elanous 0.2.31 → 0.2.34

package/src/task-agent/task-hand.ts

@@ -10,7 +10,7 @@
 import { execFileSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, statSync, writeFileSync, type Stats } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, posix, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parse as parseYaml } from 'yaml';
 import { validateUnitCalls } from '../graph-runner/runner.js';
@@ -28,6 +28,10 @@ import { applyRunIdentityTag, applyRunIdentityTags, deriveBirthIdentity, parseRu
 import { parseWorkOrder, renderWorkOrderGoal, WORK_ORDER_FILE_PATTERN, type WorkOrder } from './work-order.js';
 import { inspectPrelaunchAlreadyDone, type AlreadyDoneDecision, type AlreadyDoneCandidate,
   type PrelaunchGitRunnerForTest } from './prelaunch-already-done.js';
+import { draftReleaseComment } from '../self-dev/draft-triage-rules.js';
+import { parseAskTargetPathHints, parseAskTargetPathHintsResult } from '../self-dev/launch-preflight-text.js';
+import { inspectGoalDoneBoundary } from '../self-implement/goal-author.js';
+import { INFLIGHT_REGISTRY_FILE, registerInflight } from '../pr-tool/inflight-registry.js';
 
 export interface ResolveHandTextDeps {
   cwd: string;
@@ -207,6 +211,8 @@ export interface TaskCardMove { kind: 'launch' | 'wait'; command?: string[]; rea
 export interface TaskCard {
   id: string;
   text: string;
+  /** 첫 줄 대상 경로 라벨에서 확인한 저장소 상대 경로. 필드 부재는 경로를 모른다는 뜻이다. */
+  targetPaths?: string[];
   seat?: TaskSeat;
   checklistId?: string;
   /** Explicit release version for an adopted PR; post-land still confirms the cell exists there. */
@@ -228,8 +234,11 @@ export interface TaskCard {
    * launch-failed = 발사기가 띄우기에 실패했다(사유는 history 마지막 칸) — 다음 수는 다시 발사.
    * failed = 발사된 런이 PR·수확 가지 없이 죽었거나 끝내 안 떴다(TA-JUDGE-DEAD-RUN · `card-evidence.ts`) — 사유
    * (`failed/needs-owner|needs-relaunch — …`)는 history 마지막 칸 · 자동 재발사하지 않는다(사람/판단부 몫).
+   * landed-by-hand = 실패 카드에 묶인 PR을 사람이 손수 병합해 main 에 안착시켰다(TA-CARD-MERGE-RECONCILE ·
+   * `postland-card.ts` `reconcileHandMergedCard`) — 이전 status·사유는 history `hand-move` 줄에 보존된다.
+   * landed = 병합된 merge 커밋이 카드의 land attempt head 와 정확히 일치해 에이전트 착지로 확정했다(같은 정산 경로).
    */
-  status: 'handed' | 'launched' | 'launch-failed' | 'failed' | 'done';
+  status: 'handed' | 'launched' | 'launch-failed' | 'failed' | 'landed-by-hand' | 'landed' | 'done';
   history: TaskCardEvent[];
   /** 미션 카드만 — 조각 카드 id(순서대로) · 쪼갠 출처(`mission.ts` splitMission). */
   pieces?: string[];
@@ -289,7 +298,7 @@ export interface TaskCard {
    * REJUDGE base-stale — `base-stale` (overlap evidence gate base went stale with PR-file overlap) waits for a re-gate on a new base;
    * only after that re-gate passes is the attempt consumed (`openLandAttempts`) and the same head may land once more.
    */
-  landAttempts?: Array<{ pr: number; head: string; at: string; ok?: boolean; detail?: string; class?: 'infra' | 'judgement' | 'base-stale'; reason?: string }>;
+  landAttempts?: Array<{ pr: number; head: string; at: string; ok?: boolean; detail?: string; class?: 'infra' | 'judgement' | 'base-stale' | 'recovery'; reason?: string }>;
   /** TA-LIVE-LAND-2 — `tasks hand --ta-land`: this card's run leaves the merge to the task agent (propose-land). */
   taLand?: true;
   /** TASKS-HAND-CHILD-LLM — `tasks hand --child-llm <provider>/<model> [--child-llm-effort <level>]` → 발사 인자 `--child-llm-provider/-model/-effort`. */
@@ -338,6 +347,16 @@ export function boundPrTerminal(card: Pick<TaskCard, 'pr' | 'prTerminal'>): Task
   return marker && typeof card.pr === 'object' && card.pr.number === marker.pr && card.pr.url === marker.url ? marker : undefined;
 }
 
