elanous 0.2.29 → 0.2.31

package/src/task-orchestrator/surfaces/pod-warm-ta-shadow.ts

@@ -0,0 +1,85 @@
+/**
+ * warm Pod 재사용 — 'ta' 소비자의 «그림자 비교» 순수 모듈 (PLAN-warm-reuse-tonight-2026-10-15 §5 · pod-warm-switch.ts 의 'ta' 몫).
+ *
+ * 관측: 이 모듈은 아무것도 관측하지 않는다 — 완료된 si-task Job outcome 과 lease-fenced warm candidate 를
+ *       «받은 값만으로» 비교한다(자체 I/O · 부수효과 없음).
+ * 판단: 후보 키는 원문이 준 두 성분 — same source SHA / child model. lease 펜스(pod-lease.ts 세대 펜스,
+ *       WarmReuseEvidence.leaseValid 와 같은 칸)가 유효하지 않으면 키가 같아도 기각한다(fail-closed).
+ * 수복: match=false 면 호출자는 기존 fresh Job 경로를 그대로 탄다 — reason 이 «무엇이 모자랐나»를 넘긴다.
+ *
+ * ⛔ 이 모듈은 비교만 한다. 소비자 결선(self-implement-pod 연결)은 형제 샤드 몫이다(정의-결선 분리 경계).
+ * ⛔ 못 잰 값(undefined · 빈 값)은 «일치»가 아니라 «기각» 이다 — pod-warm-switch.ts 의
+ *    'unmeasured = off' 규율과 원값 그대로의 정확 비교(앞뒤 공백 등 형식 어긋남은 고쳐 읽지 않는다)를 그대로 잇는다.
+ */
+
+/**
+ * UNRESOLVED — 원문 요청 문면이 `(keyed by same source SHA / child model /` 에서 끊겼다.
+ * child model 뒤에 추가 키 성분이 더 있는지, 그리고 그 뒤에 이어지던 비교 요구가 무엇이었는지 이 문서에서 확정할 수 없다.
+ * 이 모듈은 확정된 두 키(same source SHA / child model)만 비교한다 — 나머지는 의도적으로 미정(unspecified)이며 지어내지 않는다.
+ * 추가 성분은 원문 회수 시 그 표현 그대로만 붙인다.
+ */
+export const TA_SHADOW_UNRESOLVED_NOTE: string =
+  "UNRESOLVED: original ask truncated after '(keyed by same source SHA / child model /' — " +
+  'confirmed keys are source SHA and child model; any further key components or comparison ' +
+  'requirements are intentionally unspecified, not invented.';
+
+/** 완료된 si-task Job outcome — 비교에 쓰는 키 성분만 담는다(원문 확정: same source SHA / child model). */
+export interface SiTaskJobOutcome {
+  /** 이 outcome 을 낸 원본 소스의 SHA — 후보 키 성분 ①. */
+  sourceSha: string;
+  /** 이 outcome 을 낸 자식 모델(self-implement-pod.ts `childModel` 과 같은 문자열 칸) — 후보 키 성분 ②. */
+  childModel: string;
+}
+
+/**
+ * lease-fenced warm candidate — pod-lease.ts 세대 펜스가 붙은 warm 재사용 후보.
+ * `leaseValid` 는 pod-warm-switch.ts `WarmReuseEvidence.leaseValid` 와 같은 칸:
+ * `true` = 현재 generation 유효 · `false` = 펜스 기각 · `undefined` = 못 잰(off).
+ */
+export interface LeaseFencedWarmCandidate {
+  sourceSha: string;
+  childModel: string;
+  leaseValid?: boolean;
+}
+
+/** 비교 결과 — 첫 번째로 걸린 이유를 그대로 넘긴다(«lease-fence rejection passthrough» 포함). */
+export interface TaShadowComparison {
+  match: boolean;
+  reason:
+    | 'match'
+    | 'lease-unmeasured'
+    | 'lease-invalid'
+    | 'source-sha-unmeasured'
+    | 'source-sha-malformed'
+    | 'source-sha-mismatch'
+    | 'child-model-unmeasured'
+    | 'child-model-malformed'
+    | 'child-model-mismatch';
+}
+
+/** 원값 그대로의 정확 비교 — 못 잼(unmeasured) · 형식 어긋남(malformed) · 불일치(mismatch) 를 갈라 뱉는다. */
+function exactString(
+  field: 'source-sha' | 'child-model',
+  outcome: string,
+  candidate: string,
+): TaShadowComparison['reason'] | null {
+  if (typeof outcome !== 'string' || !outcome || typeof candidate !== 'string' || !candidate) return `${field}-unmeasured`;
+  if (outcome !== outcome.trim() || candidate !== candidate.trim()) return `${field}-malformed`;
+  if (outcome !== candidate) return `${field}-mismatch`;
+  return null;
+}
+
+/**
+ * 완료된 si-task Job outcome 과 lease-fenced warm candidate 가 «같은 키» 인지 — 순수 비교.
