elanous 0.2.28 → 0.2.31

package/src/task-orchestrator/surfaces/pod-mirror-seed.ts

@@ -0,0 +1,103 @@
+// GATE-WARM-BOOT (10-15) — put the cut commit into each pool host's git mirror before the shard Pods start.
+//
+// S: 0.2.29 gate Pods spent 750–840 s before the shard shell; the tests took 0–69 s. Every Pod clones from the host
+//    mirror (`pod.hostMirror` → `/host-mirror`, podSourceScript), but the cut commit e1783835 was not in the node-b mirror
+//    (the mirror's own fetch loop follows `main`; only the `--remote` host executor pushed `refs/elanous/gate/<sha>`).
+//    So all 68 Pods fell to `git fetch --depth 1 origin <sha>` from GitHub, under load, one by one.
+// A: push `<sha>:refs/elanous/gate/<sha>` to the placed pool member's mirror once per (host, commit) per process — podSourceScript's commit branch
+//    then passes `git cat-file -e` and skips the GitHub fetch. Best effort: a failed push is recorded and the Pod keeps
+//    its old path (fetch from GitHub) — never a silent use of another tree.
+import { spawn } from 'node:child_process';
+import { debug } from '../../debug/log.js';
+
+/** Host-side mirror path (relative to the ssh user's home) — the k3d node binds `~/mirror` at `/mirror-host`. */
+export const GATE_POOL_MIRROR_PATH = 'mirror/elanous-agent.git';
+export const GATE_MIRROR_SEED_LIMIT_MS = 120_000;
+
+export interface MirrorSeedResult { host: string; ok: boolean; ms: number; detail?: string }
+
+type Push = (args: string[], cwd: string, limitMs: number) => Promise<{ rc: number; output: string }>;
+
+export async function seedPoolMirrors(o: { hosts: readonly (string | undefined)[]; commit: string; tree: string; push: Push; mirrorPath?: string; limitMs?: number }): Promise<MirrorSeedResult[]> {
+  if (!/^[0-9a-f]{40}$/.test(o.commit)) throw new Error('invalid gate commit');
+  const mirror = o.mirrorPath ?? GATE_POOL_MIRROR_PATH;
+  const hosts = [...new Set(o.hosts.filter((host): host is string => !!host && /^[\w.@-]+$/.test(host) && !host.startsWith('-')))];
+  const results = await Promise.all(hosts.map(async (host): Promise<MirrorSeedResult> => {
+    const start = Date.now();
+    try {
+      const run = await o.push(['push', '--quiet', '--no-verify', `${host}:${mirror}`, `${o.commit}:refs/elanous/gate/${o.commit}`], o.tree, o.limitMs ?? GATE_MIRROR_SEED_LIMIT_MS);
+      const ms = Date.now() - start;
+      return run.rc === 0 ? { host, ok: true, ms } : { host, ok: false, ms, detail: run.output.trim().slice(-300) };
+    } catch (error) {
+      return { host, ok: false, ms: Date.now() - start, detail: String(error).slice(0, 300) };
+    }
+  }));
+  for (const result of results) {
+    debug.log('release-loop.gate', result.ok ? 'pod-mirror-seeded' : 'pod-mirror-seed-failed', { ...result, commit: o.commit }, result.ok ? undefined : { level: 'warn' });
+  }
+  return results;
+}
+
+const seeded = new Map<string, Promise<MirrorSeedResult | undefined>>();
+
+/** Bounded `git <args>` in `cwd` — killed after `limitMs`; never throws. */
+export function gitWithin(args: string[], cwd: string, limitMs: number): Promise<{ rc: number; output: string }> {
+  return new Promise((resolve) => {
+    let output = '';
+    let child;
+    try { child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] }); }
+    catch (error) { resolve({ rc: 2, output: String(error) }); return; }
+    const timer = setTimeout(() => { output += `\n[mirror-seed] timed out after ${limitMs} ms`; child.kill('SIGKILL'); }, limitMs);
+    child.stdout?.on('data', (chunk) => { output += String(chunk); });
+    child.stderr?.on('data', (chunk) => { output += String(chunk); });
+    child.on('error', (error) => { clearTimeout(timer); resolve({ rc: 2, output: `${output}\n${String(error)}` }); });
+    child.on('close', (code) => { clearTimeout(timer); resolve({ rc: code ?? 2, output }); });
+  });
+}
+
+/**
+ * Seed once per (host, commit) in this process: every shard Job placed on the same member awaits the same push, so a
+ * 28-shard gate pushes once per host. `cwd` must be a git tree that has the commit (the gate runs in the repo tree).
+ */
+export function seedMirrorOnce(o: { host: string; commit: string; cwd: string; push?: Push }): Promise<MirrorSeedResult | undefined> {
+  const key = `${o.host}\0${o.commit}`;
+  let pending = seeded.get(key);
+  if (!pending) {
+    // A failed seed is not memoized — the next Job on that host tries again (a transient ssh drop must not send the whole gate to GitHub).
+    pending = seedPoolMirrors({ hosts: [o.host], commit: o.commit, tree: o.cwd, push: o.push ?? gitWithin })
+      .then((results) => { if (!results[0]?.ok) seeded.delete(key); return results[0]; },
+        (error: unknown) => { seeded.delete(key); return { host: o.host, ok: false, ms: 0, detail: String(error).slice(0, 300) }; });
+    seeded.set(key, pending);
+  }
+  return pending;
+}
+
+/**
+ * SI-SEED-DEFAULT — a default-source si-task Job (main HEAD, or `--base <branch>`) has no pinned sha, so the host resolves
+ * the branch tip once (`git ls-remote`, bounded) and makes sure the seeding tree has that commit (a bounded fetch of that
+ * one sha when it does not — objects only, no ref is moved). Never throws: a miss returns `reason` and the caller skips
+ * the seed (best effort — the Job keeps its GitHub path).
+ */
+export async function resolveDefaultSourceHead(o: { repoUrl: string; base?: string; cwd: string; git?: Push; limitMs?: number }): Promise<{ sha?: string; reason?: string }> {
+  const git = o.git ?? gitWithin;
+  const limitMs = o.limitMs ?? 30_000;
+  const base = o.base || 'main';
+  if (base.startsWith('-') || !/^[\w./-]+$/.test(base) || o.repoUrl.startsWith('-')) return { reason: 'invalid-ref' };
+  try {
+    const listed = await git(['ls-remote', '--', o.repoUrl, `refs/heads/${base}`], o.cwd, limitMs);
+    if (listed.rc !== 0) return { reason: 'ls-remote-failed' };
+    // Only the exact ref asked for — never the first `refs/heads/*` line (a branch named `a/refs/heads/main` must not pass).
+    const want = `refs/heads/${base}`;
+    const sha = listed.output.split(/\r?\n/).map((line) => line.split('\t')).find(([hash, ref]) => ref === want && /^[0-9a-f]{40}$/.test(hash ?? ''))?.[0];
+    if (!sha) return { reason: 'ls-remote-no-sha' };
+    if ((await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0) return { sha };
+    const fetched = await git(['fetch', '--quiet', '--no-write-fetch-head', '--', o.repoUrl, sha], o.cwd, GATE_MIRROR_SEED_LIMIT_MS);
+    if (fetched.rc !== 0) return { reason: 'commit-fetch-failed' };
+    return (await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0 ? { sha } : { reason: 'commit-not-local' };
+  } catch {
+    return { reason: 'resolve-threw' };
+  }
+}
+
+/** Test seam — forget the per-process seed memo. */
+export function resetMirrorSeedMemo(): void { seeded.clear(); }

