elanous 0.2.29 → 0.2.31

package/src/acp/core-turn-bridge.ts

@@ -43,6 +43,8 @@ import {
   type CoreTurnContext,
   type CoreTurnDispatchTool,
 } from '../core-turn/index.js';
+import { stripGoalRepeatReadbackPreface } from '../core-turn/run-goal-loop.js';
+import { parseSeatTurnCapConfig, resolveSeatTurnCap } from '../core-turn/seat-turn-cap.js';
 import { getUserConfig } from '../user-config.js';
 import { getModelFamily } from '../models/prompts.js';
 import { resolveModelContextWindow } from '../models/context-window.js';
@@ -50,7 +52,7 @@ import type { AcpServerOptions, AcpTurnContext } from './server.js';
 import { acpToolDenialResult } from './tool-approval.js';
 import { readOriginSessionMeta } from './origin-session-meta.js';
 import { isFactQuestion } from './fact-question.js';
-import { classifyTuiChatIntent, formatTuiRouteLine, type TuiChatRoute } from '../core-turn/short-question.js';
+import { classifyTuiChatIntent, formatTuiRouteLine, isSeatOpsDirective, type TuiChatRoute } from '../core-turn/short-question.js';
 import { HARNESS_ROLE_ENV } from '../harness/harness-space.js';
 
 const FACT_QUESTION_INSTRUCTION = '사실·최신 정보 질문이다. WebSearch 를 1~2회 쓰고 검색 결과(제목·스니펫·URL)로 답하라. 출처 링크를 붙여라. 셸·브라우저·파일 도구는 검색 결과로 부족할 때만. 도구 예산에 닿으면 지금까지 근거로 답하고 끝에 «더 찾아볼까요?»를 붙여라.';
@@ -64,7 +66,8 @@ type QuickTuiRoute = Exclude<TuiChatRoute, '코딩·구현' | '읽기·분석'>;
 const QUICK_TOOLS: Record<QuickTuiRoute, readonly string[]> = {
   '조회': ['decisions_pending', 'ops_seats', 'ops_status', 'release_status', 'logs_query', 'context_now', 'memory_recall', 'Read'],
   '설정 변경': ['DashboardConfigGet', 'DashboardConfigSet', 'LlmListAvailableModels', 'prompt_getRuntimeConfig', 'prompt_setRuntimeConfig', 'view_getConfig', 'view_applyRuntimeConfig', 'view_saveConfig', 'memory_recall'],
-  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall'],
+  // MsgList is a read-only ledger listing (never acks); MsgPost · MsgAck · RunShell · Bash stay out (TUI-QUICK-ROUTE-EXPLICIT-CMD).
+  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall', 'MsgList'],
   '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'session_manage', 'ops_status', 'memory_recall'],
 };
 
@@ -133,6 +136,9 @@ export interface CoreTurnBridgeDeps {
   abortPollMs?: number;
   /** Only the in-process dashboard session opts into TUI routing; daemon ACP stays unchanged. */
   tuiRouting?: boolean;
+  /** TUI-H1-SEAT-GOALLOOP — the seat this TUI works for (`detectSeatTui`), read per turn. null/absent = a human
+   *  conversation TUI (routing unchanged). A seat TUI sends operational directives to the goal loop. */
+  resolveSeat?: () => string | null;
 }
 
