elanous 0.2.32 → 0.2.35

package/scripts/release-loop/preflight.ts

@@ -1,12 +1,14 @@
-// `elanous release preflight` — 컷 30분 전 사전 점검(RELEASE-PREFLIGHT · 10-06).
+// `elanous release preflight` — 컷 −30분 운영 점검 + 컷 −60분 main export 사전 점검.
 //
 // 🩸 계기(10-06 실측): 0.2.17 릴리스 런이 첫 노드(checklist-gate)에서 멎었다 — «발행 뒤» 칸(POSTPUB-VERIFY)이 그 판에
-//    남아 있었고 게이트가 그것을 미완으로 셌다. 컷이 올 때까지 아무도 몰랐다. 새 규칙 = 착지 마감 = 컷 − 30분, 그 30분에 이 점검.
+//    남아 있었고 게이트가 그것을 미완으로 셌다. 컷 전 체크리스트 점검은 착지 마감 컷 −30분, F9 export 는 main HEAD 에서 컷 −60분 수동 실행.
 // ⛔ 읽기 전용 — 칸을 옮기지도, 동결을 바꾸지도, push 하지도 않는다. 옮길 것은 «명령»으로 제안만 한다.
 // ⛔ 게이트 규칙을 다시 쓰지 않는다 — checklist-gate 노드 · release run 진입 검사 · 예약 시작 준비 검사(releaseReadiness, #24557)가
 //    함께 쓰는 단 하나의 판정 cutChecklistGate 를 그대로 부르고, 예약 시작 경로는 releaseReadiness 를 CLI 와 같은 인자로 부른다.
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, mkdtempSync } from 'node:fs';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
 import { cutChecklistGate, listChecklist, type ChecklistItem } from '../../src/release-loop/checklist.js';
 import { getSchedule, formatKst, type ReleaseSchedule } from '../../src/release-loop/release-schedule.js';
 import { readLandingFreeze, landingFreezeMessage, type LandingFreeze } from '../../src/release-loop/landing-freeze.js';
@@ -14,9 +16,10 @@ import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { debug } from '../../src/debug/log.js';
 import { releaseReadiness } from './release-readiness.js';
 import { latestPublishedPreviousVersion, runUnattendedRelease, type UnattendedReleaseDeps } from './unattended-release.js';
+import { loadExportConfig, run as runPublicExport, selectExportFiles } from '../public-export.js';
 