package/src/task-orchestrator/surfaces/pod-result-marker-wait.ts

@@ -0,0 +1,33 @@
+// TA-POD-WARMBOOT-PARITY (10-15) — the Pod result marker (GATE-POD-RESULT-MARKER · #27815) for Jobs that do not go
+// through runPodCommand (the si-task Job in self-implement-pod.ts).
+//
+// S: runPodCommand prints `\n<marker> <launch> rc=<n>\n` as the child's last line and ends its wait on it when the Job
+//    condition lags (k3d). The si-task Job builds its own manifest and waits only on the condition.
+// A: reuse the marker format and split from pod-command-job.ts (no second format), and keep the one-poll judgement
+//    («no condition yet → read the tail → this launch's marker? → rc») as a pure function here.
+// ⚠️ pod-command-job.ts imports self-implement-pod.ts statically, so self-implement-pod.ts loads this module with a
+//    dynamic import only (a static import back would hit the TDZ of the cycle).
+// Later (after T1): runPodCommand's own loop can call podResultMarkerRc too.
+import { podResultMarker, splitPodResultMarker } from './pod-command-job.js';
+
+
+/** The child's final shell line: prints this launch's marker with the child rc (same bytes runPodCommand's child prints).
+ *  null when the token is not a plain id (`[A-Za-z0-9_.:-]+`) — the Job then runs without a marker (condition path only). */
+export function podResultMarkerShellLine(token: string): string | null {
+  if (!/^[\w.:-]+$/.test(token)) return null;
+  return `printf '\\n%s rc=%s\\n' '${podResultMarker(token)}' "$rc"`;
+}
+
+/**
+ * One poll, condition not there yet: the `kubectl logs … --tail=2` result → this launch's rc, or null.
+ * A failed read (Pod pending · init container), another launch's marker, or a bare marker word is null (keep waiting).
+ */
+export function podResultMarkerRc(tail: { status: number | null; stdout: string }, token: string): number | null {
+  if (tail.status !== 0) return null;
+  return splitPodResultMarker(tail.stdout.startsWith('\n') ? tail.stdout : `\n${tail.stdout}`, token).rc;
+}
+
+/** Remove this launch's marker tail from the child logs before they are parsed (other bytes unchanged). */
+export function stripPodResultMarker(logs: string, token: string): string {
+  return splitPodResultMarker(logs, token).logs;
+}