 /** Default abort-poll cadence. 50ms = 20 Hz: responsive without
@@ -228,16 +234,24 @@ export function bridgeCoreTurnToAcp(
       // Only a goal-driven harness child (explicit executor role — dev-harness · self-implement surfaces) keeps every
       // turn on the goal loop. A human TUI inside a harness space (one-word `dev --elanous`, `--hold`) is routed (UX 10-07).
       const harness = process.env[HARNESS_ROLE_ENV]?.trim() === 'executor';
+      // seatKnown=false: no resolver (or it threw) — routed as a human TUI, but the log keeps «unknown», not «not a seat».
+      let seat: string | null = null;
+      let seatKnown = false;
+      if (deps.tuiRouting && !harness && deps.resolveSeat) {
+        try { seat = deps.resolveSeat(); seatKnown = true; }
+        catch (error) { debug.log('chat.route', 'seat-unresolved', { error: String(error) }, { level: 'warn' }); }
+      }
       const route = deps.tuiRouting && !harness
         ? classifyTuiChatIntent(turnCtx.userText, {
             hasAttachments: turnCtx.promptBlocks?.some((block) => block.type !== 'text') ?? false,
+            seat: seat !== null,
           })
         : { route: '코딩·구현' as const, reason: harness ? 'harness' : 'legacy', goalLoop: true };
       const tools = !route.goalLoop && route.route !== '코딩·구현' && route.route !== '읽기·분석'
         ? toolsForTuiRoute(availableTools, route.route)
         : availableTools;
       if (deps.tuiRouting) {
-        debug.log('chat.route', 'decided', { route: route.route, reason: route.reason, goalLoop: route.goalLoop });
+        debug.log('chat.route', 'decided', { route: route.route, reason: route.reason, goalLoop: route.goalLoop, seat, seatKnown });
         // Only a quick route is announced: a coding turn's transcript stays exactly as before (preservation).
         // Awaited so the route line precedes the answer; a failed write is observed, not fatal to the turn.
         if (!route.goalLoop) {
@@ -253,6 +267,17 @@ export function bridgeCoreTurnToAcp(
       // 하드코딩 기본 ON 아님 — config 로 아밍(안전).
       const goalLoopCfg = getUserConfig().llm.goalLoop;
       const armGoalLoop = goalLoopCfg?.enabled === true && route.goalLoop;
+      // 인지(TUI-H1-SEAT-GOALLOOP) — 자리 TUI 의 운영 지시가 그래도 단일 턴이면(예: llm.goalLoop 꺼짐) 경고로 남긴다.
+      // 빠른 짧은 물음(short-*)은 자리에서도 «의도적» 단일 턴이라 경고에서 뺀다(«다음 행이 뭐야?»).
+      if (deps.tuiRouting && seat !== null && !armGoalLoop && !route.reason.startsWith('short-')
+        && isSeatOpsDirective(turnCtx.userText)) {
+        try {
+          debug.log('chat.route', 'seat-ops-single-turn', {
+            seat, route: route.route, reason: route.reason, goalLoop: route.goalLoop,
+            goalLoopEnabled: goalLoopCfg?.enabled === true,
+          }, { level: 'warn' });
+        } catch { /* observation cannot interrupt a turn */ }
+      }
       // 사실 질문 예산은 «단일 턴» 전용이다 — goal loop 와 겹치면 예산을 다 쓴 뒤에도 루프가 계속 재촉해
       // 매 continuation 이 «Tool budget reached» 로 거부되고, 모델은 그것을 도구 장애로 읽어 blocked 를 남긴다
       // (10-14 13:48 운영 TUI OP: route short-question·goalLoop ⊕ factQuestion → 소진 뒤 헛호출 7회).
@@ -307,10 +332,17 @@ export function bridgeCoreTurnToAcp(
           safeguard: 'context-pressure-bail',
         });
       }
+      // TUI-SEAT-TURN-CAP — 자리 판정으로 goal loop 에 온 턴만 core 턴 상한·«할 일 0» 판정을 받는다(사람 TUI·하니스 자식 0).
+      const seatTurnCap = armGoalLoop && seat !== null && route.reason.startsWith('seat-')
+        ? { seat, ...resolveSeatTurnCap(parseSeatTurnCapConfig(getUserConfig().chat?.seatTurnCap)) }
+        : undefined;
       const runTurnDispatch = (c: CoreTurnContext): Promise<unknown> =>
         armGoalLoop
           ? runGoalLoop(c, {
               ...(goalLoopCfg?.maxIterations !== undefined ? { maxIterations: goalLoopCfg.maxIterations } : {}),
+              // #29 처방 — 자리 판정으로 goal loop 에 «되돌아온» 턴만 빈 evidence 완료를 답으로 받는다.
+              ...(route.reason.startsWith('seat-') ? { lenientCompletionEvidence: true } : {}),
+              ...(seatTurnCap !== undefined ? { seatTurnCap } : {}),
               ...(goalCtxWindow > 0 ? { contextTokenLimit: goalCtxWindow } : {}),
             })
           : runCoreTurn(c);
@@ -462,10 +494,19 @@ export function bridgeCoreTurnToAcp(
             const visibleFinalText = needsFollowup ? extractLastAssistantText(completedMessages) : finalAssistantText;
             const originalFinalStreamed = needsFollowup && finalAssistantText !== null
               && streamedTextSum.endsWith(finalAssistantText);
+            // TUI-GOAL-REPEAT-ANSWER — 골 루프가 «인사 + 같은 답» 재방출을 화면에서 가리면(원장은 그대로)
+            // 브리지의 스트림 합계에는 그 답이 없다. 그대로 보면 «마지막 답을 못 그렸다»고 재표면화로 다시
+            // 그린다 — 이전 답이 이미 화면에 있는데도. 인사를 뗀 답 부분이 스트림 꼬리에 있으면 «그렸다»로
+            // 본다(골 루프 경로에서만 — 다른 경로의 판정은 그대로).
+            const goalRepeatStrippedFinalText = armGoalLoop && visibleFinalText !== null
+              ? stripGoalRepeatReadbackPreface(visibleFinalText)
+              : visibleFinalText;
             const synthesisAlreadyStreamed =
               visibleFinalText !== null
               && visibleFinalText.length > 0
-              && streamedTextSum.endsWith(visibleFinalText);
+              && (streamedTextSum.endsWith(visibleFinalText)
+                || (goalRepeatStrippedFinalText !== null && goalRepeatStrippedFinalText.length > 0
+                  && streamedTextSum.endsWith(goalRepeatStrippedFinalText)));
             // ⭐ 최종 답 = 모델 답 ⊕ 런타임 검증 보충이면 사용자에겐 «모델 답»만 보인다 — 보충은 로그로(#25).
             //   대화 이력(completedMessages)엔 그대로 남아 다음 턴 맥락은 바뀌지 않는다.
             const supplement = finalSupplement !== null && finalAssistantText === finalSupplement.finalText
@@ -491,7 +532,11 @@ export function bridgeCoreTurnToAcp(
               });
             }
             if (supplement !== null) {
-              const answerStreamed = supplement.answer.length > 0 && streamedTextSum.trimEnd().endsWith(supplement.answer);
+              // TUI-GOAL-REPEAT-ANSWER — 위와 같은 이유: 인사를 뗀 답 부분이 스트림 꼬리에 있으면 그렸다(골 루프만).
+              const answerStreamed = supplement.answer.length > 0
+                && (streamedTextSum.trimEnd().endsWith(supplement.answer)
+                  || (armGoalLoop
+                    && streamedTextSum.trimEnd().endsWith(stripGoalRepeatReadbackPreface(supplement.answer))));
               try {
                 // 보충 «전체»를 남긴다 — 한 행이 저장 전에 잘리지 않게 조각(part/parts)으로 나눈다(리뷰 r3·r4).
                 const redacted = redactSecretText(supplement.supplement);