 export type PreflightLevel = 'ok' | 'warn' | 'block';
-export type PreflightCheck = 'checklist' | 'postpub' | 'run-input' | 'freeze' | 'schedule';
+export type PreflightCheck = 'checklist' | 'postpub' | 'run-input' | 'freeze' | 'schedule' | 'export';
 export interface PreflightFinding { level: PreflightLevel; check: PreflightCheck; id?: string; message: string; suggestion?: string }
 export interface GateMeasure { version: string; runId: string; gateSeconds: number; toPublishSeconds?: number }
 const compareStable = (a: string, b: string) => { const x = a.split('.').map(Number), y = b.split('.').map(Number); return x[0]! - y[0]! || x[1]! - y[1]! || x[2]! - y[2]!; };
@@ -27,7 +30,8 @@ export interface PreflightResult {
   blockers: number;
   warnings: number;
   findings: PreflightFinding[];
-  schedule: { cutAt: string; landBy: string | null; publishAt: string | null; publishAtSource: 'option' | 'schedule' | 'cadence' | null } | null;
+  schedule: { cutAt: string; landBy: string | null; publishAt: string | null; publishAtSource: 'option' | 'schedule' | 'cadence' | null; exportCheckAt: string } | null;
+  exportCheck: { mainSha: string; files: number; leaks: number; codeLiterals: number } | null;
   /** The immediately previous release (by version order) whose gate is compared. */
   previousVersion: string | null;
   gateMeasure: GateMeasure | null;
@@ -46,6 +50,72 @@ export interface PreflightDeps {
   releaseRunDeps?: UnattendedReleaseDeps;
   /** The immediately previous release; default = the run input's previousVersion (release ledger). */
   previousVersion?: string;
+  /** Injectable for deterministic preflight tests. Production pins origin/main and scans a disposable checkout. */
+  exportCheck?: () => Promise<{ mainSha: string; files: number; leaks: number; codeLiterals: number }>;
+}
+
+function runGit(cwd: string, args: string[]): string {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 16 << 20 });
+  if (result.status !== 0) throw new Error(`git ${args.join(' ')} 실패 rc=${result.status}: ${(result.stderr ?? '').trim().slice(0, 300)}`);
+  return (result.stdout ?? '').trim();
+}
+
+/** Read-only main snapshot: all checkout and cleanup writes are contained in a disposable temp directory. */
+export async function scanOriginMainExport(): Promise<{ mainSha: string; files: number; leaks: number; codeLiterals: number }> {
+  const repoRoot = runGit(process.cwd(), ['rev-parse', '--show-toplevel']);
+  const mainSha = runGit(repoRoot, ['rev-parse', '--verify', 'origin/main^{commit}']);
+  const temp = mkdtempSync(join(tmpdir(), 'release-preflight-main-'));
+  const snapshot = join(temp, 'checkout');
+  try {
+    runGit(temp, ['clone', '--shared', '--no-checkout', '--quiet', repoRoot, snapshot]);
+    runGit(snapshot, ['read-tree', mainSha]);
+    const tracked = runGit(snapshot, ['ls-files', '-z']).split('\0').filter(Boolean);
+    const trackedSet = new Set(tracked);
+    // `git check-ignore --no-index` applies every nested ignore file, including ones below selected paths.
+    const needed = new Set(tracked.filter((file) => file === '.gitignore' || file.endsWith('/.gitignore')));
+    needed.add('release/public-export.yaml');
+    // Read only the paths the pinned manifest can inspect; the full tracked-path index stays at mainSha.
+    const manifestPath = join(snapshot, 'release/public-export.yaml');
+    const manifest = spawnSync('git', ['-C', snapshot, 'show', `${mainSha}:release/public-export.yaml`], { encoding: 'utf8', maxBuffer: 4 << 20 });
+    if (manifest.status !== 0) throw new Error(`origin/main public export manifest 읽기 실패: ${(manifest.stderr ?? '').trim()}`);
+    mkdirSync(join(snapshot, 'release'), { recursive: true });
+    writeFileSync(manifestPath, manifest.stdout ?? '');
+    const config = loadExportConfig(snapshot);
+    const selected = selectExportFiles(tracked, config);
+    for (const file of selected) needed.add(file);
+    for (const source of Object.values(config.replace)) needed.add(source);
+    if (config.skills) {
+      needed.add('catalog/resources.yaml');
+      needed.add('src/video-pipeline/capabilities.ts');
+      for (const file of tracked) if (/^skills\/[^/]+\/SKILL\.md$/u.test(file)) needed.add(file);
+      for (const file of tracked) {
+        const skill = /^skills\/([^/]+)\//u.exec(file)?.[1];
+        if (skill) mkdirSync(join(snapshot, 'skills', skill), { recursive: true });
+      }
+    }
+    const checkout = spawnSync('git', ['-C', snapshot, 'checkout-index', '--stdin', '-z', '-f'], {
+      input: `${[...needed].filter((file) => trackedSet.has(file)).join('\0')}\0`, encoding: 'utf8', maxBuffer: 16 << 20,
+    });
+    if (checkout.status !== 0) throw new Error(`origin/main export 입력 파일 준비 실패 rc=${checkout.status}: ${(checkout.stderr ?? '').trim().slice(0, 300)}`);
+    let output = '';
+    const originalLog = console.log;
+    const originalError = console.error;
+    console.log = (...args: unknown[]) => { output += `${args.map(String).join(' ')}\n`; };
+    console.error = () => {};
+    let code: number;
+    try { code = runPublicExport(['--leak-check', '--json'], snapshot); }
+    finally { console.log = originalLog; console.error = originalError; }
+    const report = JSON.parse(output.trim()) as {
+      files?: number; leaks?: number; hits?: Array<{ marker: string }>; codeLiterals?: { hits?: number };
+      privateRedactions?: { loaded?: boolean };
+    };
+    if (report.privateRedactions?.loaded !== true) throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    if (typeof report.files !== 'number' || typeof report.leaks !== 'number') throw new Error('public-export 검사 결과가 완전하지 않다');
+    if (code !== (report.leaks > 0 ? 1 : 0)) throw new Error(`public-export 종료 코드와 누수 결과 불일치: rc=${code} leaks=${report.leaks}`);
+    return { mainSha, files: report.files, leaks: report.leaks, codeLiterals: report.codeLiterals?.hits ?? 0 };
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
 }
 