+ * 순서: lease 펜스 먼저(펜스가 기각이면 키가 같아도 기각이 우선한다) → source SHA → child model.
+ */
+export function compareWarmTaShadow(outcome: SiTaskJobOutcome, candidate: LeaseFencedWarmCandidate): TaShadowComparison {
+  if (candidate.leaseValid !== true) {
+    return { match: false, reason: candidate.leaseValid === false ? 'lease-invalid' : 'lease-unmeasured' };
+  }
+  const sha = exactString('source-sha', outcome.sourceSha, candidate.sourceSha);
+  if (sha !== null) return { match: false, reason: sha };
+  const model = exactString('child-model', outcome.childModel, candidate.childModel);
+  if (model !== null) return { match: false, reason: model };
+  return { match: true, reason: 'match' };
+}

package/src/task-orchestrator/surfaces/pod-warm-worker-protocol.ts

@@ -0,0 +1,153 @@
+/**
+ * Warm Pod wire contract. A reply is only a shadow observation until its lease,
+ * attempt, artifacts, and result agree with the existing one-shot Job.
+ * No command or result in this module launches a Pod or changes the gate verdict.
+ */
+
+export interface WarmWorkerKey {
+  context: string;
+  imageDigest: string;
+  lockHash: string;
+  architecture: string;
+}
+
+export interface WarmWorkerCommand {
+  protocol: 1;
+  runId: string;
+  attemptId: string;
+  cutSha: string;
+  baselineSha?: string;
+  leaseId: string;
+  generation: number;
+  workerId: string;
+  key: WarmWorkerKey;
+  deadlineAt: number;
+  files: readonly string[];
+  /** Named, versioned environment profile; credentials travel through the existing Secret path. */
+  envProfile: string;
+}
+
+export interface WarmWorkerFileResult {
+  file: string;
+  rc: number;
+  /** Canonical `file > case` IDs parsed from a complete JUnit artifact. */
+  failureIds: readonly string[];
+  /** Named unhandled errors, including those emitted outside JUnit. */
+  errorIds: readonly string[];
+  junitComplete: boolean;
+}
+
+export interface WarmWorkerReply {
+  protocol: 1;
+  runId: string;
+  attemptId: string;
+  cutSha: string;
+  baselineSha?: string;
+  leaseId: string;
+  generation: number;
+  workerId: string;
+  key: WarmWorkerKey;
+  envProfile: string;
+  startedAt: number;
+  finishedAt: number;
+  files: readonly WarmWorkerFileResult[];
+}
+
+export type WarmShadowReason = 'match' | 'no-sample' | 'reply-unmeasured' | 'reference-unmeasured' | 'invalid-reply' | 'identity' | 'missing-artifact' | 'file-set' | 'result';
+export interface WarmShadowDecision {
+  reason: WarmShadowReason;
+  /** The existing Job remains authoritative throughout shadow mode. */
+  adopt: 'job';
+  quarantineWorker: boolean;
+}
+
+const decision = (reason: WarmShadowReason): WarmShadowDecision =>
+  ({ reason, adopt: 'job', quarantineWorker: !['match', 'no-sample', 'reply-unmeasured', 'reference-unmeasured'].includes(reason) });
+
+const record = (value: unknown): Record<string, unknown> | null =>
+  value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
+const named = (value: unknown): value is string => typeof value === 'string' && value.length > 0;
+const finite = (value: unknown): value is number => typeof value === 'number' && Number.isFinite(value);
+const nonnegativeInt = (value: unknown): value is number => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+
+/** Validate untrusted JSON before it can enter the shadow comparator. */
+export function parseWarmWorkerReply(raw: unknown): WarmWorkerReply | null {
+  const reply = record(raw);
+  const key = record(reply?.key);