package/src/ad-pipeline/run.ts

@@ -223,6 +223,8 @@ export interface AdProductionDeps {
   readonly render?: CommandRunner;
   /** Optional calibrated thresholds; omitted thresholds intentionally preserve unmeasured QC findings. */
   readonly qcThresholds?: QcThresholds;
+  /** Platform that decides whether on-screen text OCR (macOS Vision via swiftc) is planned; defaults to `process.platform`. */
+  readonly qcPlatform?: NodeJS.Platform;
 }
 
 export interface AdOutputIdentity {
@@ -828,7 +830,7 @@ async function runQc(
   captionedMasterPath?: string,
 ): Promise<QcResult | undefined> {
   if (!production?.render || !scene || !masterPath) return undefined;
-  const { measurements, unavailableTextRegions } = await measureQc(production, buildQcMeasurementPlan(scene, masterPath));
+  const { measurements, unavailableTextRegions } = await measureQc(production, buildQcMeasurementPlan(scene, masterPath, production.qcPlatform ?? process.platform));
   if (unavailableTextRegions !== undefined) {
     debug.log('ad-pipeline.qc', 'text-regions-unavailable', { reason: unavailableTextRegions });
   }
@@ -851,7 +853,7 @@ async function runQc(
     debug.log('ad-pipeline.qc', 'captioned-master-absent', { reason: !captionedMasterPath ? 'captioned-master-unavailable' : 'no-caption-lines' });
     return baseResult;
   }
-  const captionedPlan = buildQcMeasurementPlan(scene, captionedMasterPath, process.platform, {
+  const captionedPlan = buildQcMeasurementPlan(scene, captionedMasterPath, production.qcPlatform ?? process.platform, {
     textFrameAtSeconds: (line.startMs + line.endMs) / 2000,
   });
   const captionedMeasurement = await measureQc(production, captionedPlan, (step) => step === 'probe' || step.startsWith('text-'));

package/src/agent/runner.ts

@@ -13,6 +13,9 @@
 // generator terminates instead of hanging.
 