package/src/task-orchestrator/surfaces/pod-reuse-cleanup.ts

@@ -0,0 +1,63 @@
+/** Files and caches that survive between requests on a reusable Pod worker. */
+export const POD_REUSE_CLEAN_EXCLUSIONS = [
+  { name: 'node_modules', pattern: 'node_modules' },
+  { name: 'apps/pwa/node_modules', pattern: 'apps/pwa/node_modules' },
+  // Bun's install cache and remote gate cache live outside the worker checkout.
+  { name: 'bun install cache', pattern: null },
+  { name: 'TypeScript build info', pattern: '*.tsbuildinfo' },
+  { name: 'remote gate TypeScript cache', pattern: null },
+] as const;
+
+export type PodReuseCleanupOutcome = 'reuse' | 'discard';
+
+export interface PodReuseCleanupDecisionInput {
+  base: string;
+  resetExitCode: number | null;
+  cleanExitCode: number | null;
+  statusExitCode: number | null;
+  statusPorcelain: string;
+  remainingPaths?: readonly string[];
+}
+
+export interface PodReuseCleanupDecision {
+  resetArgs: readonly string[];
+  cleanArgs: readonly string[];
+  statusArgs: readonly string[];
+  preserved: readonly string[];
+  outcome: PodReuseCleanupOutcome;
+  reason?: 'invalid-base' | 'reset-failed' | 'clean-failed' | 'status-failed' | 'worktree-not-clean';
+  remainingPaths: readonly string[];
+}
+
+/**
+ * Pure request-boundary decision: return argv for the caller to execute and
+ * decide whether the worker can be reused from the command results.
+ * Execution/wiring and lifecycle event emission intentionally live in a later slice.
+ */
+export function decidePodReuseCleanup(input: PodReuseCleanupDecisionInput): PodReuseCleanupDecision {
+  const remainingPaths = (input.remainingPaths ?? []).slice(0, 5);
+  const resetArgs = ['reset', '--hard', input.base] as const;
+  const cleanArgs = [
+    'clean', '-ffdx',
+    ...POD_REUSE_CLEAN_EXCLUSIONS.flatMap(({ pattern }) => pattern ? ['-e', pattern] : []),
+  ] as const;
+  const statusArgs = ['status', '--porcelain'] as const;
+  const preserved = POD_REUSE_CLEAN_EXCLUSIONS.map(({ name }) => name);
+
+  let reason: PodReuseCleanupDecision['reason'];
+  if (!/^[0-9a-f]{40}$/i.test(input.base)) reason = 'invalid-base';
+  else if (input.resetExitCode !== 0) reason = 'reset-failed';
+  else if (input.cleanExitCode !== 0) reason = 'clean-failed';
+  else if (input.statusExitCode !== 0) reason = 'status-failed';
+  else if (input.statusPorcelain.trim() !== '') reason = 'worktree-not-clean';
+
+  return {
+    resetArgs,
+    cleanArgs,
+    statusArgs,
+    preserved,
+    outcome: reason ? 'discard' : 'reuse',
+    ...(reason ? { reason } : {}),
+    remainingPaths,
+  };
+}

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -2,6 +2,7 @@
  *  sha·PR·커밋은 형식 검사 전에 스크립트에 넣지 않는다(셸 주입 차단). */
 
 import { execFileSync } from 'node:child_process';
+import { siTaskPodStageShell } from './pod-lifecycle-stages.js';
 
 export type PodSource =
   | { kind: 'default'; base?: string }
@@ -52,17 +53,30 @@ function assertRemoteBase(repoUrl: string, base: string): void {
   }
 }
 