+/**
+ * DRAFT-CLAIM-AUTO-2 — 포기 경로(failed · launch-failed)로 끝난 카드가 PR 을 남겼으면 그 PR 에 달 «🔧 처리 끝» 문면.
+ * 이 조각은 순수 함수만 — 실제 PR 코멘트(gh) · draft-sweep 배선은 다음 조각. launched · handed · PR 없음은 null.
+ */
+export function abandonedDraftReleaseNote(card: Pick<TaskCard, 'id' | 'status' | 'pr'>, at: Date): { pr: number; body: string } | null {
+  if (card.status !== 'failed' && card.status !== 'launch-failed') return null;
+  const pr = cardPrNumber(card);
+  return pr === undefined ? null : { pr, body: draftReleaseComment(at, `${card.id} 포기 경로 — 자동`) };
+}
+
 /** A uniquely launched code-PR card may own a draft through its PR or its opening run. */
 export function draftTaskOwner(cards: readonly TaskCard[], draft: { number: number; runId?: string | null }): TaskCard | undefined {
   const owners = cards.filter((card) => card.status === 'launched' && (card.completion ?? 'code-pr') === 'code-pr'
@@ -421,6 +440,25 @@ export function readTaskCard(id: string, path = taskAgentStatePath()): TaskCard
   return readState(path).tasks?.[id];
 }
 
+function canonicalTargetPaths(paths: readonly string[]): string[] {
+  return [...new Set(paths.filter((path): path is string => typeof path === 'string').map((path) => posix.normalize(path))
+    .filter((path) => path !== '.' && path !== '..' && !posix.isAbsolute(path)
+      && !path.startsWith('../') && !path.includes('\\') && !/^[A-Za-z]:\//.test(path)))].sort();
+}
+
+/** 같은 저장소 경로를 만지는 착지 전 카드만 돌려준다. 경로 미기록 카드는 추측하지 않는다. */
+export function cardsTouchingPaths(cards: readonly TaskCard[], paths: readonly string[]): Array<{
+  card: TaskCard; checklistId?: string; runId?: string; pr?: number; paths: string[];
+}> {
+  const wanted = new Set(canonicalTargetPaths(paths));
+  if (wanted.size === 0) return [];
+  return cards.filter((card) => card.status === 'launched' && !card.postLand && !card.trainLanding && !card.prTerminal)
+    .map((card) => ({ card, paths: canonicalTargetPaths(card.targetPaths ?? []).filter((path) => wanted.has(path)) }))
+    .filter((item) => item.paths.length > 0)
+    .map(({ card, paths }) => ({ card, ...(card.checklistId ? { checklistId: card.checklistId } : {}),
+      ...(card.runId ? { runId: card.runId } : {}), ...(cardPrNumber(card) !== undefined ? { pr: cardPrNumber(card) } : {}), paths }));
+}
+
 export const CLOSED_BY_HAND_EVENT = 'closed-by-hand';
 
 /** 카드를 손으로 닫는다 — 상태를 `failed` 로 두고 history 에 한 줄(`closed-by-hand`)을 남긴다. 이미 손으로 닫은 카드는 그대로 돌려준다(멱등). */
@@ -539,7 +577,7 @@ export function shellQuote(arg: string): string {
 }
 