 import {
+  inferProviderFromModel,
+  isModelCompatible,
+  resolveDefaultProvider,
   streamLLMWithTools,
   type LLMMessage,
   type LLMToolSpec,
@@ -20,6 +23,7 @@ import {
 import { debug } from '../debug/log.js';
 import { buildUniversalPreamble } from '../prompt-library/universal-preamble.js';
 import { getModelFamily } from '../models/prompts.js';
+import { resolveModelAlias } from '../intelligence-map/model-alias.js';
 import type {
   AgentDefinition, AgentEvent, AgentSpawnOpts, AgentTask,
 } from './types.js';
@@ -57,6 +61,151 @@ class AsyncEventQueue<T> {
   }
 }
 
+// ── Model resolution (TUI-AGENT-MODEL-FALLBACK · 결함 #34) ──
+//
+// A definition's frontmatter `model:` is a REQUEST, not a guarantee. The
+// runner must check it against the provider the child will actually run
+// on BEFORE handing it to streamLLMWithTools — a codex parent used to
+// request `haiku` verbatim and die (the provider chain re-routed the
+// Claude-family id to Anthropic, 결함 #34, 2026-10-14).
+//
+// `model: undefined` in the result means "inherit the parent": the child
+// then rides streamLLMWithTools's own provider decision
+// (`opts.provider ?? resolveDefaultProvider(opts.model)`), exactly like a
+// spawn with no model hint at all.
+
+/** Why resolveAgentModel returned the model it did. Six distinct exits —
+ *  never collapse them into one value: "fell back to parent" and "sent an
+ *  unrecognized id verbatim" must stay separable in the logs. */
+export type AgentModelResolutionReason =
+  | 'no-definition-model'
+  | 'declared-inherit'
+  | 'definition'
+  | 'incompatible-provider'
+  | 'unknown-model'
+  | 'provider-unknown';
+
+export interface AgentModelResolution {
+  /** Canonical model id; undefined = inherit the parent's model. */
+  model: string | undefined;
+  reason: AgentModelResolutionReason;
+}
+
+/** Injection seams so tests can pin the provider / inference without
+ *  touching user config. Defaults are the production functions. */
+export interface ResolveAgentModelDeps {
+  currentProviderName: () => string;
+  isCompatible: (providerName: string, model: string) => boolean;
+  inferProvider: (model: string) => string | null;
+}
+
+/** Production `currentProviderName` — the provider a model-less spawn
+ *  would run on right now (the parent-configured default). A lookup
+ *  failure is NOT hidden behind a made-up name: it throws, and
+ *  resolveAgentModel turns it into the separate `provider-unknown` exit
+ *  (judging compatibility against a fake name like 'auto' would drop a
+ *  usable definition model to inherit). */
+function productionCurrentProviderName(): string {
+  return resolveDefaultProvider().name;
+}
+
+const defaultResolveAgentModelDeps: ResolveAgentModelDeps = {
+  currentProviderName: productionCurrentProviderName,
+  isCompatible: isModelCompatible,
+  inferProvider: inferProviderFromModel,
+};
+
+/** Resolve a definition model against the provider the child would run
+ *  on RIGHT NOW. Decision order — each step guards the next:
+ *    1. no model → { undefined, 'no-definition-model' }
+ *    2. `inherit` (trimmed, case-insensitive; an inheritance MARKER, not
+ *       a model name) → { undefined, 'declared-inherit' }
+ *    3. resolveModelAlias → canonical id
+ *    4. inferProvider(canonical) === null → { canonical, 'unknown-model' }
+ *       — do NOT fall back: free-form names ride the provider as-is
+ *       (isModelCompatible's "unknown prefix is the provider's problem"
+ *       stance; dropping a local free-form name to inherit is a regression)
+ *    5. isCompatible(currentProviderName, canonical)
+ *       true  → { canonical, 'definition' }
+ *       false → { undefined, 'incompatible-provider' } (parent fallback)
+ *       currentProviderName throws → { undefined, 'provider-unknown' } —
+ *       compatibility cannot be judged, so the definition model is NOT
+ *       sent (sending it could re-route the provider by model name); the
+ *       child inherits the parent model — the goal's «can't call it →
+ *       parent model» intent, kept as its own reason so a lookup failure
+ *       is never confused with a real incompatibility
+ *
+ *  Inference (4) runs BEFORE compatibility (5) because isModelCompatible
+ *  returns true on null inference — checking compatibility first would
+ *  mislabel every unknown model as compatible and the unknown-model exit
+ *  would be unreachable. */
