elanous 0.2.32 → 0.2.34

package/src/graph-runner/runner.ts

@@ -1,8 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { execFile } from 'node:child_process';
+import { execFile, spawnSync } from 'node:child_process';
 import { existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 import { getElanousConfigDir, getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { debug } from '../debug/log.js';
@@ -17,13 +16,16 @@ import { recordFailureEvent } from '../self-implement/heal-intake.js';
 import { growthApprovalRef, proposeGrowth, type GraphGrowth, type GrowthProposer, type GrowthRecipeEffect, type GrowthDecisionDeps, type GrowthCommand } from './graph-grow.js';
 import { DecisionLedger, type DecisionEntry } from '../decisions/decision-ledger.js';
 import { createLLMGrowthProposer } from './graph-grow-llm.js';
-import { parseGraphTemplateYaml, type GraphEdgeSpec, type GraphNodeSpec, type GraphTemplateSpec } from '../self-implement/graph-yaml.js';
+import { graphVersionHash, parseGraphTemplateYaml, type GraphEdgeSpec, type GraphNodeSpec, type GraphTemplateSpec } from '../self-implement/graph-yaml.js';
+import { createGraphUnitResolver, resolveGraphUnit, UnitNotFoundError, type ResolvedGraphUnit } from '../self-implement/graph-unit-resolver.js';
+import { flattenGraphUnits } from '../self-implement/graph-unit-flatten.js';
+export { UnitNotFoundError } from '../self-implement/graph-unit-resolver.js';
 import { createGraphVariant, type GraphVariantPlan } from '../self-implement/graph-variant.js';
 import { psProcessStartMs, START_TOLERANCE_MS } from '../harness/harness-stop.js';
 import { executeBashNode } from '../workflow-runtime/nodes/bash.js';
 import { interpolate } from '../workflow-runtime/variables.js';
 import type { BashNode, NodeExecContext, WorkflowDeps } from '../workflow-runtime/types.js';
-import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression, type GateExecutorOverride } from '../../scripts/release-loop/resume.js';
+import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeWaiver, type AcceptedRegression, type GateExecutorOverride, type GatePodPoolOverride } from '../../scripts/release-loop/resume.js';
 
 type BashRun = WorkflowDeps['runBash'];
 const DEFAULT_BASH_TIMEOUT_MS = 5 * 60 * 1_000;
@@ -67,6 +69,20 @@ function assertReleaseCommandBinding(node: GraphNodeSpec, command: string | unde
   }
 }
 
+const LOOP_TERMINAL_STATUS: Readonly<Record<string, Readonly<Record<string, 'done' | 'failed'>>>> = {
+  'ta-journey': { done: 'done', failed: 'failed', 'needs-human': 'failed', rework: 'failed' },
+  'default-loop': { landed: 'done', stopped: 'failed' },
+  'document-loop': { landed: 'done', 'document-blocked': 'failed', 'needs-human': 'failed' },
+  'operate-loop': { landed: 'done', 'operate-blocked': 'failed', 'needs-human': 'failed' },
+  'research-loop': { landed: 'done', 'needs-human': 'failed' },
+};
+
+function topLevelTerminalStatus(graphId: string, terminal: string): 'done' | 'failed' | undefined {
+  const aliases = Object.hasOwn(LOOP_TERMINAL_STATUS, graphId) ? LOOP_TERMINAL_STATUS[graphId] : undefined;
+  if (aliases) return Object.hasOwn(aliases, terminal) ? aliases[terminal] : undefined;
+  return terminal === 'done' || terminal === 'failed' ? terminal : undefined;
+}
+
 export interface GraphRunState {
   graphId: string;
   runId: string;
@@ -77,6 +93,8 @@ export interface GraphRunState {
   activeNode?: { nodeId: string; pid: number; pidStartedAt: string };
   stoppedAt?: string;
   status: 'running' | 'done' | 'failed' | 'budget-exceeded' | 'awaiting-approval';
+  /** Original named terminal when status is its canonical done/failed mapping. */
+  reason?: string;
   path: string[];
   /** startedAt/endedAt (ISO) and seconds are written when the node runs; ledgers before GRAPH-NODE-TIMES (0.2.19) have none. */
   nodes: Array<{ nodeId: string; ok: boolean; exit: number | null; executed: boolean; output?: unknown; error?: string; decidedBy?: string; decidedAt?: string;
@@ -101,7 +119,7 @@ export interface GraphRunState {
   growthPark?: { from: string; outcome: string; reason: string; decisionId: string; decisionRef: string; growth: GraphGrowth; command?: GrowthCommand; approval?: string };
   resume?: { from: string; at: string; previousStatus: GraphRunState['status']; graph?: 'snapshot' | 'current' };
   /** GATE-HOST-EXECUTOR — every explicit input change a resume made (what was set and what it replaced), oldest first. */
-  inputOverrides?: GateExecutorOverride[];
+  inputOverrides?: Array<GateExecutorOverride | GatePodPoolOverride>;
   executed: number;
   dryRun: boolean;
   statePath: string;
@@ -123,6 +141,8 @@ export interface GraphRunOptions {
   releaseAcceptedRegressions?: { requested: AcceptedRegression[]; acceptedRegressions: AcceptedRegression[] };
   /** Release-only (GATE-HOST-EXECUTOR): run the restarted gate on this executor — recorded in `inputOverrides`, never a waiver. */
   releaseGateExecutor?: { executor: string; host?: string };
+  /** Release-only (RESUME-GATE-POOL-OVERRIDE): replace the saved gate pool for this resumed gate. */
+  releaseGatePodPool?: string;
   useCurrentGraph?: boolean;
   /** Internal unit invocation context, propagated only by runGraph. */
   unitContext?: { parentRunId: string; ancestors: readonly string[]; remainingSteps: number; entryNodeId?: string };
@@ -132,9 +152,35 @@ export interface GraphRunOptions {
    * its own universe and lands in the tree-derived test universe while the run ledger is prod.
    */
   pinChildUniverse?: boolean;
+  /** Release resume: command checkout and cut tip, checked before every Bash dispatch. */
+  releaseCommandSource?: { root: string; cutTip: string; git?: (args: string[]) => string };
   deps?: { root?: string; runBash?: BashRun; callLLM?: (prompt: string) => Promise<string>; log?: (event: string, data: Record<string, unknown>) => void; beforeNode?: () => void; processStartMs?: (pid: number) => number | null; growthProposer?: GrowthProposer; growthLLM?: (prompt: string) => Promise<string>; classifyGrowthRecipe?: (node: GraphNodeSpec, resolved: { command?: string; approval?: string }) => GrowthRecipeEffect; growthDecision?: GrowthDecisionDeps & { list?: (filters: { status: 'all' }) => DecisionEntry[] } };
 }
 