 const POSTPUB_ID = /^POSTPUB-/i;
@@ -127,6 +197,7 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
   const now = deps.now ?? new Date();
   const next = nextPatch(version);
   const findings: PreflightFinding[] = [];
+  let exportCheck: PreflightResult['exportCheck'] = null;
   const moveHint = (id: string) => `elanous release checklist move ${id} --from ${version} --to ${next} --reason "발행 뒤 칸 — 다음 판에서 확인"`;
 
   // 1·2. Checklist gate simulation «at the cut» (the node and the run entry both judge after land-by) ⊕ post-publish cells.
@@ -176,6 +247,17 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
   for (const p of gate.parity ?? []) findings.push({ level: 'warn', check: 'checklist', id: p.id, message: `${p.id} — 화면 짝 경고: ${p.why}` });
   if (!blockReason.size) findings.push({ level: 'ok', check: 'checklist', message: `체크리스트 게이트 모의 통과 — ${data.items.length}칸 · 이월 ${gate.moved.length} · 알려진 문제 ${gate.knownIssues.length}` });
 
+  // 3a. Public export leakage is measured against one pinned origin/main commit, never this possibly dirty branch.
+  try {
+    exportCheck = await (deps.exportCheck ?? scanOriginMainExport)();
+    findings.push(exportCheck.leaks
+      ? { level: 'block', check: 'export', message: `origin/main ${exportCheck.mainSha.slice(0, 12)} 공개 export 누수 ${exportCheck.leaks}건 · ${exportCheck.files} 파일 검사` }
+      : { level: 'ok', check: 'export', message: `origin/main ${exportCheck.mainSha.slice(0, 12)} 공개 export 누수 0건 · ${exportCheck.files} 파일 검사` });
+    if (exportCheck.codeLiterals) findings.push({ level: 'warn', check: 'export', message: `코드 리터럴 표지 ${exportCheck.codeLiterals}건은 문서/주석 누수에서 분리해 기록` });
+  } catch (error) {
+    findings.push({ level: 'block', check: 'export', message: `origin/main 공개 export 검사를 완료하지 못했다 — ${error instanceof Error ? error.message : String(error)}` });
+  }
+
   // 3. The same input check `release run --dry-run` makes.
   let runPrevious: string | undefined;
   try {
@@ -209,7 +291,11 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
     // --publish-at > the stored schedule publish time (`release schedule set --publish-at`) > the October cadence.
     const publishAtSource = deps.publishAt ? 'option' : schedule.publishAt ? 'schedule' : 'cadence';
     const publishAt = deps.publishAt ? new Date(deps.publishAt).toISOString() : schedule.publishAt ?? cadencePublishAt(schedule.cutAt);
-    scheduleOut = { cutAt: schedule.cutAt, landBy: schedule.landBy, publishAt, publishAtSource };
+    const exportCheckAt = new Date(cut - 60 * 60_000).toISOString();
+    scheduleOut = { cutAt: schedule.cutAt, landBy: schedule.landBy, publishAt, publishAtSource, exportCheckAt };
+    findings.push(Date.parse(now.toISOString()) < Date.parse(exportCheckAt)
+      ? { level: 'warn', check: 'schedule', message: `main export 검사 시각 ${formatKst(exportCheckAt)}(컷 − 60분)보다 이르다 · OP가 그 시각에 수동 실행` }
+      : { level: 'ok', check: 'schedule', message: `main export 검사 시각 ${formatKst(exportCheckAt)}(컷 − 60분) · 자동 예약 없음` });
     if (!schedule.landBy) findings.push({ level: 'warn', check: 'schedule', message: `착지 마감 없음 — 컷 ${formatKst(schedule.cutAt)} · 규칙은 컷 − 30분` });
     else if (cut - Date.parse(schedule.landBy) < 30 * 60_000) findings.push({ level: 'warn', check: 'schedule', message: `착지 마감 ${formatKst(schedule.landBy)} 이 컷 − 30분보다 늦다(컷 ${formatKst(schedule.cutAt)})` });
     else findings.push({ level: 'ok', check: 'schedule', message: `일정 — 착지 마감 ${formatKst(schedule.landBy)} · 컷 ${formatKst(schedule.cutAt)}` });
@@ -233,7 +319,7 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
   const blockers = findings.filter((f) => f.level === 'block').length;
   const warnings = findings.filter((f) => f.level === 'warn').length;
   debug.log('release.preflight', 'checked', { version, blockers, warnings });
-  return { version, next, verdict: blockers ? 'block' : warnings ? 'warn' : 'ok', blockers, warnings, findings, schedule: scheduleOut, previousVersion, gateMeasure, fallbackGateMeasure };
+  return { version, next, verdict: blockers ? 'block' : warnings ? 'warn' : 'ok', blockers, warnings, findings, schedule: scheduleOut, exportCheck, previousVersion, gateMeasure, fallbackGateMeasure };
 }
 