+  if (!reply || reply.protocol !== 1 || !named(reply.runId) || !named(reply.attemptId) || !named(reply.cutSha)
+    || !named(reply.leaseId) || !named(reply.workerId) || !named(reply.envProfile)
+    || !nonnegativeInt(reply.generation) || reply.generation < 1
+    || !finite(reply.startedAt) || !finite(reply.finishedAt)
+    || !key || !named(key.context) || !named(key.imageDigest) || !named(key.lockHash) || !named(key.architecture)
+    || !Array.isArray(reply.files) || reply.files.some((part: unknown) => {
+      const item = record(part);
+      return !item || !named(item.file) || !nonnegativeInt(item.rc)
+        || typeof item.junitComplete !== 'boolean'
+        || !Array.isArray(item.failureIds) || !item.failureIds.every(named)
+        || !Array.isArray(item.errorIds) || !item.errorIds.every(named);
+    }) || (reply.baselineSha !== undefined && !named(reply.baselineSha))) return null;
+  return raw as WarmWorkerReply;
+}
+
+function fileMap(files: readonly WarmWorkerFileResult[], expected: readonly string[]): Map<string, WarmWorkerFileResult> | null {
+  if (!Array.isArray(files) || !Array.isArray(expected) || files.length !== expected.length
+    || expected.some((file) => !named(file)) || new Set(expected).size !== expected.length) return null;
+  const wanted = new Set(expected);
+  const map = new Map<string, WarmWorkerFileResult>();
+  for (const part of files) {
+    if (!part || !named(part.file) || !wanted.has(part.file) || map.has(part.file)) return null;
+    map.set(part.file, part);
+  }
+  return map;
+}
+
+function validPart(part: WarmWorkerFileResult): boolean {
+  const prefix = `${part.file} > `;
+  const namedId = (id: unknown) => typeof id === 'string' && id.startsWith(prefix) && id.slice(prefix.length).trim().length > 0;
+  const namedErrorId = (id: unknown) => typeof id === 'string' && id.startsWith(`${prefix}[error] `)
+    && id.slice(`${prefix}[error] `.length).trim().length > 0;
+  return Number.isSafeInteger(part.rc) && part.rc >= 0 && part.junitComplete === true
+    && Array.isArray(part.failureIds) && part.failureIds.every(namedId)
+    && new Set(part.failureIds).size === part.failureIds.length
+    && Array.isArray(part.errorIds) && part.errorIds.every(namedErrorId)
+    && new Set(part.errorIds).size === part.errorIds.length
+    && new Set([...part.failureIds, ...part.errorIds]).size === part.failureIds.length + part.errorIds.length
+    && (part.rc === 0 ? part.failureIds.length + part.errorIds.length === 0 : part.failureIds.length + part.errorIds.length > 0);
+}
+
+function sameIds(left: readonly string[], right: readonly string[]): boolean {
+  if (new Set(left).size !== left.length || new Set(right).size !== right.length || left.length !== right.length) return false;
+  const orderedRight = [...right].sort();
+  return [...left].sort().every((id, index) => id === orderedRight[index]);
+}
+
+/** Fail closed on a stale generation, missing artifact, changed file set, or changed `rc + failure IDs`. */
+export function assessWarmWorkerShadow(command: WarmWorkerCommand, job: readonly WarmWorkerFileResult[], rawReply: unknown): WarmShadowDecision {
+  if (!Array.isArray(command.files) || !command.files.length) return decision('no-sample');
+  const reference = fileMap(job, command.files);
+  if (!reference) return decision('reference-unmeasured');
+  // Validate the whole authoritative sample before attributing anything to the worker.