 /** 발사기에 넘기는 연결 — env(`ELANOUS_RUN_ID`)를 자식 환경에 얹으면 하니스 런이 `runId` 로 돈다(`resolveRunIdentity` 상속). launchId 는 카드에만 남는 발사 토큰이다. */
-export interface TaskLaunchContext { runId: string; launchId: string; env: Record<string, string>; cardLabelContext?: TaskCardLabelContext }
+export interface TaskLaunchContext { runId: string; launchId: string; env: Record<string, string>; cardLabelContext?: TaskCardLabelContext; substrate?: 'pod'; podGoal?: string; effectiveChildProvider?: string }
 /** 발사기가 «이 런 id 로 띄웠다»고 돌려주는 영수증 — 없으면 카드에 런 id 를 적지 않는다(추측하지 않는다). */
 export interface TaskLaunchReceipt {
   runId?: string;
@@ -644,6 +682,8 @@ export function dispatchDeliverableCompletion(id: string, input: { ref: string;
 export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   const text = opts.text.trim();
   if (!text) throw new Error('과제 한 줄이 비어 있다');
+  const targetPathHints = parseAskTargetPathHintsResult(text);
+  const targetPaths = canonicalTargetPaths(targetPathHints.paths);
   if (opts.seat !== undefined && !TASK_SEATS.includes(opts.seat)) throw new Error(`자리는 ${TASK_SEATS.join('|')} 중 하나다: ${opts.seat}`);
   if (opts.completion !== undefined && !COMPLETION_KINDS.includes(opts.completion)) throw new Error(`종결 종류는 ${COMPLETION_KINDS.join('|')} 중 하나다: ${opts.completion}`);
   for (const [flag, value] of [['--goal', opts.goal], ['--milestone', opts.milestone]] as const) {
@@ -695,6 +735,7 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   const path = opts.statePath ?? taskAgentStatePath();
   const card: TaskCard = {
     id, text,
+    ...(!targetPathHints.labelMissing ? { targetPaths } : {}),
     ...(opts.seat ? { seat: opts.seat } : {}),
     ...(opts.checklistId ? { checklistId: opts.checklistId } : {}),
     ...(opts.checklistVersion !== undefined ? { checklistVersion: opts.checklistVersion } : {}),
@@ -735,6 +776,7 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
     if (!owned.ok) throw new TaskCardSupersededError(next.id);
   };
   writeCard(path, card);
+  try { debug.log('task-agent.hand', 'target-paths', { card: id, count: targetPaths.length, labelMissing: targetPathHints.labelMissing }); } catch { /* fail-soft */ }
   try { debug.log('task-agent.graph-select', !selected.composition ? 'composition-missing' : selected.error ? 'composition-invalid' : 'composition-selected', {
     completion, file: selected.composition?.file ?? `graphs/work/${completion}.yaml`,
     unitsResolved: selected.unitsResolved, missingUnits: selected.missingUnits,
@@ -748,6 +790,17 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   }
   if (mode === 'shadow') return { card, move, mode, launched: false, ...(project ? { cwd: project.target } : {}) };
   if (!opts.launcher) throw new Error('--live 인데 launcher 가 없다');
+  if (completion === 'code-pr' && card.checklistId) {
+    const { missing } = inspectGoalDoneBoundary(text);
+    if (missing.length > 0) {
+      const reason = `goal-revision-required: 완료 경계 누락 ${missing.join(' · ')} — 골 문면을 고친 뒤 다시 넘기세요`;
+      const failed: TaskCard = { ...card, status: 'failed', history: [...card.history,
+        { at: (opts.now ?? (() => new Date()))().toISOString(), event: 'goal-revision-required', detail: reason }] };
+      writeCard(path, failed);
+      try { debug.log('task-agent.hand', 'done-boundary-missing', { taskId: id, checklistId: card.checklistId ?? null, missing, reason }); } catch { /* fail-soft */ }
+      throw new Error(`${reason} (카드 ${id})`);
+    }
+  }
   let prelaunch: AlreadyDoneDecision;
   try { prelaunch = completion === 'code-pr'
     ? (opts.prelaunchInspector ?? ((input, target) => inspectPrelaunchAlreadyDone(input, target,
@@ -766,9 +819,14 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
   const runId = mintRunId();
   const launchId = `tl-${randomBytes(6).toString('hex')}`;
   const context: TaskLaunchContext = { runId, launchId, env: { [HARNESS_RUN_ID_ENV]: runId, ELANOUS_TASK_CARD_ID: card.id,
+    ...(cardPrNumber(card) ? { ELANOUS_TASK_BOUND_PR: String(cardPrNumber(card)) } : {}),
     ...(card.checklistId ? { ELANOUS_POD_SLOT_ID: card.checklistId } : {}),
     ...(card.seat ? { ELANOUS_POD_OWNER_KIND: 'seat', ELANOUS_POD_OWNER_ID: card.seat } : {}),
-    ...(card.taLand ? { [TA_LAND_ENV]: '1' } : {}) }, cardLabelContext: taskCardLabelContext(card) };
+    ...(card.taLand ? { [TA_LAND_ENV]: '1' } : {}) }, cardLabelContext: taskCardLabelContext(card),
+    // An omitted card provider uses the established Pod default. Carry the effective value explicitly so
+    // remote-parent code never has to infer a provider from the serialized CLI argv.
+    effectiveChildProvider: card.childLlm?.provider ?? 'openai-codex',
+    ...(completion === 'code-pr' && selected.launcher === 'harness-say' ? { substrate: 'pod' as const, podGoal: card.text } : {}) };
   let receipt: void | TaskLaunchReceipt;
   try {
     receipt = await opts.launcher(move.command!, project?.target, context);
@@ -796,6 +854,19 @@ export async function handTask(opts: HandTaskOptions): Promise<HandTaskResult> {
     ],
   };
   writeCard(path, launched);
+  // INFLIGHT-REGISTRY — 출발 때 맥락을 남긴다(머지 때 같은 파일 줄의 의도를 스마트 머지가 읽는다 · 착지하면 지운다).
+  try {
+    const [head = '', ...rest] = text.split(/\r?\n/);
+    const intentLines = (/^\s*(?:대상\s*경로|target\s*paths?)\s*[:：]/i.test(head) ? rest : [head, ...rest])
+      .filter((line) => !/^\s*(?:[-*]\s*)?완료 경계 (?:코드|실물|증거 명령)\s*:/.test(line));
+    registerInflight({
+      runId: boundRunId ?? runId, cell: card.checklistId ?? card.id, cardId: card.id,
+      intent: intentLines.join(' ').trim() || text,
+      files: parseAskTargetPathHints(text),
+    }, { path: join(dirname(path), INFLIGHT_REGISTRY_FILE), ...(opts.now ? { now: opts.now } : {}) });
+  } catch (error) {
+    try { debug.log('pr-tool.inflight', 'register-failed', { taskId: id, error: String((error as Error)?.message ?? error).slice(0, 200) }, { level: 'warn' }); } catch { /* fail-soft */ }
+  }
   try { debug.log('task-agent', 'launched', { taskId: id, seat: card.seat ?? null, runId: boundRunId ?? null }); } catch { /* fail-soft */ }
   if (boundRunId) {
     try { debug.log('task-agent', 'card-run-bound', { card: id, runId: boundRunId, launchId }); } catch { /* fail-soft */ }