 const ICON: Record<PreflightLevel, string> = { ok: '✅', warn: '⚠️', block: '⛔' };

package/scripts/release-loop/probe-pod-host-dirs-live.ts

@@ -20,6 +20,8 @@ function option(name: string, fallback?: string): string {
 }
 
 async function main(): Promise<void> {
+  const actor = process.env.ELANOUS_SEAT?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
+  if (!actor) throw new Error('pod provenance actor missing: ELANOUS_SEAT or USER/LOGNAME required');
   const context = option('context');
   const host = option('host');
   const cluster = option('cluster', 'elanous-pool');
@@ -51,6 +53,9 @@ async function main(): Promise<void> {
       let completed = false;
       try {
         const result = await runPodCommand({
+          provenance: { actorKind: process.env.ELANOUS_SEAT?.trim() ? 'seat' : 'human', actor, character: 'host-dirs-probe',
+            entrance: 'probe', kind: 'probe', run: name, phase: 'exec', requestedAt: new Date().toISOString(),
+            reason: `host directory probe ${arm}` },
           command: ['sh', '-c', 'printf cache-ok > /bun-cache/.host-dir-probe && printf slots-ok > /gate-install-slots/.host-dir-probe && test "$(cat /bun-cache/.host-dir-probe)" = cache-ok && test "$(cat /gate-install-slots/.host-dir-probe)" = slots-ok && rm /bun-cache/.host-dir-probe /gate-install-slots/.host-dir-probe && echo HOST_DIRS_WRITTEN'],
           name,
           namespace, image, imageCommit: null, deadlineSeconds: 120, pollMs: 1_000, statusUnreadableMs: 30_000,