+export function resolveAgentModel(
+  defModel: string | undefined,
+  deps: Partial<ResolveAgentModelDeps> = {},
+): AgentModelResolution {
+  const d: ResolveAgentModelDeps = { ...defaultResolveAgentModelDeps, ...deps };
+  if (defModel === undefined || defModel.trim() === '') {
+    return { model: undefined, reason: 'no-definition-model' };
+  }
+  const trimmed = defModel.trim();
+  if (trimmed.toLowerCase() === 'inherit') {
+    return { model: undefined, reason: 'declared-inherit' };
+  }
+  const canonical = resolveModelAlias(trimmed) ?? trimmed;
+  if (d.inferProvider(canonical) === null) {
+    return { model: canonical, reason: 'unknown-model' };
+  }
+  let providerName: string;
+  try {
+    providerName = d.currentProviderName();
+  } catch {
+    return { model: undefined, reason: 'provider-unknown' };
+  }
+  if (d.isCompatible(providerName, canonical)) {
+    return { model: canonical, reason: 'definition' };
+  }
+  return { model: undefined, reason: 'incompatible-provider' };
+}
+
+/** Resolve + record exactly one `agent.model` observation. Every runtime
+ *  resolution goes through here (runAgent ⊕ a direct buildAgentMessages call
+ *  without a pre-resolved `model`) so «one observation per resolution» holds
+ *  on both paths. incompatible-provider (parent fallback), unknown-model
+ *  (verbatim pass-through of an unrecognizable id) and provider-unknown
+ *  (provider lookup failed, inherited the parent unjudged) are the exits an
+ *  operator must tell apart from a log line alone — they get warn level. */
+function resolveAgentModelObserved(
+  def: Pick<AgentDefinition, 'name' | 'model'>,
+  pinnedProviderName?: string,
+): AgentModelResolution {
+  let providerError: string | undefined;
+  let currentProviderName: string | undefined = pinnedProviderName;
+  const resolution = resolveAgentModel(def.model, {
+    currentProviderName: () => {
+      if (currentProviderName !== undefined) return currentProviderName;
+      try {
+        currentProviderName = productionCurrentProviderName();
+        return currentProviderName;
+      } catch (error) {
+        providerError = error instanceof Error ? error.message : String(error);
+        throw error;
+      }
+    },
+  });
+  debug.log('agent.model', 'resolved', {
+    agent: def.name,
+    declared: def.model,
+    model: resolution.model,
+    reason: resolution.reason,
+    provider: currentProviderName ?? null,
+    ...(providerError !== undefined ? { providerError } : {}),
+  }, resolution.reason === 'incompatible-provider' || resolution.reason === 'unknown-model'
+    || resolution.reason === 'provider-unknown'
+    ? { level: 'warn' as const }
+    : undefined);
+  return resolution;
+}
+
 // ── Helpers ──
 
 /** Assemble the initial message history. The parent's rendered system
@@ -74,7 +223,7 @@ export function buildAgentMessages(
   def: AgentDefinition,
   prompt: string,
   systemPromptPrefix?: string,
-  ctx: { cwd?: string; enabledTools?: readonly string[] } = {},
+  ctx: { cwd?: string; enabledTools?: readonly string[]; model?: string } = {},
 ): LLMMessage[] {
   let effectivePrefix: string | undefined = systemPromptPrefix;
   if (def.omitInheritedContext) {
@@ -108,7 +257,15 @@ export function buildAgentMessages(
   // omitInheritedContext contract stable we honor it strictly.
   let universalPreamble: LLMMessage[] = [];
   if (!def.omitInheritedContext && ctx.cwd) {
-    const agentModelFamily = def.model ? getModelFamily(def.model) : undefined;
+    // TUI-AGENT-MODEL-FALLBACK: the preamble's modelFamily must track the
+    // model the run will actually use. runAgent passes the already-resolved
+    // model (one resolution + one `agent.model` observation per spawn);
+    // direct callers that omit `model` resolve here so a definition model
+    // the current provider can't run never reaches the preamble either.
+    const effectiveModel = 'model' in ctx
+      ? ctx.model
+      : resolveAgentModelObserved(def).model;
+    const agentModelFamily = effectiveModel ? getModelFamily(effectiveModel) : undefined;
     universalPreamble = buildUniversalPreamble({
       cwd: ctx.cwd,
       ...(agentModelFamily !== undefined ? { modelFamily: agentModelFamily } : {}),
@@ -206,6 +363,14 @@ export async function* runAgent(
   // `Agent` → search-vs-spawn split, `TaskCreate` → don't batch).
   const tools = filterAgentTools(opts.tools, task.definition.tools);
 