+/** The command directory must itself be the checkout at the cut tip. */
+export function verifyReleaseCommandRoot(root: string, cutTip: string, git?: (args: string[]) => string): string {
+  let commandRoot: string;
+  try { commandRoot = realpathSync(root); }
+  catch { throw new Error(`release command root missing: ${root} — use --command-root <컷 tip checkout>`); }
+  const run = git ?? ((args: string[]): string => {
+    // git-spawn-allow: read-only checkout identity before release command dispatch.
+    // `git ls-files -v -z` exceeds Node's 1 MiB default in the 25k-path main checkout.
+    const result = spawnSync('git', args, { cwd: commandRoot, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    if (result.status !== 0 || result.error) throw new Error(`release command root is not a git checkout: ${commandRoot} — use --command-root <컷 tip checkout>`);
+    return result.stdout.trim();
+  });
+  const head = run(['rev-parse', 'HEAD']);
+  // `status` can hide modified tracked code when assume-unchanged or skip-worktree is set.
+  // A release command checkout must not carry either index promise.
+  const hiddenTracked = run(['ls-files', '-v', '-z']).split('\0').find((entry) => entry && entry[0] !== 'H');
+  if (!/^[0-9a-f]{40}$/i.test(cutTip) || head.toLowerCase() !== cutTip.toLowerCase() ||
+      (!git && realpathSync(run(['rev-parse', '--show-toplevel'])) !== commandRoot) ||
+      hiddenTracked || run(['-c', 'status.showUntrackedFiles=all', 'status', '--porcelain', '--untracked-files=all'])) {
+    throw new Error(`release command root ${commandRoot}@${head.slice(0, 12)} differs from cut tip ${cutTip.slice(0, 12)} — use --command-root <컷 tip checkout>`);
+  }
+  return commandRoot;
+}
+
 function safeSegment(value: string): string {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) || value === '.' || value === '..') {
     throw new Error(`invalid graph run identifier: ${value}`);
@@ -443,46 +489,22 @@ function nextNode(edges: readonly GraphEdgeSpec[], nodeId: string, exitOutcome:
   return edge.map?.[exitOutcome] ?? edge.fallback?.[0]?.node;
 }
 
-type ResolvedUnit = { path: string; template: GraphTemplateSpec; hash: string };
-
-export class UnitNotFoundError extends Error {
-  constructor(call: string) {
-    super(`unit not found: ${call}`);
-    this.name = 'UnitNotFoundError';
-  }
-}
+type ResolvedUnit = ResolvedGraphUnit;
+export const resolveUnit = resolveGraphUnit;
 