package/src/task-agent/work-order-build.ts

@@ -0,0 +1,22 @@
+import { parseWorkOrder, type WorkOrder } from './work-order.js';
+
+export interface BuildWorkOrderInput {
+  cellId: string;
+  version: string;
+  lifeId?: string;
+  priority?: string;
+  peers?: string;
+}
+
+/** Build the normalized nine-field core from already-grounded inputs; no CLI, filesystem, or launch side effects. */
+export function buildWorkOrder(input: BuildWorkOrderInput): WorkOrder {
+  const parsed = parseWorkOrder(JSON.stringify({
+    cellId: input.cellId,
+    lifeId: input.lifeId,
+    version: input.version,
+    priority: input.priority,
+    peers: input.peers,
+  }));
+  if (!parsed.ok) throw new Error(parsed.reason);
+  return parsed.order;
+}

package/src/task-orchestrator/surfaces/pod-account-broker.ts

@@ -17,6 +17,17 @@ export type PodProviderPlan =
   | { provider: 'grok'; excluded: PodAccountPlan['excluded']; grokSubscriptionEligible: boolean }
   | { provider: null; reasons: string[]; grokSubscriptionEligible: boolean };
 
+/** Effective cap used by the Pod broker; callers carrying an owner-approved selection must carry this same value. */
+export function podAccountThresholdPercent(name: string, options: {
+  excludeAt?: number;
+  thresholdPercentByAccount?: Readonly<Record<string, unknown>>;
+} = {}): number {
+  return codexAccountThresholdPercent(name, {
+    thresholdPercent: options.excludeAt ?? POD_ACCOUNT_EXCLUDE_AT_PERCENT,
+    thresholdPercentByAccount: options.thresholdPercentByAccount,
+  });
+}
+
 /** Pod 의 codex → grok 선택. 자격 종류는 과금 동의와 별도로 판단한다. */
 export function planPodProvider(input: {
   codexCandidates: readonly RotationCandidate[];
@@ -85,9 +96,7 @@ export function planPodAccounts(
   const known: RotationCandidate[] = [];
   const unknown: RotationCandidate[] = [];
   for (const c of candidates) {
-    const threshold = typeof options === 'number'
-      ? excludeAt
-      : codexAccountThresholdPercent(c.name, { thresholdPercent: excludeAt, thresholdPercentByAccount });
+    const threshold = typeof options === 'number' ? excludeAt : podAccountThresholdPercent(c.name, { excludeAt, thresholdPercentByAccount });
     if (c.reached === true) { excluded.push({ name: c.name, why: 'quota reached' }); continue; }
     if (c.usedPercent !== undefined && c.usedPercent >= threshold) { excluded.push({ name: c.name, why: `used ${c.usedPercent}% ≥ ${threshold}%` }); continue; }
     (c.usedPercent === undefined ? unknown : known).push(c);
@@ -113,6 +122,33 @@ export function planPodAccounts(
   return { usable, excluded };
 }
 
+/** HQ selects one owner account before remote-parent launch; keep the configured rotation order. */
+export function planOwnerCodexMirrorCandidates(candidates: readonly RotationCandidate[], options: {
+  accountOrder: readonly string[];
+  thresholdPercentByAccount?: Readonly<Record<string, unknown>>;
+}): RotationCandidate[] {
+  const usable = new Set(planPodAccounts(candidates, { thresholdPercentByAccount: options.thresholdPercentByAccount }).usable);
+  const rank = (name: string): number => {
+    const index = options.accountOrder.indexOf(name);
+    return index < 0 ? options.accountOrder.length : index;
+  };
+  return candidates.map((candidate, index) => ({ candidate, index })).filter(({ candidate }) => usable.has(candidate.name))
+    .sort((a, b) => rank(a.candidate.name) - rank(b.candidate.name) || a.index - b.index)
+    .map(({ candidate }) => candidate);
+}
+
+/** Remote owner-mirror runs may plan against exactly the account HQ selected and its measured usage. */
+export function ownerCodexMirrorCandidate(candidates: readonly RotationCandidate[], account: string, usedPercent?: number): RotationCandidate[] {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(account)) return [];
+  return candidates.filter((candidate) => candidate.name === account).map((candidate) => {
+    const ownerCandidate = { ...candidate };
+    delete ownerCandidate.usedPercent;
+    ownerCandidate.reached = false;
+    const measured = usedPercent !== undefined && Number.isFinite(usedPercent) ? usedPercent : undefined;
+    return { ...ownerCandidate, reached: false, ...(measured !== undefined ? { usedPercent: measured } : {}) };
+  });
+}
+
 /** Job 마다 다음 계정 — 잔량 순으로 돌려 가며. 쓸 계정이 없으면 만들 때 이유를 대고 던진다. */
 export function makePodAccountBroker(plan: PodAccountPlan): () => string {
   if (plan.usable.length === 0) {