+  // TUI-AGENT-MODEL-FALLBACK (결함 #34): resolve the definition model
+  // against the provider the child will ACTUALLY run on — the pinned
+  // `opts.provider` when the dispatcher chose one, otherwise the
+  // parent-configured default (what streamLLMWithTools picks for a
+  // model-less spawn). `model: undefined` = inherit: the child then takes
+  // the same provider/model decision path as the parent.
+  const modelResolution = resolveAgentModelObserved(task.definition, opts.provider?.name);
+
   // Build history on the task so callers can inspect it after the run.
   // PFC-S1 P5: pass task.cwd so the slim-context notice (when
   // omitInheritedContext) can name the child's working directory.
@@ -214,6 +379,7 @@ export async function* runAgent(
     task.prompt,
     opts.systemPromptPrefix,
     {
+      model: modelResolution.model,
       ...(task.cwd ? { cwd: task.cwd } : {}),
       ...(tools ? { enabledTools: tools.map(t => t.name) } : {}),
     },
@@ -252,7 +418,7 @@ export async function* runAgent(
       dispatchTool,
     },
     {
-      model: task.definition.model,
+      model: modelResolution.model,
       tools,
       signal: task.controller.signal,
       provider: opts.provider,

package/src/agent/subagent-callable.ts

@@ -132,7 +132,7 @@ export function createGlobalSubagentCallable(
     const done = drainToResult(handle.events, () => ({
       durationMs: Date.now() - startedAt,
       modelId: effectiveDefinition.model,
-    }));
+    }), () => handle.task.controller?.signal.aborted ?? (signal?.aborted === true));
 
     return { address, done };
   };
@@ -154,6 +154,7 @@ async function drainToResult(
     unknown
   >,
   closing: () => { durationMs: number; modelId?: string },
+  signalAborted: () => boolean,
 ): Promise<{
   status: 'completed' | 'failed' | 'cancelled';
   output: string;
@@ -190,7 +191,7 @@ async function drainToResult(
 
   const close = closing();
   const baseModel = close.modelId ? { modelId: close.modelId } : {};
-  if (aborted) {
+  if (aborted || signalAborted()) {
     return { status: 'cancelled', output: accumulated, durationMs: close.durationMs, ...baseModel };
   }
   if (errorMsg !== null) {

package/src/agent-mission/review-loop.ts

@@ -361,9 +361,12 @@ export function extractAppliedReviewItems(comments: readonly NonNullable<LatestR
 /** 브랜치의 열린 PR 코멘트에서 이전 self-dev 반영분을 fail-soft로 읽는다. */
 export function fetchAppliedReviewItemsForBranch(branch: string, runGh: (args: string[]) => string = gh): AppliedReviewItems {
   try {
-    const raw = runGh(['pr', 'view', branch, '--json', 'comments']);
-    const source = JSON.parse(raw) as LatestReviewSource;
-    const signals = filterReviewSignals(source);
+    // A Pod repair uses the synthetic worktree base `pr-N`; GitHub knows that
+    // source by PR number, not by the synthetic branch name.
+    const source = /^pr[:-]([1-9]\d*)$/.exec(branch)?.[1] ?? branch;
+    const raw = runGh(['pr', 'view', source, '--json', 'comments']);
+    const reviewSource = JSON.parse(raw) as LatestReviewSource;
+    const signals = filterReviewSignals(reviewSource);
     return { basePrLocated: true, ...analyzeAppliedReviewItems(signals.selfAuthoredComments) };
   } catch {
     return { basePrLocated: false, items: [], headlineComments: 0 };

package/src/agent-substrate/acp-implementer.ts

@@ -85,6 +85,18 @@ export interface AcpImplementerResult {
 
 const OBS = 'agent-substrate.acp-implementer';
 