package/scripts/release-loop/publish-node.ts

@@ -1,14 +1,55 @@
 #!/usr/bin/env bun
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { WARNING_ONLY } from './auto-approve-node.js';
+import { BLOCKING_METRIC_NAMES, WARNING_ONLY } from './auto-approve-node.js';
 import { beginLandingMerge, landingFreezeMessage } from '../../src/release-loop/landing-freeze.js';
 import { debug } from '../../src/debug/log.js';
 import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
+import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { prereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
-import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
+import { validatedTuiRegress } from './tui-node-checks.js';
+import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner, type GraphContext } from './node-verdict.js';
+
+/** The approval output alone is not authority: the runner also stores a one-winner decision claim for this visit. */
+export function hasRecordedPublishApproval(context: GraphContext, root: string): boolean {
+  const runId = context.runId;
+  const approval = context.outputs['approve-publish'];
+  if (!runId || !/^[A-Za-z0-9_-]+$/.test(runId) || approval?.outcome !== 'approved'
+    || approval.graphId !== 'release-loop' || approval.runId !== runId || approval.nodeId !== 'approve-publish'
+    || typeof approval.decidedAt !== 'string' || Number.isNaN(Date.parse(approval.decidedAt))) return false;
+  try {
+    const statePath = join(root, 'graph-runs', 'release-loop', `${runId}.json`);
+    const state = JSON.parse(readFileSync(statePath, 'utf8')) as {
+      graphId?: string; runId?: string; path?: string[];
+      nodes?: Array<{ nodeId?: string; ok?: boolean; output?: unknown; decidedAt?: string }>;
+    };
+    const visit = state.path?.lastIndexOf('approve-publish') ?? -1;
+    if (state.graphId !== 'release-loop' || state.runId !== runId || state.path?.at(-1) !== 'publish'
+      || visit < 0 || !Array.isArray(state.nodes)) return false;
+    const node = state.nodes.filter((item) => item.nodeId === 'approve-publish').at(-1);
+    const output = typeof node?.output === 'string' ? JSON.parse(node.output) as Record<string, unknown> : null;
+    if (!node?.ok || node.decidedAt !== approval.decidedAt || output?.runId !== runId
+      || output?.decidedAt !== approval.decidedAt || output?.outcome !== 'approved') return false;
+    const claim = JSON.parse(readFileSync(`${statePath}.${visit + 1}.decision.json`, 'utf8')) as Record<string, unknown>;
+    return claim.nodeId === 'approve-publish' && claim.decision === 'approved'
+      && claim.decidedAt === approval.decidedAt;
+  } catch { return false; }
+}
+
+/** Warning rows may be repeated, but each of the eight fixed gates must occur exactly once in its declared order. */
+export function hasMeasuredApprovalMetrics(metrics: unknown): boolean {
+  if (!Array.isArray(metrics) || !metrics.every((row: unknown) => row && typeof row === 'object'
+    && typeof (row as Record<string, unknown>).name === 'string'
+    && (row as Record<string, unknown>).verdict === 'pass')) return false;
+  const rows = metrics as Array<{ name: string; verdict: string }>;
+  const fixed = rows.filter((row) => !WARNING_ONLY.has(row.name));
+  return fixed.length === BLOCKING_METRIC_NAMES.length
+    && BLOCKING_METRIC_NAMES.every((name, index) => fixed[index]?.name === name)
+    && rows.some((row) => row.name === 'tui-regress')
+    && rows.some((row) => row.name === 'mac-smoke');
+}
 
 export function publicNotes(markdown: string, pages: { pages: Array<{ id: string; slug?: string; source?: string }> }): string {
   if (!Array.isArray(pages.pages)) throw new Error('invalid public pages registry');
@@ -46,7 +87,8 @@ export function waitForAssets(run: CommandRunner, repo: string, tag: string, nam
 }
 
 export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: string,
-  clock: { now: () => number; sleep: (ms: number) => void } = { now: Date.now, sleep: Bun.sleepSync }) {
+  clock: { now: () => number; sleep: (ms: number) => void } = { now: Date.now, sleep: Bun.sleepSync },
+  approvalRoot = effectiveInstanceRoot()) {
   const context = readGraphContext();
   // A resumed graph once invoked this irreversible node at npm-publish, docs-land, and failed.
   // The runner's context is the authority: only the publish visit may publish.
@@ -54,12 +96,21 @@ export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: str
   const version = context.input.version;
   // A measured automatic decision or the existing human approval must authorize publication.
   const auto = context.outputs['auto-approve'];
-  if (context.outputs['approve-publish']?.outcome !== 'approved' &&
+  const regress = validatedTuiRegress(context.outputs.tui?.regress);
+  const approvedForRun = hasRecordedPublishApproval(context, approvalRoot);
+  if (!approvedForRun &&
     !(auto?.outcome === 'ok' && auto.decidedBy === 'release-loop metrics'
-      // The 8 blocking metrics; warning-only rows (tui-regress · mac-smoke) are shown but never counted (V1g · MAC1).
-      && Array.isArray(auto.metrics)
-      && auto.metrics.filter((metric: unknown) => !(metric && typeof metric === 'object' && 'name' in metric && WARNING_ONLY.has(String(metric.name)))).length === 8
-      && auto.metrics.every((metric: unknown) => metric && typeof metric === 'object' && 'verdict' in metric && metric.verdict === 'pass'))) {
+      && !('unmeasured' in regress) && regress.pass === 7 && regress.fail === 0
+      && typeof context.runId === 'string' && context.runId.length > 0 && auto.runId === context.runId
+      && auto.tuiSubcheck && typeof auto.tuiSubcheck === 'object'
+      && (auto.tuiSubcheck as Record<string, unknown>).runId === context.runId
+      && (auto.tuiSubcheck as Record<string, unknown>).level === 'ok'
+      && (auto.tuiSubcheck as Record<string, unknown>).fail === 0
+      && Array.isArray((auto.tuiSubcheck as Record<string, unknown>).failedCheckIds)
+      && ((auto.tuiSubcheck as Record<string, unknown>).failedCheckIds as unknown[]).length === 0
+      && (auto.tuiSubcheck as Record<string, unknown>).approvalRequired === false
+      // Eight fixed metrics; the TUI subcheck is outside that count but its fail/unmeasured verdict still blocks auto-publish.
+      && hasMeasuredApprovalMetrics(auto.metrics))) {
     return { outcome: 'fail' as const, verdict: 'fail' as const, summary: 'publish blocked: neither auto-approve nor approve-publish approved' };
   }
   for (const node of ['gate', 'pwa', 'upgrade', 'tui', 'prepare', 'docs']) {