package/src/task-orchestrator/surfaces/pod-command-job.ts

@@ -34,6 +34,8 @@ import {
 
 /** CLI `--deadline` 생략 시 — 기존 Pod Job 수명 상한과 같다. */
 export const POD_COMMAND_DEADLINE_SECONDS = POD_JOB_DEADLINE_SECONDS;
+/** An opt-in shadow cannot let a synchronous kubectl call hide its host deadline for two minutes. */
+export const POD_COMMAND_CANCEL_KUBECTL_TIMEOUT_MS = 15_000;
 
 export const POD_NETWORK_SKILLS = ['omni-crawl', 'omni-digest'] as const;
 export const POD_LITE_IMAGE = 'elanous-harness-lite:local';
@@ -414,6 +416,12 @@ export interface RunPodCommandOptions {
    * elsewhere. Omitted = poll without a bound (unchanged for every caller but the release gate).
    */
   statusUnreadableMs?: number;
+  /** Optional caller cancellation. Omitted callers keep their existing polling behavior. */
+  signal?: AbortSignal;
+  /** Optional host wall-clock deadline; checked even when a synchronous kubectl delayed the abort timer. */
+  hostDeadlineAtMs?: number;
+  /** Clock seam for deadline checks. */
+  nowMs?: () => number;
   kubectl?: Kubectl;
   /** A caller-owned scheduler is self-capped: acquires count only its own Jobs, never cluster occupancy (POOLGLOBAL-REG). */
   poolScheduler?: PodPoolScheduler;
@@ -486,14 +494,35 @@ export function podCommandTargetCommit(o: { remote: boolean; gitHead: () => stri
   return o.localImageCommit();
 }
 
