknown>;
+    const foundPr = typeof v.pr === 'number' ? v.pr : typeof v.pr === 'string' ? Number(v.pr.replace(/^#/, '')) : NaN;
+    if (foundPr !== pr || typeof v.headCommit !== 'string' || v.headCommit.toLowerCase() !== head.toLowerCase()
+      || v.reviewed !== true || (v.verdict !== 'fail' && v.verdict !== 'pass' && v.verdict !== 'warn')
+      || typeof v.error === 'string' || !Array.isArray(v.mustFix)
+      || !v.mustFix.every((item) => typeof item === 'string')) return null;
+    return v.mustFix.filter((item): item is string => typeof item === 'string' && !isNoneSentinelFinding(item) && !!item.trim());
+  }
+  return null;
+}