+  for (const file of command.files) if (!validPart(reference.get(file)!)) return decision('reference-unmeasured');
+  if (rawReply === null || rawReply === undefined) return decision('reply-unmeasured');
+  const reply = parseWarmWorkerReply(rawReply);
+  if (!reply) return decision('invalid-reply');
+  if (command.protocol !== 1 || reply.protocol !== 1 || !command.runId || !command.attemptId || !command.cutSha || !command.leaseId || !command.workerId
+    || !Number.isSafeInteger(command.generation) || command.generation < 1
+    || !Number.isFinite(command.deadlineAt)
+    || command.runId !== reply.runId || command.attemptId !== reply.attemptId || command.cutSha !== reply.cutSha
+    || command.baselineSha !== reply.baselineSha || command.envProfile !== reply.envProfile
+    || command.leaseId !== reply.leaseId || command.generation !== reply.generation || command.workerId !== reply.workerId
+    || !command.key || command.key.context !== reply.key?.context || command.key.imageDigest !== reply.key?.imageDigest
+    || command.key.lockHash !== reply.key?.lockHash || command.key.architecture !== reply.key?.architecture
+    || !Number.isFinite(reply.startedAt) || !Number.isFinite(reply.finishedAt) || reply.finishedAt < reply.startedAt
+    || reply.finishedAt > command.deadlineAt) return decision('identity');
+  const candidate = fileMap(reply.files, command.files);
+  if (!candidate) return decision('file-set');
+  for (const file of command.files) if (!validPart(candidate.get(file)!)) return decision('missing-artifact');
+  for (const file of command.files) {
+    const before = reference.get(file)!;
+    const after = candidate.get(file)!;
+    if (before.rc !== after.rc || !sameIds(before.failureIds, after.failureIds) || !sameIds(before.errorIds, after.errorIds)) return decision('result');
+  }
+  return decision('match');
+}

package/src/task-orchestrator/surfaces/pod-warm-worker-runtime.ts

@@ -0,0 +1,208 @@
+/** In-Pod warm worker. This module does not create a Pod or select a gate result. */
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
+import { warmReferenceFromJobArtifacts } from '../../../scripts/release-loop/gate-warm-artifacts.js';
+import { stateDirSourceForChild } from '../../agent/identity-env.js';
+import type { WarmWorkerCommand, WarmWorkerFileResult, WarmWorkerReply } from './pod-warm-worker-protocol.js';
+
+const token = (s: unknown): s is string => typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(s);
+const sha = (s: unknown): s is string => typeof s === 'string' && /^[a-f0-9]{40}$/.test(s);
+const keyValid = (key: WarmWorkerCommand['key'] | undefined): boolean => !!key && token(key.context)
+  && typeof key.imageDigest === 'string' && /^sha256:[a-f0-9]{64}$/.test(key.imageDigest)
+  && typeof key.lockHash === 'string' && /^[a-f0-9]{64}$/.test(key.lockHash)
+  && token(key.architecture);
+const testPath = (s: unknown): s is string => typeof s === 'string' && s.length < 512
+  && /^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*\/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*\.test\.tsx?$/.test(s)
+  && !s.split('/').some(part => part === '..' || part === '.');
+const withoutGitEnvironment = (): NodeJS.ProcessEnv => {
+  const env = { ...process.env };
+  for (const name of Object.keys(env)) if (name.startsWith('GIT_')) delete env[name];
+  return env;
+};
+
+export interface WarmWorkerRunFile {
+  file: string;
+  cutSha: string;
+  attemptId: string;
+  cwd: string;
+  env: NodeJS.ProcessEnv;
+  logPath: string;
+  junitPath: string;
+  deadlineAt: number;
+}
+export type WarmWorkerFileRunner = (request: WarmWorkerRunFile) => Promise<number>;
+
+/** Recheck the source bytes before every request, not only at Pod init. */
+export function warmWorkerSourceMatches(repoDir: string, cutSha: string, lockHash: string): boolean {
+  try {
+    const env = withoutGitEnvironment();
+    const git = (args: string[]) => spawnSync('git', ['-C', repoDir, ...args], { encoding: 'utf8', env, maxBuffer: 16 * 1024 * 1024 });
+    const top = git(['rev-parse', '--show-toplevel']);
+    const head = git(['rev-parse', 'HEAD']);
+    const dirty = git(['status', '--porcelain', '--untracked-files=no']);
+    // Git status deliberately trusts assume-unchanged and skip-worktree bits.
+    // A reusable Pod cannot trust those bits because tests execute worktree bytes.