-export function resolveUnit(call: string, callerPath: string): ResolvedUnit {
-  const [id, requested] = call.split('@');
-  const repo = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-  const directories = [join(dirname(callerPath), 'units'), dirname(callerPath), join(repo, 'graphs', 'units'), join(getElanousConfigDir(), 'graphs', 'units')];
-  for (const dir of directories) {
-    if (!existsSync(dir)) continue;
-    const matches = readdirSync(dir).filter(file => /\.ya?ml$/.test(file) && file !== 'recipes.yaml' && file !== 'recipes.yml').flatMap(file => {
-      const path = join(dir, file);
-      const source = readFileSync(path, 'utf8');
-      const header: unknown = parseYaml(source);
-      if (!header || typeof header !== 'object' || Array.isArray(header) || (header as Record<string, unknown>).graph_id !== id) return [];
-      const parsed = parseGraphTemplateYaml(source, path);
-      if (parsed.errors.length) throw new Error(parsed.errors.map(e => `${e.path}: ${e.message}`).join('\n'));
-      const template = parsed.template!;
-      return template.unit && (requested === String(template.version) || requested === `^${template.version}`)
-        ? [{ path, template, hash: createHash('sha256').update(source).digest('hex') }] : [];
-    });
-    if (matches.length > 1) throw new Error(`ambiguous unit: ${call}`);
-    if (matches.length) return matches[0]!;
-  }
-  throw new UnitNotFoundError(call);
+export function validateUnitCalls(graph: GraphTemplateSpec, path: string, ancestors: readonly string[] = [], onMissing?: (call: string) => void): Map<string, ResolvedUnit> {
+  return validateUnitCallsWithResolver(graph, path, ancestors, onMissing, createGraphUnitResolver());
 }
 