+/** Only opt-in callers can stop waiting on a pre-Job async operation. Late rejections stay observed. */
+function awaitPodCommandAbort<T>(pending: Promise<T>, signal?: AbortSignal): Promise<T> {
+  if (!signal) return pending;
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = () => { signal.removeEventListener('abort', onAbort); reject(signal.reason ?? new Error('pod command aborted')); };
+    signal.addEventListener('abort', onAbort, { once: true });
+    pending.then(
+      (value) => { signal.removeEventListener('abort', onAbort); resolve(value); },
+      (error) => { signal.removeEventListener('abort', onAbort); reject(error); },
+    );
+    if (signal.aborted) onAbort();
+  });
+}
+
 /** 풀 자리 · 이미지 판 · Job 적용 · 완료 대기 · 산출 회수 · Secret 정리. */
 export async function runPodCommand(options: RunPodCommandOptions): Promise<PodCommandResult> {
+  const nowMs = options.nowMs ?? Date.now;
+  const ensureLive = () => {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error('pod command aborted');
+    if (options.hostDeadlineAtMs !== undefined && nowMs() >= options.hostDeadlineAtMs) throw new Error('pod shadow: host timeout');
+  };
+  ensureLive();
   const command = [...options.command];
   if (command.length === 0) throw new Error('pod command: 명령이 비었다');
   const skills = [...new Set((options.skills ?? []).map((s) => s.trim()).filter(Boolean))];
   const llm = options.llm;
   const log = options.log ?? ((c, e, d) => debug.log(c, e, d));
-  const baseKubectl = options.kubectl ?? defaultKubectl;
+  const baseKubectl = options.kubectl ?? ((args: readonly string[], input?: string) =>
+    defaultKubectl(args, input, options.signal ? POD_COMMAND_CANCEL_KUBECTL_TIMEOUT_MS : undefined));
   const sleep = options.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
   const namespace = options.namespace ?? 'elanous-test';
   const image = options.image ?? podCommandImageFor(skills, options.clone === true, options.lite === true);
@@ -534,22 +563,37 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     // concurrency cap — its Jobs count against the spec caps, not the cluster's goal Pods (#24253 → 0.2.15 gate ran 1 shard).
     const selfCapped = options.poolScheduler !== undefined;
     for (;;) {
-      member = await pool.tryAcquire(undefined, undefined, { selfCapped });
+      ensureLive();
+      const acquiring = pool.tryAcquire(undefined, undefined, { selfCapped, signal: options.signal });
+      try { member = await awaitPodCommandAbort(acquiring, options.signal); }
+      catch (error) {
+        // If cancellation won the await at the same instant acquisition completed, return that lease.
+        void acquiring.then((late) => { if (late) pool!.release(late); }, () => {});
+        throw error;
+      }
       if (member) break;
-      await sleep(options.pollMs ?? 15_000);
+      await awaitPodCommandAbort(sleep(options.pollMs ?? 15_000), options.signal);
     }
   }
+  if (options.signal?.aborted) {
+    if (member && pool) pool.release(member);
+    ensureLive();
+  }
   const currentContext = member || options.kubectl ? null : baseKubectl(['config', 'current-context']);
   const context = member?.context ?? (currentContext?.status === 0 ? currentContext.stdout.trim() : '');
-  const kubectl: Kubectl = (args, stdin) => baseKubectl(context ? ['--context', context, ...args] : [...args], stdin);
-  const cleanupSecret = () => { kubectl(['-n', namespace, 'delete', 'secret', '-l', own, '--ignore-not-found']); };
+  const kubectlRaw: Kubectl = (args, stdin) => baseKubectl(context ? ['--context', context, ...args] : [...args], stdin);
+  const kubectl: Kubectl = (args, stdin) => { ensureLive(); const result = kubectlRaw(args, stdin); ensureLive(); return result; };
+  const cleanupSecret = () => { kubectlRaw(['-n', namespace, 'delete', 'secret', '-l', own, '--ignore-not-found']); };
   const artifactRoot = options.artifactsRoot ?? `${effectiveInstanceRoot()}/pod-artifacts`;
   const artifactsDir = `${artifactRoot}/${name}`;
+  let jobApplied = false;
   try {
+    ensureLive();
     if (!context && !options.kubectl) throw new Error('pod command: kubectl context 를 확인할 수 없다');
     let grokAuth: string | undefined;
     if (llm === 'grok') {
-      const creds = (options.grokCredentials ?? (() => hostGrokCredentials({ env, apiKeyOptIn: false })))();
+      // POD-GROK-VALIDITY-FIT — this Job's deadline is not fitted to the token, so the copy must outlive the whole Job.
+      const creds = (options.grokCredentials ?? (() => hostGrokCredentials({ env, apiKeyOptIn: false, minValidityMs: deadlineSeconds * 1000 })))();
       if (!creds.grokAuth) throw new Error('grok: 구독 자격 없음 · API 키 opt-in 꺼짐 또는 키 없음');
       let parsed: unknown;
       try { parsed = JSON.parse(creds.grokAuth); } catch { throw new Error('grok: Pod 구독 자격 JSON 이 아니다'); }
@@ -573,7 +617,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       const localSkillsDigest = options.kubectl ? null : image === POD_LITE_IMAGE
         ? podSkillsDigest(POD_NETWORK_SKILLS, resolve(import.meta.dir, '../../../skills')).digest
         : podSkillsDigest(resolvePodSkills(env).skills).digest;
-      const syncs = await (options.syncImages ?? syncPoolImages)([member], image, imageCommit, { localSkillsDigest });
+      const syncs = await awaitPodCommandAbort((options.syncImages ?? syncPoolImages)([member], image, imageCommit, { localSkillsDigest }), options.signal);