+    const tracked = git(['ls-files', '-v', '-z']);
+    return top.status === 0 && realpathSync(top.stdout.trim()) === realpathSync(repoDir)
+      && head.status === 0 && head.stdout.trim() === cutSha
+      && dirty.status === 0 && dirty.stdout.trim() === ''
+      && tracked.status === 0 && tracked.stdout.split('\0').filter(Boolean).every(entry => entry.startsWith('H '))
+      && createHash('sha256').update(readFileSync(join(repoDir, 'bun.lock'))).digest('hex') === lockHash;
+  } catch { return false; }
+}
+
+export interface WarmWorkerOutcome {
+  reply: WarmWorkerReply | null;
+  /** A missing or partial result cannot enter the comparator as measured evidence. */
+  quarantineWorker: boolean;
+  reason: 'complete' | 'invalid-command' | 'missing-artifact' | 'execution-error' | 'cleanup-failed' | 'quarantined';
+  artifactsDir?: string;
+}
+
+/** One runtime serializes commands so cleanup has completed before the next test can start. */
+export class WarmWorkerRuntime {
+  private tail: Promise<unknown> = Promise.resolve();
+  private quarantined = false;
+  constructor(private readonly options: {
+    repoDir: string;
+    scratchDir: string;
+    artifactsRoot: string;
+    workerId: string;
+    runFile: WarmWorkerFileRunner;
+    removeScratch?: (path: string) => void;
+    now?: () => number;
+  }) {}
+
+  handle(command: WarmWorkerCommand): Promise<WarmWorkerOutcome> {
+    const next = this.tail.then(() => this.execute(command)).catch((): WarmWorkerOutcome => {
+      this.quarantined = true;
+      return { reply: null, quarantineWorker: true, reason: 'execution-error' };
+    });
+    this.tail = next.catch(() => undefined);
+    return next;
+  }
+
+  private async execute(command: WarmWorkerCommand): Promise<WarmWorkerOutcome> {
+    if (this.quarantined) return { reply: null, quarantineWorker: true, reason: 'quarantined' };
+    const now = this.options.now ?? Date.now;
+    if (command?.protocol !== 1 || !token(command.runId) || !token(command.attemptId)
+      || !sha(command.cutSha) || !token(command.leaseId)
+      || !token(command.workerId) || command.workerId !== this.options.workerId
+      || !Number.isSafeInteger(command.generation) || command.generation < 1
+      || !Number.isFinite(command.deadlineAt)
+      || !token(command.envProfile) || (command.baselineSha !== undefined && !sha(command.baselineSha))
+      || !keyValid(command.key)
+      || !Array.isArray(command.files) || command.files.length === 0
+      || command.files.some(file => !testPath(file)) || new Set(command.files).size !== command.files.length) {
+      return { reply: null, quarantineWorker: false, reason: 'invalid-command' };
+    }
+    if (command.deadlineAt <= now()) {
+      this.quarantined = true;
+      return { reply: null, quarantineWorker: true, reason: 'execution-error' };
+    }
+    const repo = realpathSync(this.options.repoDir);
+    if (!warmWorkerSourceMatches(repo, command.cutSha, command.key.lockHash)) {
+      this.quarantined = true;
+      return { reply: null, quarantineWorker: true, reason: 'quarantined' };
+    }
+    for (const file of command.files) {
+      let target: string;
+      try { target = realpathSync(join(repo, file)); }
+      catch { return { reply: null, quarantineWorker: false, reason: 'invalid-command' }; }
+      if (!target.startsWith(`${repo}${sep}`)) return { reply: null, quarantineWorker: false, reason: 'invalid-command' };
+      let component = repo;
+      for (const part of file.split('/')) {
+        component = join(component, part);
+        if (lstatSync(component).isSymbolicLink()) {
+          return { reply: null, quarantineWorker: false, reason: 'invalid-command' };
+        }
+      }
+      const env = withoutGitEnvironment();
+      const tracked = spawnSync('git', ['-C', repo, 'ls-files', '--error-unmatch', '--', file], { encoding: 'utf8', env, maxBuffer: 16 * 1024 * 1024 });
+      if (tracked.status !== 0 || tracked.stdout.trim() !== file) {
+        return { reply: null, quarantineWorker: false, reason: 'invalid-command' };
+      }
+    }
+    const artifactsDir = resolve(this.options.artifactsRoot, command.runId, command.attemptId,
+      command.leaseId, String(command.generation), command.workerId);
+    const artifactsRoot = resolve(this.options.artifactsRoot);
+    if (!artifactsDir.startsWith(`${artifactsRoot}${sep}`) || existsSync(artifactsDir)) {
+      return { reply: null, quarantineWorker: false, reason: 'invalid-command' };
+    }