+/** Claude ACP's default preset imports user/project plugins and MCP servers into every
+ * prompt snapshot. The implementation child only needs the built-in coding tools. */
+export const CLAUDE_IMPLEMENTER_META = {
+  claudeCode: { options: {
+    tools: ['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep'],
+    settingSources: [],
+    plugins: [],
+    mcpServers: {},
+    strictMcpConfig: true,
+  } },
+} as const;
+
 export function makeAcpImplementer(opts: AcpImplementerOpts): (prompt: string) => Promise<AcpImplementerResult> {
   return async (prompt) => {
     const spawn = subscriptionReviewerSpawn(opts.spec ?? { provider: 'claude-acp' }, opts.env ?? process.env, opts.proxyBaseUrl);
@@ -119,10 +131,10 @@ export function makeAcpImplementer(opts: AcpImplementerOpts): (prompt: string) =
       await withinHandshake(agent.start());
       let sid: string;
       if (opts.resumeSessionId) {
-        await withinHandshake(agent.loadSession({ sessionId: opts.resumeSessionId, cwd: opts.worktree }));
+        await withinHandshake(agent.loadSession({ sessionId: opts.resumeSessionId, cwd: opts.worktree, _meta: CLAUDE_IMPLEMENTER_META }));
         sid = opts.resumeSessionId;
       } else {
-        sid = await withinHandshake(agent.newSession());
+        sid = await withinHandshake(agent.newSession(CLAUDE_IMPLEMENTER_META));
       }
       if (opts.model) await withinHandshake(agent.selectSessionModel(sid, opts.model));
       debug.log(OBS, 'start', { cwd: opts.worktree, model: opts.model ?? '(default)', resumed: Boolean(opts.resumeSessionId) });

package/src/agent-substrate/pr-reviewer.ts

@@ -652,6 +652,17 @@ export function buildReviewPrompt(
  *  `none of the tests …`. 표지 낱말로 시작하는 실제 블로커를 지우면 PASS/WARN 리뷰에서 블로커가 사라진다. */
 const NONE_WORD = String.raw`(?:없음|해당\s*없음|n\/a|none|nothing)`;
 const BARE_SENTINEL = new RegExp(String.raw`^${NONE_WORD}\s*[.。]?$`, 'i');
+// GLM 은 비어 있는 mustFix 항목이나 괄호 안의 한 문장으로 무소견을 적는다.
+// 괄호 전체만 검사한다. 중간에 "no blockers" 가 있어도 뒤에 지적이 이어지면 버리지 않는다.
+const BRACKETED_PLACEHOLDER = /^[（(]\s*([\s\S]*?)\s*[）)]$/;
+const PLACEHOLDER_ONLY = /^(?:없음|해당\s*없음|none|n\/a|no\s+blockers?)$/i;
+const PLACEHOLDER_END = /(?:블로커|차단)\s*없음$|no\s+blockers?$/i;
+function isBracketedPlaceholder(text: string): boolean {
+  const bracketed = BRACKETED_PLACEHOLDER.exec(text);
+  if (!bracketed) return false;
+  const inside = bracketed[1]!.trim().replace(/(?:\s*(?:…|\.{2,}|[.。]))+\s*$/, '').trim();
+  return PLACEHOLDER_ONLY.test(inside) || PLACEHOLDER_END.test(inside);
+}
 const DASH_ONLY_SENTINEL = /^[([（【]\s*[-—–]\s*[)\]）】]$/;
 // 목록 항목의 바깥 `- `와 별개로, 리뷰어가 괄호 안에도 장식 대시를 둘 수 있다: `- (- 없음 -)`.
 const DASH_WRAPPED_BRACKETED_SENTINEL = new RegExp(String.raw`^[([（【]\s*(?:[-—–]+\s*)?${NONE_WORD}\s*(?:[-—–]+\s*)?[)\]）】]$`, 'i');
@@ -685,6 +696,7 @@ function isLongNoFindingBracket(text: string): boolean {
  *  ⭐ export — `parseReviewResultOutput` 가 «같은» 판정으로 저장된 결과의 표지 줄을 다시 접는다(PR-LAND-MUSTFIX-NONE · 복제 금지). */
 export function isNoneSentinelFinding(finding: string): boolean {
   const text = finding.trim();
+  if (!text || isBracketedPlaceholder(text)) return true;
   if (/^[-—–]+$/.test(text)) return true;
   const markerText = text.replace(/^[—–-]+\s*|\s*[—–-]+$/g, '').trim();
   if (markerText && (BARE_SENTINEL.test(markerText) || DASH_ONLY_SENTINEL.test(markerText) || DASH_WRAPPED_BRACKETED_SENTINEL.test(markerText))) return true;