package/scripts/release-loop/pwa-remote.ts

@@ -0,0 +1,166 @@
+// RELEASE-PWA-NODE-RESILIENCE ① (0.2.36 · 대표 10-20 «PWA 단계도 원격에서»): the release `pwa` node can run its
+// scenario suite on an SSH host (`release.loop.pwaRemote`, e.g. node-b) instead of the busy release machine.
+// 0.2.34 (10-20 18:50~19:13): at 1-min load 100+ on mbp the CDP attach went past 5s and T1b failed twice on reruns,
+// while the same commit alone passed — the release machine's load, not the PWA, decided the verdict.
+//
+// Same shape as the gate's host executor (`--gate-executor host` · `gateRemote` · `gateRemoteMirror`):
+//   ① ensure the bare mirror on the host  ② push the commit to `refs/elanous/pwa/<sha>`
+//   ③ one ssh call: clone the mirror at <sha> into a temp dir, install, run THAT commit's
+//      `pwa-scenarios-node.ts` locally there, print its JSON verdict, remove the temp dir.
+// ⛔ No silent fallback: when any step fails the node reports `error` with the stage and the host's own words
+// and exits 2. It never reruns the suite on the release machine.
+import { spawnSync } from 'node:child_process';
+import { debug } from '../../src/debug/log.js';
+
+/** `[user@]host`. A leading `-` is refused separately (ssh/git would read it as an option — `-oProxyCommand=…`). */
+export const PWA_REMOTE_HOST_PATTERN = /^(?:[\w.-]+@)?[\w.-]+$/;
+export const DEFAULT_PWA_REMOTE_MIRROR = '~/mirror/elanous-agent.git';
+/** Build (≤15m) + boot + warm-up + suite + reruns on the host; the local ssh deadline is only a backstop. */
+export const PWA_REMOTE_TIMEOUT_MS = 75 * 60_000;
+/** The host kills its own work first (shorter than the local backstop) so the temp clone and the ref are cleaned there. */
+export const PWA_REMOTE_LIMIT_SECONDS = 70 * 60;
+/** rc of a run the Perl supervisor stopped after its deadline. */
+const LIMIT_RCS = new Set([124]);
+
+export type PwaRemoteStage = 'input' | 'mirror' | 'push' | 'run' | 'timeout' | 'parse';
+
+export interface PwaRemoteOptions {
+  host: string;
+  commit: string;
+  withCostly: boolean;
+  reruns: number;
+  /** Bare mirror on the host (absolute or `~/…`). Default = the gate's mirror. */
+  mirror?: string;
+  /** Local repository that holds `commit` (pushed from here). */
+  repo: string;
+  timeoutMs?: number;
+}
+
+export interface PwaRemoteResult {
+  /** Exit code for the graph node: 0 pass/flaky · 1 fail · 2 could not run. */
+  exitCode: 0 | 1 | 2;
+  output: Record<string, unknown>;
+}
+
+interface Spawned { rc: number; stdout: string; stderr: string; error?: string }
+export type PwaRemoteSpawn = (cmd: string, args: string[], opts: { cwd: string; timeoutMs: number }) => Spawned;
+
+const defaultSpawn: PwaRemoteSpawn = (cmd, args, opts) => {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^(https?|all)_proxy$/i.test(k)));
+  const r = spawnSync(cmd, args, { cwd: opts.cwd, env, encoding: 'utf8', timeout: opts.timeoutMs, killSignal: 'SIGKILL', maxBuffer: 64 * 1024 * 1024 });
+  return { rc: r.status ?? 255, stdout: r.stdout ?? '', stderr: r.stderr ?? '', ...(r.error ? { error: String(r.error) } : {}) };