-/** Job 스크립트의 원천 단계. 성공 갈래는 `ELANOUS_POD_SOURCE <kind> <HEAD>` 로 끝난다. */
-export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath = '/host-mirror'): string {
+/** Job 스크립트의 원천 단계. 성공 갈래는 `ELANOUS_POD_SOURCE <kind> <HEAD>` 로 끝난다.
+ *  `stageMarkers` — si-task Job 만: 호스트 미러 `clone --shared` 시도의 시작·성공을 `ELANOUS_POD_STAGE mirror start|end` 로 찍는다
+ *  (건너뛰거나 실패하면 끝 표지가 없다 → 호스트가 missing 으로 읽는다). 기본은 꺼짐 — gate·pod-command Job 의 바이트는 그대로다. */
+export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath = '/host-mirror', options: { stageMarkers?: boolean } = {}): string {
+  const mark = (edge: 'start' | 'end'): string[] => options.stageMarkers ? [siTaskPodStageShell('mirror', edge)] : [];
   const quotedUrl = `'${repoUrl.replace(/'/g, `'\\''`)}'`;
   const quotedMirror = `'${mirrorPath.replace(/'/g, `'\\''`)}'`;
   const clone = `git clone -q --depth 50 ${quotedUrl} repo`;
   const start = [
     'if [ -e repo ]; then exit 5; fi',
-    `if [ -d ${quotedMirror} ] && git -C ${quotedMirror} rev-parse --verify HEAD >/dev/null 2>&1 && git clone -q --shared -- ${quotedMirror} repo && git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then`,
+    // TA-POD-WARMBOOT-PARITY (10-16): the mirror fallback used to be silent — 157 HARD gate Pods all said
+    // `VIA github` and nothing said why (the Job had no /host-mirror mount). Each failed step now names itself.
+    'mirror_skip=',
+    ...mark('start'),
+    `if ! [ -d ${quotedMirror} ]; then mirror_skip=no-mount`,
+    `elif ! git -C ${quotedMirror} rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=rev-parse-failed`,
+    `elif ! git clone -q --shared -- ${quotedMirror} repo || ! git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=clone-failed`,
+    'fi',
+    'if [ -z "$mirror_skip" ]; then',
+    ...mark('end').map((line) => `  ${line}`),
     `  git -C repo remote set-url origin ${quotedUrl} || exit 5`,
     '  source_via=mirror',
     'else',
+    "  printf 'ELANOUS_POD_SOURCE_MIRROR_SKIP %s\\n' \"$mirror_skip\"",
     '  if [ -e repo ]; then rm -r -- repo || exit 5; fi',
     `  ${clone} || exit 5`,
     '  source_via=github',
@@ -143,7 +157,9 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     '  exit 3',
     'fi',
     'if [ -e repo ]; then exit 5; fi',
+    ...mark('start'),
     `if [ -d ${quotedMirror} ] && git -C ${quotedMirror} rev-parse --verify HEAD >/dev/null 2>&1 && git clone -q --shared -- ${quotedMirror} repo && git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then`,
+    ...mark('end').map((line) => `  ${line}`),
     `  git -C repo remote set-url origin ${quotedUrl} || exit 5`,
     '  if git -C repo bundle verify /tmp/source.bundle >/dev/null 2>&1; then',
     '    git -C repo fetch /tmp/source.bundle "refs/elanous/pod-source/*:refs/remotes/bundle/*" || exit 5',