+    mkdirSync(this.options.scratchDir, { recursive: true });
+    mkdirSync(artifactsRoot, { recursive: true });
+    mkdirSync(artifactsDir, { recursive: true, mode: 0o700 });
+    const startedAt = now();
+    const files: WarmWorkerFileResult[] = [];
+    let reason: WarmWorkerOutcome['reason'] = 'complete';
+    for (const [index, file] of command.files.entries()) {
+      if (this.quarantined) break;
+      const sandbox = mkdtempSync(join(this.options.scratchDir, 'warm-request-'));
+      const dirs = Object.fromEntries(['home', 'state', 'tmp', 'config', 'cache', 'data', 'xdg-state', 'xdg-runtime'].map(name => [name, join(sandbox, name)]));
+      for (const path of Object.values(dirs)) mkdirSync(path, { mode: 0o700 });
+      const prefix = join(artifactsDir, `file-${index}`);
+      const env: NodeJS.ProcessEnv = {
+        ...withoutGitEnvironment(), HOME: dirs.home, ELANOUS_STATE_DIR: dirs.state,
+        ELANOUS_STATE_DIR_SOURCE: stateDirSourceForChild(dirs.state), TMPDIR: dirs.tmp,
+        XDG_CONFIG_HOME: dirs.config, XDG_CACHE_HOME: dirs.cache,
+        XDG_DATA_HOME: dirs.data, XDG_STATE_HOME: dirs['xdg-state'], XDG_RUNTIME_DIR: dirs['xdg-runtime'],
+      };
+      let rc = 1;
+      try {
+        rc = await this.options.runFile({ file, cutSha: command.cutSha, attemptId: command.attemptId, cwd: this.options.repoDir, env,
+          logPath: `${prefix}.log`, junitPath: `${prefix}.junit.xml`, deadlineAt: command.deadlineAt });
+        if (rc !== 0 && rc !== 1) reason = 'execution-error';
+        writeFileSync(`${prefix}.json`, JSON.stringify({ rc, files: [file], commit: command.cutSha,
+          attemptId: command.attemptId, warmKey: command.key, jobExitCode: 0, jobFailed: false }), { mode: 0o600 });
+        writeFileSync(`${prefix}.rc`, String(rc), { mode: 0o600 });
+        if (existsSync(`${prefix}.log`) && existsSync(`${prefix}.junit.xml`)) {
+          const sha256 = (path: string) => createHash('sha256').update(readFileSync(path)).digest('hex');
+          writeFileSync(`${prefix}.warm-manifest.json`, JSON.stringify({
+            protocol: 1, cutSha: command.cutSha, attemptId: command.attemptId, file, rc,
+            logSha256: sha256(`${prefix}.log`), junitSha256: sha256(`${prefix}.junit.xml`),
+            metaSha256: sha256(`${prefix}.json`), rcSha256: sha256(`${prefix}.rc`),
+          }), { mode: 0o600 });
+        }
+        const parsed = warmReferenceFromJobArtifacts(prefix, file,
+          { cutSha: command.cutSha, attemptId: command.attemptId });
+        if (parsed) files.push(parsed);
+        else { reason = 'missing-artifact'; break; }
+      } catch {
+        reason = 'execution-error';
+        break;
+      } finally {
+        try { (this.options.removeScratch ?? ((path: string) => rmSync(path, { recursive: true } )))(sandbox); }
+        catch { this.quarantined = true; reason = 'cleanup-failed'; }
+      }
+      if (now() >= command.deadlineAt) reason = 'execution-error';
+      if (reason !== 'complete') break;
+    }
+    if (now() >= command.deadlineAt) reason = 'execution-error';
+    if (reason !== 'complete') this.quarantined = true;
+    if (reason !== 'complete' || files.length !== command.files.length) return { reply: null, quarantineWorker: true, reason, artifactsDir };
+    if (!warmWorkerSourceMatches(repo, command.cutSha, command.key.lockHash)) {
+      this.quarantined = true;
+      return { reply: null, quarantineWorker: true, reason: 'quarantined', artifactsDir };
+    }
+    const finishedAt = now();
+    if (finishedAt >= command.deadlineAt) {
+      this.quarantined = true;
+      return { reply: null, quarantineWorker: true, reason: 'execution-error', artifactsDir };
+    }
+    const reply: WarmWorkerReply = {
+      protocol: 1, runId: command.runId, attemptId: command.attemptId, cutSha: command.cutSha,
+      ...(command.baselineSha ? { baselineSha: command.baselineSha } : {}), leaseId: command.leaseId,
+      generation: command.generation, workerId: command.workerId, key: command.key,
+      envProfile: command.envProfile, startedAt, finishedAt, files,
+    };
+    writeFileSync(join(artifactsDir, 'reply.json'), JSON.stringify(reply), { mode: 0o600 });
+    if (now() >= command.deadlineAt) {
+      rmSync(join(artifactsDir, 'reply.json'));
+      this.quarantined = true;
+      return { reply: null, quarantineWorker: true, reason: 'execution-error', artifactsDir };
+    }
+    return { reply, quarantineWorker: false, reason: 'complete', artifactsDir };
+  }
+}