       const synced = syncs.get(member.context);
       if (synced && !synced.ok) throw new Error(`pod command: 이미지 판을 못 맞췄다: ${synced.detail}`);
       if (synced?.imageRef) member = { ...member, imageRef: synced.imageRef };
@@ -586,8 +630,8 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     const seedMirror = options.seedMirror ?? (options.kubectl ? undefined : seedMirrorOnce);
     if (seedMirror && options.clone && options.source?.kind === 'commit' && hostMirror && member?.sshHost) {
       // Worst case added to a cold start: the push limit (GATE_MIRROR_SEED_LIMIT_MS), once per host·commit.
-      const seed = await seedMirror({ host: member.sshHost, commit: options.source.sha, cwd: options.mirrorSeedCwd ?? process.cwd() })
-        .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) }));
+      const seed = await awaitPodCommandAbort(seedMirror({ host: member.sshHost, commit: options.source.sha, cwd: options.mirrorSeedCwd ?? process.cwd() })
+        .catch((error: unknown) => ({ host: member!.sshHost!, ok: false, ms: 0, detail: String(error).slice(0, 300) })), options.signal);
       log('pod.command-job', 'mirror-seed', { host: member.sshHost, commit: options.source.sha, ok: seed?.ok ?? false, ms: seed?.ms ?? 0, ...(seed?.detail ? { detail: seed.detail } : {}) });
     }
     // GATE-WARM-BOOT-NO-INIT (10-15): the hostPath dirs the uid-1000 child writes are handed over on the node itself, once per
@@ -600,14 +644,15 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       if (!member) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'no-pool-member', paths: hostDirPaths });
       else if (!prepareHostDirs) log('pod.command-job', 'host-dirs-prep', { ok: false, reason: 'prep-disabled', paths: hostDirPaths });
       else {
-        const prep = await prepareHostDirs({ member, hostPaths: hostDirPaths })
-          .catch((error: unknown) => ({ host: member!.sshHost ?? 'local', ok: false, ms: 0, detail: String(error).slice(0, 300) }));
+        const prep = await awaitPodCommandAbort(prepareHostDirs({ member, hostPaths: hostDirPaths })
+          .catch((error: unknown) => ({ host: member!.sshHost ?? 'local', ok: false, ms: 0, detail: String(error).slice(0, 300) })), options.signal);
         hostDirsPrepared = prep?.ok === true;
         log('pod.command-job', 'host-dirs-prep', { host: prep?.host ?? member.sshHost ?? 'local', ok: prep?.ok ?? false, ms: prep?.ms ?? 0, paths: hostDirPaths, ...(prep?.detail ? { detail: prep.detail } : {}) });
       }
     }
     // Any path where the node-side hand-over did not succeed keeps the old in-Pod hand-over (review mf: uid 1000 could not write).
     const hostDirsInit = hostDirPaths.length > 0 && !hostDirsPrepared;
+    ensureLive();
     const ghToken = options.clone ? (options.ghToken ?? defaultGhToken)() : undefined;
     const secret = commandJobSecret({ name, namespace, launch, skills, skillEnvText, ...(grokAuth !== undefined ? { grokAuth } : {}), ...(ghToken !== undefined ? { ghToken } : {}) });
     if (secret) {
@@ -623,6 +668,8 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
       ...(hostDirsInit ? { hostDirsInit: true } : {}),
     });
     kubectl(['-n', namespace, 'delete', 'job', '-l', own, '--ignore-not-found']);
+    // A wall deadline can elapse inside the synchronous apply; cleanup by this launch's name then remains safe.
+    jobApplied = true;
     const applied = kubectl(['apply', '-f', '-'], JSON.stringify(manifest));
     if (applied.status !== 0) {
       cleanupSecret();
@@ -633,6 +680,7 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     let markerRc: number | null = null;
     const appliedAt = Date.now();
     for (;;) {
+      ensureLive();
       const got = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
       const finished = jobFinished(got.stdout);
       if (finished) { state = finished; break; }
@@ -655,8 +703,9 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
           throw new Error(`pod command: Job 상태를 ${Math.round(options.statusUnreadableMs / 1000)}초 동안 못 읽었다(${context}) — ${(got.stderr ?? '').trim().split('\n').pop()?.slice(0, 200) ?? ''}`);
         }
       } else unreadableSince = null;
-      await sleep(options.pollMs ?? 15_000);
+      await awaitPodCommandAbort(sleep(options.pollMs ?? 15_000), options.signal);
     }
+    ensureLive();
     let logsResult = kubectl(['-n', namespace, 'logs', `job/${name}`, '-c', 'child']);
     // Marker path returns before the Job condition — a full-log read can hit the same transient window the tail read
     // already survived (container log rotation · API hiccup). Retry it a little before calling the artifacts lost.
@@ -721,6 +770,12 @@ export async function runPodCommand(options: RunPodCommandOptions): Promise<PodC
     });
     return { exitCode, artifactsDir, job: name, image: imageRef ?? image, artifacts };
   } catch (err) {
+    if (jobApplied && options.signal) {
+      // Opt-in bounded callers remove their own failed/Pending Job, including status-unreadable exits.
+      // On an unreachable API this is best effort; the local lease is always released in finally.
+      try { kubectlRaw(['-n', namespace, 'delete', 'job', name, '--ignore-not-found', '--wait=false']); }
+      catch { /* preserve the cancellation reason */ }
+    }
     cleanupSecret();
     throw err;
   } finally {