package/src/task-orchestrator/surfaces/pod-warm-switch.ts

@@ -0,0 +1,141 @@
+/**
+ * warm Pod 재사용 ⑤ — 소비자별 «실전 사용 가능?» 손잡이 (PLAN-warm-reuse-tonight-2026-10-15 §5).
+ *
+ * 관측: 판정마다 `debug.log('pod.warm', 'switch-decision', …)` 한 줄(소비자·live·reason·표본 수).
+ * 판단: config flag(`pod.warmReuse.{gateRecheck,land,ta}` · 기본 false) ⊕ 증거
+ *       (lease 유효 · 카나리아 통과 · 같은 head/main/lock · 최근 mismatch 0 · 연속 일치 표본 ≥ minMatchSamples).
+ * 수복: live=false 면 소비자는 기존 fresh Job 경로를 그대로 탄다 — reason 이 «무엇이 모자랐나»를 넘긴다.
+ *
+ * ⛔ 이 모듈은 판정만 한다. 소비자 결선(pod-command-job · gate-node · self-implement-pod)은 각 소비자 PR 몫이다.
+ * ⛔ 못 잰 증거(undefined)는 «통과»가 아니라 «off» 다 — 모르면 켜지 않는다.
+ * 순서: gate-recheck → land → ta. 앞 소비자가 «자기 증거로» live 가 아니면 뒤 소비자도 live 가 아니다
+ *       (증거는 소비자별 — 뒤 소비자의 증거로 앞 소비자를 대신 판정하지 않는다 · 앞 증거가 없으면 off).
+ */
+import { debug } from '../../debug/log.js';
+
+export type WarmReuseConsumer = 'gate-recheck' | 'land' | 'ta';
+
+/** 켜는 순서 — 뒤 소비자는 바로 앞 소비자가 live 일 때만 live 가 될 수 있다. */
+export const WARM_REUSE_CONSUMER_ORDER: readonly WarmReuseConsumer[] = ['gate-recheck', 'land', 'ta'];
+
+/** 연속 일치 표본 기본 하한(보수적). */
+export const DEFAULT_WARM_MIN_MATCH_SAMPLES = 3;
+
+/** `pod.warmReuse` config 절 — 타입이 어긋난 값은 off/기본값으로 읽는다. */
+export interface WarmReuseSwitchConfig {
+  gateRecheck?: boolean;
+  land?: boolean;
+  ta?: boolean;
+  minMatchSamples?: number;
+}
+
+/** warm 워커 신원 — 기대값(fresh Job 쪽)과 워커 쪽을 같은 칸끼리 대조한다. */
+export interface WarmReuseIdentity {
+  head?: string;
+  main?: string;
+  lock?: string;
+}
+
+/** 판정 증거. 칸이 비면(undefined) «못 쟀다» = off. */
+export interface WarmReuseEvidence {
+  /** 같은 파일 fresh Job 대비 연속 일치(rc ⊕ JUnit 실패 ID) 표본 수. */
+  consecutiveMatchSamples?: number;
+  /** 최근 창의 warm↔fresh mismatch 수 — 0 이어야 live. */
+  recentMismatchCount?: number;
+  /** Nexus `pod-worker-lease` 가 현재 generation 으로 유효한가. */
+  leaseValid?: boolean;
+  /** 정비 뒤 카나리아 통과. */
+  canaryPassed?: boolean;
+  expected?: WarmReuseIdentity;
+  worker?: WarmReuseIdentity;
+}
+
+/** 소비자별 증거 — 판정 대상 ⊕ 그 앞 소비자들의 증거가 모두 있어야 live 가 될 수 있다. */
+export type WarmReuseEvidenceByConsumer = Partial<Record<WarmReuseConsumer, WarmReuseEvidence>>;
+
+export interface WarmReuseDecision {
+  consumer: WarmReuseConsumer;
+  live: boolean;
+  /** `live` 이거나 첫 번째로 걸린 이유(예 `flag-off` · `predecessor-off:land` · `samples-short`). */
+  reason: string;
+}
+
+const FLAG_KEY: Record<WarmReuseConsumer, keyof Pick<WarmReuseSwitchConfig, 'gateRecheck' | 'land' | 'ta'>> = {
+  'gate-recheck': 'gateRecheck',
+  land: 'land',
+  ta: 'ta',
+};
+
+const IDENTITY_FIELDS = ['head', 'main', 'lock'] as const;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+/** minMatchSamples — 양의 안전 정수만, 아니면 기본값. */
+export function resolveWarmMinMatchSamples(config: unknown): number {
+  const raw = isRecord(config) ? config.minMatchSamples : undefined;
+  return typeof raw === 'number' && Number.isSafeInteger(raw) && raw > 0 ? raw : DEFAULT_WARM_MIN_MATCH_SAMPLES;
+}
+
+/** flag — 문자 그대로 `true` 만 켠다. */