-export function validateUnitCalls(graph: GraphTemplateSpec, path: string, ancestors: readonly string[] = [], onMissing?: (call: string) => void): Map<string, ResolvedUnit> {
+function validateUnitCallsWithResolver(graph: GraphTemplateSpec, path: string, ancestors: readonly string[], onMissing: ((call: string) => void) | undefined,
+  resolve: typeof resolveGraphUnit): Map<string, ResolvedUnit> {
   if (ancestors.includes(graph.graphId)) throw new Error(`unit cycle: ${[...ancestors, graph.graphId].join(' -> ')}`);
   if (ancestors.length > 3) throw new Error('unit nesting exceeds depth 3');
   const result = new Map<string, ResolvedUnit>();
   for (const node of graph.nodes) {
     if (node.kind !== 'subgraph' || node.call === undefined) continue;
     let unit: ResolvedUnit;
-    try { unit = resolveUnit(node.call!, path); } catch (error) {
+    try { unit = resolve(node.call!, path); } catch (error) {
       if (error instanceof UnitNotFoundError && onMissing) { onMissing(node.call!); continue; }
       throw error;
     }
@@ -501,7 +523,7 @@ export function validateUnitCalls(graph: GraphTemplateSpec, path: string, ancest
       debug.log('graph.unit', 'contract-mismatch', { graphId: graph.graphId, nodeId: node.nodeId, call: node.call });
       throw new Error(`unit contract mismatch: ${node.nodeId} -> ${node.call}`);
     }
-    validateUnitCalls(unit.template, unit.path, [...ancestors, graph.graphId], onMissing);
+    validateUnitCallsWithResolver(unit.template, unit.path, [...ancestors, graph.graphId], onMissing, resolve);
     result.set(node.nodeId, unit);
   }
   return result;
@@ -515,6 +537,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
   if (options.releaseWaiver && (!options.resumeRunId || options.fromNodeId !== options.releaseWaiver.nodeId)) throw new Error('release waiver requires --resume --from <waived node>');
   if (options.releaseAcceptedRegressions && (!options.resumeRunId || !options.fromNodeId || options.releaseWaiver)) throw new Error('accepted regressions require a release resume boundary');
   if (options.releaseGateExecutor && (!options.resumeRunId || !options.fromNodeId)) throw new Error('gate executor override requires a release resume boundary');
+  if (options.releaseGatePodPool !== undefined && (!options.resumeRunId || !options.fromNodeId)) throw new Error('gate pod pool override requires a release resume boundary');
   const root = options.deps?.root ?? effectiveInstanceRoot();
   const matchingRuns = options.resumeRunId && !options.resumeGraphId
     ? listGraphRuns(root).runs.filter((run) => run.runId === options.resumeRunId && run.graphPath === resolve(path)) : [];
@@ -547,7 +570,13 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
   const variant = options.variant ? createGraphVariant({ template: graph, ...options.variant }) : undefined;
   if (variant && !variant.ok) throw new Error(`graph variant rejected: ${JSON.stringify(variant.rejections)}`);
   if (variant?.ok) graph = variant.template;
-  const units = validateUnitCalls(graph, path, options.unitContext?.ancestors);
+  const unitResolver = createGraphUnitResolver();
+  const units = validateUnitCallsWithResolver(graph, path, options.unitContext?.ancestors ?? [], undefined, unitResolver);
+  if (units.size > 0) {
+    const staticView = flattenGraphUnits(graph, path, unitResolver);
+    debug.log('graph.unit', 'static-view', { graphId: graph.graphId, hash: graphVersionHash(staticView),
+      nodeIds: staticView.nodes.map((node) => node.nodeId), edges: staticView.edges });
+  }
   const unitEntryNode = options.unitContext?.entryNodeId ?? saved?.entryNodeId ?? graph.entryNode;
   if (saved?.entryNodeId !== undefined && options.unitContext?.entryNodeId !== undefined && saved.entryNodeId !== options.unitContext.entryNodeId) {
     throw new Error('unit entry changed on resume');
@@ -579,8 +608,10 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     .flatMap(name => credentialStatus(name, pluginRoot).fields.map(field => field.env));
   const credentialFields = owner ? credentialStatus(owner.name, pluginRoot).fields.filter(field => field.set).map(field => field.name) : [];
   for (const terminal of graph.terminalNodes) {
-    if (terminal !== 'done' && terminal !== 'failed') {
-      throw new Error(`unsupported terminal node: ${terminal} (expected done or failed)`);
+    // Units use their declared exits. The four loop graphs also declare named
+    // top-level exits; all other graphs retain the done/failed contract.
+    if (!(graph.unit ? graph.unit.exits.includes(terminal) : topLevelTerminalStatus(graph.graphId, terminal) !== undefined)) {
+      throw new Error(`unsupported terminal node: ${terminal} (expected ${graph.unit ? graph.unit.exits.join(' or ') : 'done or failed'})`);
     }
   }
   const recipeSource = readFileSync(graphMode === 'snapshot' ? join(snapshotDir!, 'recipes.yaml') : join(dirname(path), 'recipes.yaml'), 'utf8');
@@ -636,6 +667,29 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       ...(options.input === undefined ? {} : { input: options.input }),
       ...(options.unitContext?.entryNodeId === undefined ? {} : { entryNodeId: options.unitContext.entryNodeId }),
       executed: 0, dryRun: options.dryRun === true, statePath };
+  const verifyReleaseSource = (): string | undefined => {
+    const source = options.releaseCommandSource;
+    if (!source) return undefined;
+    const savedCutTip = lastJsonObject(state.nodes.find((node) => node.nodeId === 'version-release')?.output)?.commit;
+    if (graphId !== 'release-loop' || !options.resumeRunId || typeof savedCutTip !== 'string' || source.cutTip !== savedCutTip) {
+      throw new Error('release command source differs from the saved cut tip');
+    }
+    const commandRoot = verifyReleaseCommandRoot(source.root, savedCutTip, source.git);
+    // The ledger snapshot must be the recipe that the cut checkout actually carries.
+    // HEAD alone does not bind a saved graph to that checkout.
+    if (!state.graphSnapshot) throw new Error('release recipe snapshot missing — cannot pin command source');
+    const cutGraph = join(commandRoot, 'graphs', 'release', 'release-loop.yaml');
+    const cutRecipes = join(commandRoot, 'graphs', 'release', 'recipes.yaml');
+    const hashFile = (file: string): string => {
+      try { return createHash('sha256').update(readFileSync(file)).digest('hex'); }
+      catch { throw new Error(`release recipe source missing in cut checkout: ${file}`); }
+    };
+    if (hashFile(cutGraph) !== state.graphSnapshot.graphSha || hashFile(cutRecipes) !== state.graphSnapshot.recipesSha) {
+      throw new Error('release recipe source differs from the saved graph snapshot at cut tip');
+    }
+    return commandRoot;
+  };
+  verifyReleaseSource();
   if (options.resumeRunId && graphMode === 'snapshot' && state.sourceHash && state.sourceHash !== approvalSourceHash) {
     throw new Error('graph snapshot changed since run started');
   }
@@ -728,6 +782,13 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       state.inputOverrides = [...(state.inputOverrides ?? []), override];
       debug.log('graph.runs', 'input-override', { graphId, runId, ...override });
     }
+    if (options.releaseGatePodPool !== undefined) {
+      if (graphId !== 'release-loop') throw new Error('gate pod pool override requires the release-loop graph');
+      const override = releaseResumeGatePodPool(state, { from: options.fromNodeId, pool: options.releaseGatePodPool });
+      state.input = { ...(state.input as Record<string, unknown>), ...override.set };
+      state.inputOverrides = [...(state.inputOverrides ?? []), override];
+      debug.log('graph.runs', 'input-override', { graphId, runId, ...override });
+    }
     if (state.unitCalls) {
       const calls = state.unitCalls;
       state.unitCalls = calls.filter(call => {
@@ -911,6 +972,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       const redactCredentials = (text: string) => Object.values(credentials).filter(value => value.length > 0)
         .reduce((safe, value) => safe.replaceAll(value, '[REDACTED]'), text);
       const runBash: BashRun = async (body, opts) => {
+        const commandRoot = verifyReleaseSource();
         // Hash the actual /bin/bash argv after interpolation. Keep the command text (which may contain
         // credentials) out of logs, but leave enough to distinguish a replayed publish from npm/docs.
         const argvSha256 = createHash('sha256').update(JSON.stringify(['/bin/bash', '-c', body])).digest('hex');
@@ -929,7 +991,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
           return true;
         });
         try {
-          const result = await execute(body, opts);
+          const result = await execute(body, commandRoot ? { ...opts, cwd: commandRoot } : opts);
           code = result.exitCode;
           return { ...result, stdout: redactCredentials(result.stdout), stderr: redactCredentials(result.stderr) };
         } finally {
@@ -978,9 +1040,13 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       for (const record of state.nodes) previous[record.nodeId] = lastJsonObject(record.output) ?? record.output;
       const supplied = state.input && typeof state.input === 'object' && !Array.isArray(state.input)
         ? state.input as Record<string, unknown> : {};
+      const lastPrior = state.nodes.at(-1);
+      const lastPriorOutput = lastPrior ? previous[lastPrior.nodeId] : undefined;
+      const priorResult = lastPriorOutput && typeof lastPriorOutput === 'object' && !Array.isArray(lastPriorOutput)
+        ? (lastPriorOutput as Record<string, unknown>).result : undefined;
       const inputs: Record<string, unknown> = Object.create(null);
       for (const key of contract.inputs) {
-        const value = Object.hasOwn(supplied, key) ? supplied[key] : previous[key];
+        const value = Object.hasOwn(supplied, key) ? supplied[key] : key === 'prior' ? priorResult : previous[key];
         if (value !== undefined) inputs[key] = value;
       }
       const alreadySpent = state.path.length + (state.unitCalls ?? []).reduce((sum, call) => sum + call.steps, 0);
@@ -1083,7 +1149,8 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     } else {
       // 승인 노드도 결과를 «값»으로 남긴다 — 뒤 노드가 문맥(outputs)에서 승인 여부를 확인할 수 있게(발행 노드가 승인 없이 돌지 않도록).
       if (approval && !state.dryRun && !command) {
-        output = JSON.stringify({ outcome: ok ? 'approved' : 'rejected', ...(state.pending?.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending?.decidedAt ?? null });
+        output = JSON.stringify({ outcome: ok ? 'approved' : 'rejected', graphId, runId, nodeId: current,
+          ...(state.pending?.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending?.decidedAt ?? null });
       }
       state.nodes.push({ nodeId: current, ok, exit, executed: !waiving && ((!!command && (!state.dryRun || !!command.dry_run_command)) || (!!prompt && !state.dryRun) || unitExecuted), ...((waiving || units.has(current) || ((command || prompt || approval) && (!state.dryRun || !!command?.dry_run_command))) && output !== undefined ? { output } : {}), ...(error ? { error } : {}),
         ...(waiving ? { waiver: { reason: options.releaseWaiver!.reason, at: nodeEndedAt, ...(options.releaseWaiver!.unmeasured === undefined ? {} : { unmeasured: options.releaseWaiver!.unmeasured }), original: { exit: waivedRecord!.exit, ...(waivedRecord!.output === undefined ? {} : { output: waivedRecord!.output }), ...(waivedRecord!.error === undefined ? {} : { error: waivedRecord!.error }) } } } : {}),
@@ -1111,7 +1178,10 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     }
     persist();
     if (graph.terminalNodes.includes(current)) {
-      state.status = current === 'failed' || !ok ? 'failed' : 'done';
+      state.status = !ok ? 'failed' : graph.unit ? (current === 'failed' ? 'failed' : 'done')
+        : topLevelTerminalStatus(graph.graphId, current)!;
+      if (!graph.unit && current !== 'done' && current !== 'failed') state.reason = current;
+      else delete state.reason;
       persist();
       if (state.status === 'failed' && !state.dryRun && graphId === 'release-loop') {
         recordReleaseRunFailure(state, root, `Graph ${graphId}/${runId} failed at ${current}`);