package/src/agent-substrate/self-review-cli.ts

@@ -1125,6 +1125,24 @@ function roleAcpErrorReason(error: unknown): 'acp-handshake-timeout' | 'acp-erro
 
 type AcpFallbackSkip = { backend: string; reason: string };
 
+function validateReviewDenyBackends(value: unknown, now: number): string[] | null {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) return null;
+  const denied: string[] = [];
+  for (const entry of value) {
+    if (typeof entry === 'string' && entry.trim()) { denied.push(entry); continue; }
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return null;
+    const item = entry as Record<string, unknown>;
+    if (Object.keys(item).some((key) => key !== 'backend' && key !== 'expiresAt')
+      || typeof item.backend !== 'string' || !item.backend.trim()
+      || typeof item.expiresAt !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(item.expiresAt)
+      || !Number.isFinite(Date.parse(item.expiresAt)) || new Date(item.expiresAt).toISOString().slice(0, 19) !== item.expiresAt.slice(0, 19)
+      || Date.parse(item.expiresAt) <= now) return null;
+    denied.push(item.backend);
+  }
+  return denied;
+}
+
 function orderedAcpReviewFallbackBackends(configuredBackend: string | undefined, denyBackends: readonly string[] = []): {
   backends: string[];
   skipped: AcpFallbackSkip[];
@@ -1294,10 +1312,17 @@ async function runSelfReviewCliCommandPinned(
   const acpBackend = acpBackendResolution.backend;
   const requestedModel = opts.model?.trim() || undefined;
   const rawReviewDenyBackends = (getUserConfig().raw?.acp as { reviewDenyBackends?: unknown } | undefined)?.reviewDenyBackends;
-  const configuredReviewDenyBackends = Array.isArray(rawReviewDenyBackends)
-    ? rawReviewDenyBackends.filter((backend): backend is string => typeof backend === 'string')
-    : [];
-  const automaticFallbacks = orderedAcpReviewFallbackBackends(opts.configuredAcpBackend, opts.reviewDenyBackends ?? configuredReviewDenyBackends);
+  const denyCheckedAt = Date.now();
+  const configuredReviewDenyBackends = validateReviewDenyBackends(rawReviewDenyBackends, denyCheckedAt);
+  const reviewDenyBackends = validateReviewDenyBackends(opts.reviewDenyBackends, denyCheckedAt);
+  if (configuredReviewDenyBackends === null || reviewDenyBackends === null) {
+    const message = 'acp.reviewDenyBackends 설정이 유효하지 않거나 만료됐습니다 — 리뷰를 실행하지 않습니다.';
+    deps.log('review-deny-invalid', { reason: 'invalid-or-expired-review-deny-backends' }, { level: 'warn' });
+    deps.error(message);
+    return { results: opts.json ? [{ error: message }] : [], failed: 1 };
+  }
+  const automaticFallbacks = orderedAcpReviewFallbackBackends(opts.configuredAcpBackend,
+    opts.reviewDenyBackends === undefined ? configuredReviewDenyBackends : reviewDenyBackends);
   const fallbackAcpBackends = opts.acpBackend
     ? [canonicalizeBackendId(opts.acpBackend)]
     : automaticFallbacks.backends;
@@ -1632,6 +1657,7 @@ async function runSelfReviewCliCommandPinned(
     const reviewProvenance = {
       reviewRoute,
       fallbackAttempted,
+      ...(requestedModel ? { requestedModel } : {}),
       ...(fallbackBackend ? { fallbackBackend } : {}),
       ...(fallbackBackend ? { requestedModel: primaryModel, actualBackend: `acp:${fallbackBackend}` } : {}),
       ...(fallbackNotAttemptedReason ? { fallbackNotAttemptedReason } : {}),