+export function warmReuseFlagOn(config: unknown, consumer: WarmReuseConsumer): boolean {
+  return isRecord(config) && config[FLAG_KEY[consumer]] === true;
+}
+
+function evidenceReason(evidence: WarmReuseEvidence | undefined, minSamples: number): string | null {
+  if (!evidence) return 'evidence-unmeasured';
+  if (evidence.leaseValid !== true) return evidence.leaseValid === false ? 'lease-invalid' : 'lease-unmeasured';
+  if (evidence.canaryPassed !== true) return evidence.canaryPassed === false ? 'canary-failed' : 'canary-unmeasured';
+  for (const field of IDENTITY_FIELDS) {
+    const want = evidence.expected?.[field];
+    const got = evidence.worker?.[field];
+    if (typeof want !== 'string' || !want || typeof got !== 'string' || !got) return `identity-unmeasured:${field}`;
+    // 원값 그대로 정확히 비교한다 — 앞뒤 공백 등 형식이 어긋난 값은 고쳐 읽지 않고 off.
+    if (want !== want.trim() || got !== got.trim()) return `identity-malformed:${field}`;
+    if (want !== got) return `identity-mismatch:${field}`;
+  }
+  const mismatches = evidence.recentMismatchCount;
+  if (typeof mismatches !== 'number' || !Number.isSafeInteger(mismatches) || mismatches < 0) return 'mismatch-unmeasured';
+  if (mismatches > 0) return 'recent-mismatch';
+  const samples = evidence.consecutiveMatchSamples;
+  if (typeof samples !== 'number' || !Number.isSafeInteger(samples) || samples < 0) return 'samples-unmeasured';
+  if (samples < minSamples) return 'samples-short';
+  return null;
+}
+
+function decide(consumer: WarmReuseConsumer, config: unknown, evidence: WarmReuseEvidenceByConsumer | undefined): string {
+  if (!warmReuseFlagOn(config, consumer)) return 'flag-off';
+  const index = WARM_REUSE_CONSUMER_ORDER.indexOf(consumer);
+  if (index > 0) {
+    const predecessor = WARM_REUSE_CONSUMER_ORDER[index - 1]!;
+    if (decide(predecessor, config, evidence) !== 'live') return `predecessor-off:${predecessor}`;
+  }
+  const own = isRecord(evidence) ? evidence[consumer] : undefined;
+  return evidenceReason(isRecord(own) ? own : undefined, resolveWarmMinMatchSamples(config)) ?? 'live';
+}
+
+/**
+ * 소비자 하나가 지금 warm 워커를 «실전»으로 써도 되나.
+ * `config` 는 `getUserConfig().pod?.warmReuse` 를 그대로 넘긴다(없으면 전부 off).
+ * `evidence` 는 소비자별 — 대상 소비자 ⊕ 그 앞 소비자들의 칸이 모두 있어야 한다(앞 칸이 비면 `predecessor-off:<앞>`).
+ */
+export function decideWarmReuse(
+  consumer: WarmReuseConsumer,
+  config: WarmReuseSwitchConfig | undefined,
+  evidence: WarmReuseEvidenceByConsumer | undefined,
+): WarmReuseDecision {
+  const reason = decide(consumer, config, evidence);
+  const live = reason === 'live';
+  const own = isRecord(evidence) && isRecord(evidence[consumer]) ? evidence[consumer] : undefined;
+  debug.log('pod.warm', 'switch-decision', {
+    consumer,
+    live,
+    reason,
+    flag: warmReuseFlagOn(config, consumer),
+    minMatchSamples: resolveWarmMinMatchSamples(config),
+    samples: own?.consecutiveMatchSamples ?? null,
+    recentMismatchCount: own?.recentMismatchCount ?? null,
+  });
+  return { consumer, live, reason };
+}