package/src/grok/credential.ts

@@ -147,6 +147,11 @@ export function readGrokSubscriptionAccess(
   return { key: sub.token, expiresAt: sub.expiresAt };
 }
 
+/** Read only the selected subscription expiry for status/alert surfaces; never return token or account id. */
+export function readGrokSubscriptionExpiry(home?: string): string | null {
+  return readSubscriptionToken(grokAuthFilePath(home))?.expiresAt ?? null;
+}
+
 /** 프록시 필수 헤더. ⛔ `x-grok-client-version` 을 빼면 426 이다(실측). */
 export function grokSubscriptionHeaders(opts: {
   model?: string;

package/src/harness/harness-cli-command.ts

@@ -21,6 +21,7 @@ import { GOAL_TYPES, lintGoalFile, parseGoalId, parseGoalType, resolveGoalAuthor
 import { templateForGoalType } from '../self-implement/graph-templates.js';
 import { appendRunLedgerEntry, listRunLedgers, loadFederatedRunLedger, loadRunLedger, queryRunScreenKey, runLedgerDir, type RunLedgerEntry, type RunLedgerMatch, type RunLedgerWriter } from '../self-implement/run-ledger.js';
 import { classifyPodExit, type PodExitClass } from '../task-orchestrator/surfaces/pod-failure-reason.js';
+import type { PodChildEvidence } from '../task-orchestrator/surfaces/self-implement.js';
 import { classifyPodExitStop, recordRunStop, runStopRecorded, RUN_STOP_EVENT } from '../self-implement/run-stop.js';
 import { ensureOpenRouterChildModelLive, resolveChildLlmEffort, resolveImplementationChildModel } from '../self-dev/dev-cli.js';
 import { resolveHarnessTarget } from '../self-implement/harness-target-options.js';
@@ -571,19 +572,40 @@ export function recordClassifiedHarnessPodExit(runId: string | undefined, reason
   context: { entrance?: string; seat?: string; output?: string } = {}): void {
   if (!runId) return;
   try {
+    const childEvidence = reason === 'preflight-refused' ? undefined : latestPodChildEvidence(loadRunLedger(runId));
     const signal = status > 128
       ? Object.entries(osConstants.signals).find(([, number]) => number === status - 128)?.[0] ?? null : null;
     const cwd = process.cwd();
     const seat = context.seat ?? process.env.ELANOUS_HARNESS_SEAT;
-    recordRunExit({ runId, reason, status, signal, at: new Date().toISOString(),
+    recordRunExit({ runId, reason: childEvidence?.scopeEscape === true ? 'scope-escape' : reason, status, signal, at: new Date().toISOString(),
       ...(context.entrance ? { entrance: context.entrance } : {}),
       ...(['OP', 'TC', 'MK', 'UX'].includes(seat ?? '') ? { seat } : {}),
       cwd: `${basename(dirname(cwd))}/${basename(cwd)}`, hostname: hostname().split('.')[0]!, pid: process.pid,
       ...(context.output ? { lastLines: incidentLastLines(context.output) } : {}),
+      ...(childEvidence ? { childEvidence } : {}),
     }, effectiveInstanceRoot());
   } catch { /* incident writes cannot change Pod output or exit */ }
 }
 