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -230,6 +230,13 @@ function runningLimit(spec: Record<string, unknown>): number | null {
 
 /** A short-lived Pod proves cluster DNS from inside the same namespace as harness Jobs. Image pull failures are not DNS failures. */
 export type PoolDnsProbe = 'ready' | 'dns' | 'image' | 'unknown';
+/** Separate, opt-in observation. null means the probe could not measure that step. */
+export interface ExternalGitHubProbe {
+  externalDns: boolean | null;
+  githubHttps: boolean | null;
+  measuredAt: string | null;
+  reason: string | null;
+}
 const DNS_CACHE_MS = 10 * 60_000;
 const DNS_STALE_OK_MS = 30 * 60_000;
 const DNS_LOCK_WAIT_MS = 6 * 60_000;
@@ -240,6 +247,97 @@ const dnsFlock = process.platform === 'linux' || process.platform === 'darwin'
     flock: { args: ['int', 'int'], returns: 'int' },
   }).symbols.flock : null;
 
+/** A disposable Pod in the Job namespace measures GitHub reachability without changing admission. */
+export function probePoolGitHub(context: string, kubectl: PoolKubectl = leaseKubectl, options: { dir?: string; now?: () => number } = {}): ExternalGitHubProbe {
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
+  const now = options.now ?? Date.now;
+  const dir = options.dir ?? hostLeaseBaseDir();
+  const key = createHash('sha256').update(context).digest('hex');
+  const cache = join(dir, `github-egress-${key}.cache`);
+  const lock = join(dir, `github-egress-${key}.flock`);
+  const cached = (): ExternalGitHubProbe | null => {
+    try {
+      const record = object(JSON.parse(readFileSync(cache, 'utf8')));
+      if (typeof record?.at !== 'number' || now() < record.at || now() - record.at >= 60_000) return null;
+      if (typeof record.measuredAt !== 'string' || ![true, false].includes(record.externalDns as boolean) ||
+          ![true, false, null].includes(record.githubHttps as boolean | null) ||
+          !(record.reason === null || typeof record.reason === 'string')) return null;
+      return { externalDns: record.externalDns as boolean, githubHttps: record.githubHttps as boolean | null,
+        measuredAt: record.measuredAt, reason: record.reason as string | null };
+    } catch { return null; }
+  };
+  const fresh = cached();
+  if (fresh) return fresh;
+  try { mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { return unknown('probe cache unavailable'); }
+  if (!dnsFlock) return unknown('probe lock unavailable');
+  let fd: number;
+  try { fd = openSync(lock, 'a', 0o600); } catch { return unknown('probe lock unavailable'); }
+  let held = false;
+  try {
+    const deadline = Date.now() + 2_000;
+    while (!held) {
+      const shared = cached();
+      if (shared) return shared;
+      if (dnsFlock(fd, 2 | 4) === 0) { held = true; break; }
+      if (Date.now() >= deadline) return unknown('probe busy');
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+    }
+    const shared = cached();
+    if (shared) return shared;
+    const result = runPoolGitHubProbe(context, kubectl, new Date(now()).toISOString());
+    if (result.measuredAt !== null) {
+      const temp = `${cache}.${randomUUID()}.tmp`;
+      try { writeFileSync(temp, JSON.stringify({ ...result, at: now() }), { mode: 0o600 }); renameSync(temp, cache); }
+      catch { try { rmSync(temp, { force: true }); } catch { /* observation remains valid without cache */ } }
+    }
+    return result;
+  } finally {
+    if (held) dnsFlock(fd, 8);
+    closeSync(fd);
+  }
+}
+
+function runPoolGitHubProbe(context: string, kubectl: PoolKubectl, measuredAt: string): ExternalGitHubProbe {
+  const name = `elanous-egress-${randomUUID().slice(0, 12)}`;
+  const base = ['--context', context, '--request-timeout=15s'];
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
+  let created = false;
+  try {
+    const manifest = JSON.stringify({ apiVersion: 'v1', kind: 'Pod', metadata: { name, namespace: 'elanous-test', labels: { 'elanous.probe': 'github-egress' } }, spec: {
+      restartPolicy: 'Never', activeDeadlineSeconds: 35, automountServiceAccountToken: false,
+      containers: [{ name: 'probe', image: 'busybox:1.36', command: ['sh', '-c',
+        'if nslookup github.com >/dev/null 2>&1; then echo EXTERNAL_DNS_OK; if wget -q -T 8 -O /dev/null https://github.com/; then echo GITHUB_HTTPS_OK; else echo GITHUB_HTTPS_FAILED; fi; else echo EXTERNAL_DNS_FAILED; fi'],
+      resources: { requests: { cpu: '0', memory: '16Mi' }, limits: { cpu: '100m', memory: '64Mi' } } }],
+    } });
+    if (kubectl([...base, 'create', '-f', '-'], manifest).status !== 0) return unknown('probe create failed');
+    created = true;
+    const waited = kubectl([...base, '-n', 'elanous-test', 'wait', '--for=jsonpath={.status.phase}=Succeeded', `pod/${name}`, '--timeout=25s']);
+    const podResult = kubectl([...base, '-n', 'elanous-test', 'get', `pod/${name}`, '-o', 'json']);
+    if (podResult.status !== 0) return unknown('probe status unavailable');
+    const pod = object(JSON.parse(podResult.stdout));
+    const statuses = object(pod?.status)?.containerStatuses;
+    if (Array.isArray(statuses) && statuses.some((c) =>
+          ['ErrImagePull', 'ImagePullBackOff', 'InvalidImageName'].includes(String(object(object(object(c)?.state)?.waiting)?.reason))))
+      return unknown('probe image unavailable');
+    const logs = kubectl([...base, '-n', 'elanous-test', 'logs', `pod/${name}`]);
+    if (logs.status !== 0) return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+    const markers = logs.stdout.trim().split(/\r?\n/u);
+    const dnsOk = markers.includes('EXTERNAL_DNS_OK');
+    const dnsFail = markers.includes('EXTERNAL_DNS_FAILED');
+    const httpsOk = markers.includes('GITHUB_HTTPS_OK');
+    const httpsFail = markers.includes('GITHUB_HTTPS_FAILED');
+    if (dnsFail && !dnsOk && !httpsOk && !httpsFail)
+      return { externalDns: false, githubHttps: null, measuredAt, reason: 'external DNS failed' };
+    if (dnsOk && !dnsFail && httpsOk !== httpsFail)
+      return { externalDns: true, githubHttps: httpsOk, measuredAt, reason: httpsFail ? 'GitHub HTTPS failed' : null };
+    return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+  } catch { return unknown('probe failed'); }
+  finally {
+    if (created) try { kubectl([...base, '-n', 'elanous-test', 'delete', `pod/${name}`, '--ignore-not-found=true', '--wait=false']); }
+    catch { /* best effort; Kubernetes activeDeadlineSeconds also bounds the Pod */ }
+  }
+}
+
 /** The cache and lock are shared by CLI processes, keyed by context rather than pool composition. */
 export function probePoolDns(context: string, kubectl: PoolKubectl = leaseKubectl, options: { dir?: string; now?: () => number } = {}): PoolDnsProbe {
   const dir = options.dir ?? hostLeaseBaseDir();

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -41,7 +41,7 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
   const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
   const knownSecrets = secretValues(entry);
   const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
-  if (containsCredential(entry.event) || !EVENT_ALLOWED.test(entry.event)) return undefined;
+  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
 
   const data: Record<string, unknown> = { runId };
   let fields = 0;