package/src/task-orchestrator/surfaces/pod-warm-ta-shadow.ts

@@ -0,0 +1,85 @@
+/**
+ * warm Pod 재사용 — 'ta' 소비자의 «그림자 비교» 순수 모듈 (PLAN-warm-reuse-tonight-2026-10-15 §5 · pod-warm-switch.ts 의 'ta' 몫).
+ *
+ * 관측: 이 모듈은 아무것도 관측하지 않는다 — 완료된 si-task Job outcome 과 lease-fenced warm candidate 를
+ *       «받은 값만으로» 비교한다(자체 I/O · 부수효과 없음).
+ * 판단: 후보 키는 원문이 준 두 성분 — same source SHA / child model. lease 펜스(pod-lease.ts 세대 펜스,
+ *       WarmReuseEvidence.leaseValid 와 같은 칸)가 유효하지 않으면 키가 같아도 기각한다(fail-closed).
+ * 수복: match=false 면 호출자는 기존 fresh Job 경로를 그대로 탄다 — reason 이 «무엇이 모자랐나»를 넘긴다.
+ *
+ * ⛔ 이 모듈은 비교만 한다. 소비자 결선(self-implement-pod 연결)은 형제 샤드 몫이다(정의-결선 분리 경계).
+ * ⛔ 못 잰 값(undefined · 빈 값)은 «일치»가 아니라 «기각» 이다 — pod-warm-switch.ts 의
+ *    'unmeasured = off' 규율과 원값 그대로의 정확 비교(앞뒤 공백 등 형식 어긋남은 고쳐 읽지 않는다)를 그대로 잇는다.
+ */
+
+/**
+ * UNRESOLVED — 원문 요청 문면이 `(keyed by same source SHA / child model /` 에서 끊겼다.
+ * child model 뒤에 추가 키 성분이 더 있는지, 그리고 그 뒤에 이어지던 비교 요구가 무엇이었는지 이 문서에서 확정할 수 없다.
+ * 이 모듈은 확정된 두 키(same source SHA / child model)만 비교한다 — 나머지는 의도적으로 미정(unspecified)이며 지어내지 않는다.
+ * 추가 성분은 원문 회수 시 그 표현 그대로만 붙인다.
+ */
+export const TA_SHADOW_UNRESOLVED_NOTE: string =
+  "UNRESOLVED: original ask truncated after '(keyed by same source SHA / child model /' — " +
+  'confirmed keys are source SHA and child model; any further key components or comparison ' +
+  'requirements are intentionally unspecified, not invented.';
+
+/** 완료된 si-task Job outcome — 비교에 쓰는 키 성분만 담는다(원문 확정: same source SHA / child model). */
+export interface SiTaskJobOutcome {
+  /** 이 outcome 을 낸 원본 소스의 SHA — 후보 키 성분 ①. */
+  sourceSha: string;
+  /** 이 outcome 을 낸 자식 모델(self-implement-pod.ts `childModel` 과 같은 문자열 칸) — 후보 키 성분 ②. */
+  childModel: string;
+}
+
+/**
+ * lease-fenced warm candidate — pod-lease.ts 세대 펜스가 붙은 warm 재사용 후보.
+ * `leaseValid` 는 pod-warm-switch.ts `WarmReuseEvidence.leaseValid` 와 같은 칸:
+ * `true` = 현재 generation 유효 · `false` = 펜스 기각 · `undefined` = 못 잰(off).
+ */
+export interface LeaseFencedWarmCandidate {
+  sourceSha: string;
+  childModel: string;
+  leaseValid?: boolean;
+}
+
+/** 비교 결과 — 첫 번째로 걸린 이유를 그대로 넘긴다(«lease-fence rejection passthrough» 포함). */
+export interface TaShadowComparison {
+  match: boolean;
+  reason:
+    | 'match'
+    | 'lease-unmeasured'
+    | 'lease-invalid'
+    | 'source-sha-unmeasured'
+    | 'source-sha-malformed'
+    | 'source-sha-mismatch'
+    | 'child-model-unmeasured'
+    | 'child-model-malformed'
+    | 'child-model-mismatch';
+}
+
+/** 원값 그대로의 정확 비교 — 못 잼(unmeasured) · 형식 어긋남(malformed) · 불일치(mismatch) 를 갈라 뱉는다. */
+function exactString(
+  field: 'source-sha' | 'child-model',
+  outcome: string,
+  candidate: string,
+): TaShadowComparison['reason'] | null {
+  if (typeof outcome !== 'string' || !outcome || typeof candidate !== 'string' || !candidate) return `${field}-unmeasured`;
+  if (outcome !== outcome.trim() || candidate !== candidate.trim()) return `${field}-malformed`;
+  if (outcome !== candidate) return `${field}-mismatch`;
+  return null;
+}
+
+/**
+ * 완료된 si-task Job outcome 과 lease-fenced warm candidate 가 «같은 키» 인지 — 순수 비교.
+ * 순서: lease 펜스 먼저(펜스가 기각이면 키가 같아도 기각이 우선한다) → source SHA → child model.
+ */
+export function compareWarmTaShadow(outcome: SiTaskJobOutcome, candidate: LeaseFencedWarmCandidate): TaShadowComparison {
+  if (candidate.leaseValid !== true) {
+    return { match: false, reason: candidate.leaseValid === false ? 'lease-invalid' : 'lease-unmeasured' };
+  }
+  const sha = exactString('source-sha', outcome.sourceSha, candidate.sourceSha);
+  if (sha !== null) return { match: false, reason: sha };
+  const model = exactString('child-model', outcome.childModel, candidate.childModel);
+  if (model !== null) return { match: false, reason: model };
+  return { match: true, reason: 'match' };
+}