+function latestPodChildEvidence(entries: readonly RunLedgerEntry[] | null | undefined): PodChildEvidence | undefined {
+  // The current attempt's start is the fence. An earlier Pod's terminal facts cannot
+  // classify a later attempt when that attempt has no JSON or its ledger write failed.
+  const current = entries?.filter((entry) => entry.event === 'pod-child-run').at(-1)?.data;
+  if (typeof current?.job !== 'string' || typeof current.childRunId !== 'string') return undefined;
+  const data = entries?.filter((entry) => entry.event === 'pod-child-evidence'
+    && entry.data?.job === current.job && entry.data?.childRunId === current.childRunId).at(-1)?.data;
+  const evidence = data?.childEvidence;
+  if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence)) return undefined;
+  const row = evidence as Record<string, unknown>;
+  const object = (value: unknown): boolean => value !== null && typeof value === 'object' && !Array.isArray(value);
+  if (('scopeEscape' in row && row.scopeEscape !== true)
+    || ('goalCauseObserved' in row && row.goalCauseObserved !== true)
+    || ('classification' in row && typeof row.classification !== 'string')
+    || ('abandonedClassification' in row && !object(row.abandonedClassification))
+    || ('accountAvailability' in row && !object(row.accountAvailability))) return undefined;
+  return row as PodChildEvidence;
+}
+
 /** Every Pod launch entrance (harness ask/say · dev ask --substrate pod) warns once after a recent burst; it never blocks the launch. */
 export function warnRecentIncidentBurst(
   root: string = effectiveInstanceRoot(), now: Date = new Date(), write: (line: string) => void = (line) => console.error(line),
@@ -754,7 +776,10 @@ export function recordHarnessPodStop(
   if (!runId) return false;
   try {
     if (runStopRecorded(runId)) return false;
-    if ((deps.loadLedger ?? loadRunLedger)(runId)?.some((entry) => entry.event === RUN_STOP_EVENT)) return false;
+    const ledger = (deps.loadLedger ?? loadRunLedger)(runId);
+    if (ledger?.some((entry) => entry.event === RUN_STOP_EVENT)) return false;
+    const childEvidence = latestPodChildEvidence(ledger);
+    const scopeEscape = childEvidence?.scopeEscape === true;
     if (classified.reason === 'preflight-refused') {
       (deps.record ?? recordRunStop)({
         runId, site: 'preflight', class: 'launch-failed',
@@ -772,18 +797,18 @@ export function recordHarnessPodStop(
     if (detail) {
       const write = deps.write ?? ((entry: RunLedgerEntry) => appendRunLedgerEntry(entry));
       (deps.record ?? recordRunStop)({
-        runId, site: 'pod-exit', class: classifyPodExitStop(classified.reason),
+        runId, site: 'pod-exit', class: scopeEscape ? 'scope-escape' : classifyPodExitStop(classified.reason),
         cause: `Pod exit ${status}: ${detail.podExitClass}${detail.lead ? ` — ${detail.lead}` : ''}`,
-        evidenceRef, nextMove,
+        evidenceRef, nextMove, ...(childEvidence ? { childEvidence } : {}),
       }, (entry) => write({ ...entry, data: { ...entry.data, podExitClass: detail.podExitClass, tail: detail.tail } }));
       return true;
     }
     // The classified line is our own one-line verdict («Pod 안 자식이 실패했다 — OOMKilled»), not the raw output tail.
     const verdict = classified.lines[0]?.split(' — ').slice(1).join(' — ').trim();
     (deps.record ?? recordRunStop)({
-      runId, site: 'pod-exit', class: classifyPodExitStop(classified.reason),
-      cause: `Pod exit ${status}: ${classified.reason}${verdict ? ` — ${verdict}` : ''}`,
-      evidenceRef, nextMove,
+      runId, site: 'pod-exit', class: scopeEscape ? 'scope-escape' : classifyPodExitStop(classified.reason),
+      cause: `Pod exit ${status}: ${scopeEscape ? 'scope-escape' : classified.reason}${verdict ? ` — ${verdict}` : ''}`,
+      evidenceRef, nextMove, ...(childEvidence ? { childEvidence } : {}),
     }, ...(deps.write ? [deps.write] : []));
     return true;
   } catch { return false; /* ledger observation cannot change Pod output or exit */ }
@@ -2116,6 +2141,7 @@ const executeGh: GhExecute = (args) => {
 export async function supersedeMergedGoalDrafts(
   number: number, cwd: string,
   execute: GhExecute = executeGh, git: DraftSweepGitExecute = runGitCommand,
+  options: { onlyExplicitSameCell?: boolean } = {},
 ): Promise<void> {
   const remote = git(cwd, ['config', '--get', 'remote.origin.url']);
   const repository = remote.status === 0 ? githubRemoteRepository(remote.stdout) : undefined;
@@ -2132,8 +2158,10 @@ export async function supersedeMergedGoalDrafts(
     number: pr.number, title: pr.title, body: pr.body ?? undefined, branch: pr.head.ref,
     createdAt: pr.created_at, mergedAt: pr.merged_at,
   };
+  if (options.onlyExplicitSameCell && !/^Supersedes:\s*#\d+\s*$/m.test(merged.body ?? '')) return;
   const { supersedeDraftsOnMerge } = await import('../self-dev/draft-sweep.js');
-  await supersedeDraftsOnMerge({ repository, merged, adapters: githubDraftSweepAdapters(execute, git, cwd) });
+  await supersedeDraftsOnMerge({ repository, merged, adapters: githubDraftSweepAdapters(execute, git, cwd),
+    ...(options.onlyExplicitSameCell ? { onlyExplicitSameCell: true } : {}) });
 }
 
 /**
@@ -2527,7 +2555,7 @@ export function githubDraftSweepAdapters(execute: GhExecute = executeGh, git: Dr
     }
     return undefined;
   };
-  const issueCommentsFor = async (repository: string, number: number, what: 'review' | 'landing'): Promise<string[]> => {
+  const issueCommentsFor = async (repository: string, number: number, what: 'review' | 'landing' | 'same-cell'): Promise<string[]> => {
     const comments: string[] = [];
     for (let page = 1; page <= 100; page++) {
       const batch = await ghJsonAsync<Array<{ body?: string }>>(['api', `repos/${repository}/issues/${number}/comments?per_page=100&page=${page}`]);
@@ -2535,7 +2563,7 @@ export function githubDraftSweepAdapters(execute: GhExecute = executeGh, git: Dr
       comments.push(...batch.map((comment) => comment.body ?? ''));
       if (batch.length < 100) return comments;
     }
-    throw new Error(`${what === 'review' ? 'Review' : 'Landing'} comment inventory exceeded pagination limit`);
+    throw new Error(`${what === 'review' ? 'Review' : what === 'same-cell' ? 'Same-cell' : 'Landing'} comment inventory exceeded pagination limit`);
   };
   const reviewGateForDraft = async (draft: SweepDraft, repository: string): Promise<SweepReviewGate | undefined> => {
     const cached = await detailFor(repository, draft.number);
@@ -2716,6 +2744,7 @@ export function githubDraftSweepAdapters(execute: GhExecute = executeGh, git: Dr
     listPrTerminals: async () => listRunLedgers().matches.flatMap((match) => match.entries.filter((entry) => entry.event === 'pr-terminal')
       .map((entry) => entry.data as unknown as PrTerminalRecord)),
     commentDraft: async (repository, number, body) => { execute(['pr', 'comment', String(number), '--repo', repository, '--body', body]); },
+    listIssueComments: async (repository, number) => issueCommentsFor(repository, number, 'same-cell'),
     removeLabel: async (repository, number, name) => { execute(['pr', 'edit', String(number), '--repo', repository, '--remove-label', name]); },
     getReviewGate: async (draft, repository) => reviewGateForDraft(draft, repository),
     // DRAFT-LINEAGE-ONE-1 — the sweep calls this only with `--apply`, only for a live run whose newer same-lineage run

package/src/harness/harness-incidents.ts

@@ -3,6 +3,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statS
 import { join } from 'node:path';
 import { redactSecretText } from '../debug/log.js';
 import { refuseProductionLedgerWriteInTest } from './ledger-write-guard.js';
+import type { PodChildEvidence } from '../task-orchestrator/surfaces/self-implement.js';
 
 export interface RunExit {
   runId: string;
@@ -16,6 +17,7 @@ export interface RunExit {
   hostname?: string;
   pid?: number;
   lastLines?: string[];
+  childEvidence?: PodChildEvidence;
 }
 
 export interface IncidentBurst {
@@ -77,6 +79,8 @@ export function readRunExits(root: string): RunExit[] {
         ...(typeof row.pid === 'number' && Number.isSafeInteger(row.pid) ? { pid: row.pid } : {}),
         ...(Array.isArray(row.lastLines) && row.lastLines.every((line) => typeof line === 'string')
           ? { lastLines: row.lastLines } : {}),
+        ...(row.childEvidence && typeof row.childEvidence === 'object' && !Array.isArray(row.childEvidence)
+          ? { childEvidence: row.childEvidence } : {}),
       });
     }
   }

package/src/harness/harness-pod-dispatch.ts

@@ -58,11 +58,41 @@ export interface HarnessPodDispatchInput {
   readonly authorGradeSource?: import('../self-implement/goal-author.js').GoalAuthorGradeSource;
 }
 