package/src/task-orchestrator/surfaces/pod-warm-worker-protocol.ts

@@ -0,0 +1,153 @@
+/**
+ * Warm Pod wire contract. A reply is only a shadow observation until its lease,
+ * attempt, artifacts, and result agree with the existing one-shot Job.
+ * No command or result in this module launches a Pod or changes the gate verdict.
+ */
+
+export interface WarmWorkerKey {
+  context: string;
+  imageDigest: string;
+  lockHash: string;
+  architecture: string;
+}
+
+export interface WarmWorkerCommand {
+  protocol: 1;
+  runId: string;
+  attemptId: string;
+  cutSha: string;
+  baselineSha?: string;
+  leaseId: string;
+  generation: number;
+  workerId: string;
+  key: WarmWorkerKey;
+  deadlineAt: number;
+  files: readonly string[];
+  /** Named, versioned environment profile; credentials travel through the existing Secret path. */
+  envProfile: string;
+}
+
+export interface WarmWorkerFileResult {
+  file: string;
+  rc: number;
+  /** Canonical `file > case` IDs parsed from a complete JUnit artifact. */
+  failureIds: readonly string[];
+  /** Named unhandled errors, including those emitted outside JUnit. */
+  errorIds: readonly string[];
+  junitComplete: boolean;
+}
+
+export interface WarmWorkerReply {
+  protocol: 1;
+  runId: string;
+  attemptId: string;
+  cutSha: string;
+  baselineSha?: string;
+  leaseId: string;
+  generation: number;
+  workerId: string;
+  key: WarmWorkerKey;
+  envProfile: string;
+  startedAt: number;
+  finishedAt: number;
+  files: readonly WarmWorkerFileResult[];
+}
+
+export type WarmShadowReason = 'match' | 'no-sample' | 'reply-unmeasured' | 'reference-unmeasured' | 'invalid-reply' | 'identity' | 'missing-artifact' | 'file-set' | 'result';
+export interface WarmShadowDecision {
+  reason: WarmShadowReason;
+  /** The existing Job remains authoritative throughout shadow mode. */
+  adopt: 'job';
+  quarantineWorker: boolean;
+}
+
+const decision = (reason: WarmShadowReason): WarmShadowDecision =>
+  ({ reason, adopt: 'job', quarantineWorker: !['match', 'no-sample', 'reply-unmeasured', 'reference-unmeasured'].includes(reason) });
+
+const record = (value: unknown): Record<string, unknown> | null =>
+  value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
+const named = (value: unknown): value is string => typeof value === 'string' && value.length > 0;
+const finite = (value: unknown): value is number => typeof value === 'number' && Number.isFinite(value);
+const nonnegativeInt = (value: unknown): value is number => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+
+/** Validate untrusted JSON before it can enter the shadow comparator. */
+export function parseWarmWorkerReply(raw: unknown): WarmWorkerReply | null {
+  const reply = record(raw);
+  const key = record(reply?.key);
+  if (!reply || reply.protocol !== 1 || !named(reply.runId) || !named(reply.attemptId) || !named(reply.cutSha)
+    || !named(reply.leaseId) || !named(reply.workerId) || !named(reply.envProfile)
+    || !nonnegativeInt(reply.generation) || reply.generation < 1
+    || !finite(reply.startedAt) || !finite(reply.finishedAt)
+    || !key || !named(key.context) || !named(key.imageDigest) || !named(key.lockHash) || !named(key.architecture)
+    || !Array.isArray(reply.files) || reply.files.some((part: unknown) => {
+      const item = record(part);
+      return !item || !named(item.file) || !nonnegativeInt(item.rc)
+        || typeof item.junitComplete !== 'boolean'
+        || !Array.isArray(item.failureIds) || !item.failureIds.every(named)
+        || !Array.isArray(item.errorIds) || !item.errorIds.every(named);
+    }) || (reply.baselineSha !== undefined && !named(reply.baselineSha))) return null;
+  return raw as WarmWorkerReply;
+}
+
+function fileMap(files: readonly WarmWorkerFileResult[], expected: readonly string[]): Map<string, WarmWorkerFileResult> | null {
+  if (!Array.isArray(files) || !Array.isArray(expected) || files.length !== expected.length
+    || expected.some((file) => !named(file)) || new Set(expected).size !== expected.length) return null;
+  const wanted = new Set(expected);
+  const map = new Map<string, WarmWorkerFileResult>();
+  for (const part of files) {
+    if (!part || !named(part.file) || !wanted.has(part.file) || map.has(part.file)) return null;
+    map.set(part.file, part);
+  }
+  return map;
+}
+
+function validPart(part: WarmWorkerFileResult): boolean {
+  const prefix = `${part.file} > `;
+  const namedId = (id: unknown) => typeof id === 'string' && id.startsWith(prefix) && id.slice(prefix.length).trim().length > 0;
+  const namedErrorId = (id: unknown) => typeof id === 'string' && id.startsWith(`${prefix}[error] `)
+    && id.slice(`${prefix}[error] `.length).trim().length > 0;
+  return Number.isSafeInteger(part.rc) && part.rc >= 0 && part.junitComplete === true
+    && Array.isArray(part.failureIds) && part.failureIds.every(namedId)
+    && new Set(part.failureIds).size === part.failureIds.length
+    && Array.isArray(part.errorIds) && part.errorIds.every(namedErrorId)
+    && new Set(part.errorIds).size === part.errorIds.length
+    && new Set([...part.failureIds, ...part.errorIds]).size === part.failureIds.length + part.errorIds.length
+    && (part.rc === 0 ? part.failureIds.length + part.errorIds.length === 0 : part.failureIds.length + part.errorIds.length > 0);
+}
+
+function sameIds(left: readonly string[], right: readonly string[]): boolean {
+  if (new Set(left).size !== left.length || new Set(right).size !== right.length || left.length !== right.length) return false;
+  const orderedRight = [...right].sort();
+  return [...left].sort().every((id, index) => id === orderedRight[index]);
+}
+
+/** Fail closed on a stale generation, missing artifact, changed file set, or changed `rc + failure IDs`. */
+export function assessWarmWorkerShadow(command: WarmWorkerCommand, job: readonly WarmWorkerFileResult[], rawReply: unknown): WarmShadowDecision {
+  if (!Array.isArray(command.files) || !command.files.length) return decision('no-sample');
+  const reference = fileMap(job, command.files);
+  if (!reference) return decision('reference-unmeasured');
+  // Validate the whole authoritative sample before attributing anything to the worker.
+  for (const file of command.files) if (!validPart(reference.get(file)!)) return decision('reference-unmeasured');
+  if (rawReply === null || rawReply === undefined) return decision('reply-unmeasured');
+  const reply = parseWarmWorkerReply(rawReply);
+  if (!reply) return decision('invalid-reply');
+  if (command.protocol !== 1 || reply.protocol !== 1 || !command.runId || !command.attemptId || !command.cutSha || !command.leaseId || !command.workerId
+    || !Number.isSafeInteger(command.generation) || command.generation < 1
+    || !Number.isFinite(command.deadlineAt)
+    || command.runId !== reply.runId || command.attemptId !== reply.attemptId || command.cutSha !== reply.cutSha
+    || command.baselineSha !== reply.baselineSha || command.envProfile !== reply.envProfile
+    || command.leaseId !== reply.leaseId || command.generation !== reply.generation || command.workerId !== reply.workerId
+    || !command.key || command.key.context !== reply.key?.context || command.key.imageDigest !== reply.key?.imageDigest
+    || command.key.lockHash !== reply.key?.lockHash || command.key.architecture !== reply.key?.architecture
+    || !Number.isFinite(reply.startedAt) || !Number.isFinite(reply.finishedAt) || reply.finishedAt < reply.startedAt
+    || reply.finishedAt > command.deadlineAt) return decision('identity');
+  const candidate = fileMap(reply.files, command.files);
+  if (!candidate) return decision('file-set');
+  for (const file of command.files) if (!validPart(candidate.get(file)!)) return decision('missing-artifact');
+  for (const file of command.files) {
+    const before = reference.get(file)!;
+    const after = candidate.get(file)!;
+    if (before.rc !== after.rc || !sameIds(before.failureIds, after.failureIds) || !sameIds(before.errorIds, after.errorIds)) return decision('result');
+  }
+  return decision('match');
+}