+/** The mbp fleet alias must select the installed local k3d context, with a deliberately small first capacity. */
+export function resolveHarnessPodPool(spec: string | undefined): string | undefined {
+  if (!spec) return spec;
+  let changed = false;
+  let mbpCapacity = 0;
+  let mbpMembers = 0;
+  const members = spec.split(',').map((raw) => {
+    const part = raw.trim();
+    const alias = /^pool-mbp@mbp:(\d+)$/.exec(part);
+    const local = /^k3d-monad-h1:(\d+)$/.exec(part);
+    if (!alias && !local) {
+      if (/^pool-mbp@mbp(?::|$)/.test(part) || /^k3d-monad-h1(?::|$)/.test(part)) {
+        throw new Error(`mbp Pod 풀 스펙 오류: ${part}`);
+      }
+      return part;
+    }
+    const capacity = Number((alias ?? local)![1]);
+    if (!Number.isInteger(capacity) || capacity < 1 || capacity > 2) {
+      throw new Error(`mbp Pod 풀 상한은 1~2: ${part}`);
+    }
+    mbpCapacity += capacity;
+    mbpMembers++;
+    if (mbpCapacity > 2) throw new Error(`mbp Pod 풀 합산 상한은 2: ${spec}`);
+    if (mbpMembers > 1) throw new Error(`mbp Pod 풀 컨텍스트 중복: ${spec}`);
+    if (alias) changed = true;
+    return `k3d-monad-h1:${capacity}`;
+  });
+  return changed ? members.join(',') : spec;
+}
+
 export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: string): string[] {
   return [
     ELANOUS_ENTRY_SCRIPT, 'self', 'orchestrate', '--goal-file', goalFile,
     '--substrate', 'pod',
-    ...(input.podPool ? ['--pod-pool', input.podPool] : []),
+    ...(input.podPool ? ['--pod-pool', resolveHarnessPodPool(input.podPool)!] : []),
     // 하니스 기본(자동 병합)을 따른다 · 끄면 PR 까지 — 어느 쪽이든 Pod 가 사라져도 결과가 남는다.
     ...(input.repairCommitOnly ? [] : input.autoMerge === false ? ['--open-pr'] : ['--auto-merge']),
     ...(input.repairCommitOnly && input.source ? ['--base', `pr-${input.source.slice(3)}`] : input.base ? ['--base', input.base] : []),
@@ -99,6 +129,13 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
 export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps?: PodDispatchDeps): number | Promise<number>;
 export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDispatchDeps = {}): number | Promise<number> {
   const cwd = deps.cwd ?? process.cwd();
+  try { resolveHarnessPodPool(input.podPool); }
+  catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    debug.log('harness.substrate', 'pod-pool-refused', { entrance: input.entrance, reason });
+    console.error(reason);
+    return 2;
+  }
   if (input.source !== undefined) {
     try {
       parsePodSourceSpec(input.source);

package/src/harness/harness-salvage-cli.ts

@@ -5,7 +5,9 @@
 import type { Command } from 'commander';
 import { debug } from '../debug/log.js';
 import { normalizeRunId } from './harness-space.js';
-import { loadFederatedRunLedger } from '../self-implement/run-ledger.js';
+import { loadFederatedRunLedger, loadRunLedger } from '../self-implement/run-ledger.js';
+import { prodInstanceRoot } from '../instance/resolve.js';
+import { remoteLedgerMirrorDirs } from '../task-agent/parent-host.js';
 import { getUserConfig } from '../user-config.js';
 import { resolveRepositoryName } from './repository-name.js';
 import {
@@ -35,9 +37,19 @@ export interface HarnessSalvageDeps {
   print?: (line: string) => void;
 }
 
+/** 원격 부모 거울 원장 — remoteLedgerMirrorDirs(prodInstanceRoot()) 를 로컬·연합 원장 «뒤에»만 붙인다(tasks 쪽 원장 조회와 같은 재사용 경로 · 거울 생성·SSH 는 별개 칸). */
+function loadMirroredRunLedger(runId: string): ReturnType<typeof loadRunLedger> {
+  for (const directory of remoteLedgerMirrorDirs(prodInstanceRoot())) {
+    const ledger = loadRunLedger(runId, directory);
+    if (ledger !== null) return ledger;
+  }
+  return null;
+}
+
 function defaultReadPr(runId: string): RunPrState {
   try {
-    return prStateFromLedger(loadFederatedRunLedger(runId, { includeTest: true }));
+    // 로컬·연합 원장 먼저, 없으면 원격 부모 거울 — 순서는 tasks 쪽 원장 조회와 같다.
+    return prStateFromLedger(loadFederatedRunLedger(runId, { includeTest: true }) ?? loadMirroredRunLedger(runId));
   } catch (error) {
     return { status: 'unknown', reason: `원장 읽기 실패 · ${error instanceof Error ? error.message : String(error)}` };
   }