+};
+
+export const shQuote = (value: string): string => `'${value.replace(/'/g, `'\\''`)}'`;
+
+/** Validate the host and mirror before anything is spawned. */
+export function checkPwaRemote(host: unknown, mirror: unknown): { host: string; mirror: string } {
+  if (typeof host === 'string' && host.trim().startsWith('-')) throw new Error(`invalid pwa remote host: ${host.trim()} — a leading «-» would be read as an ssh/git option`);
+  if (typeof host !== 'string' || !PWA_REMOTE_HOST_PATTERN.test(host.trim())) throw new Error(`invalid pwa remote host: ${String(host)}`);
+  const m = mirror === undefined ? DEFAULT_PWA_REMOTE_MIRROR : mirror;
+  if (typeof m !== 'string' || !/^(?:\/|~\/)[\w./-]+$/.test(m) || m.split('/').includes('..')) throw new Error(`invalid pwa remote mirror path: ${String(m)}`);
+  return { host: host.trim(), mirror: m };
+}
+
+/** `~/x` stays unquoted at the front so the remote shell expands it; the rest is quoted. */
+function remotePath(path: string): string {
+  return path.startsWith('~/') ? `"$HOME"/${shQuote(path.slice(2))}` : shQuote(path);
+}
+
+/**
+ * The single remote script for step ③ — `sh -c` so the remote login shell (zsh on node-b) does not change its meaning.
+ * - Limit: Perl supervises a separate process group at PWA_REMOTE_LIMIT_SECONDS.
+ *   On timeout it kills the group, including the shell's children, then exits 124.
+ * - Cleanup: traps on EXIT · HUP · INT · TERM remove the temp clone and this run's mirror ref `refs/elanous/pwa/<sha>`
+ *   on success and failure alike — the ref only had to live until the clone fetched it, and deleting «our own» ref
+ *   (not a sweep of `refs/elanous/pwa/*`) cannot race another run on a different commit.
+ */
+export function remoteRunScript(opts: { commit: string; mirror: string; withCostly: boolean; reruns: number; limitSeconds?: number }): string {
+  const sha = shQuote(opts.commit);
+  const ref = shQuote(`refs/elanous/pwa/${opts.commit}`);
+  const limit = String(opts.limitSeconds ?? PWA_REMOTE_LIMIT_SECONDS);
+  const nodeArgs = ['--commit', opts.commit, '--json', '--reruns', String(opts.reruns), ...(opts.withCostly ? ['--with-costly'] : [])].map(shQuote).join(' ');
+  const body = [
+    `git clone --quiet --shared --no-checkout ${remotePath(opts.mirror)} "$1/repo" >&2 || exit 2`,
+    `cd "$1/repo" && git fetch --quiet origin ${ref} >&2 && git checkout --quiet --detach ${sha} >&2 || exit 2`,
+    'bun install --frozen-lockfile >&2 || exit 2',
+    '(cd apps/pwa && bun install --frozen-lockfile) >&2 || exit 2',
+    `exec bun scripts/release-loop/pwa-scenarios-node.ts ${nodeArgs}`,
+  ].join('\n');
+  // Arm the deadline only after the child confirms its new group exists. Otherwise a busy host
+  // can deliver SIGALRM between fork and setpgrp, making kill(-pid) miss every descendant.
+  const supervisor = [
+    'my $seconds = shift;',
+    'pipe(my $ready_r, my $ready_w) or exit 127;',
+    'my $pid = fork(); defined($pid) or exit 127;',
+    'if ($pid == 0) { close $ready_r; defined(setpgrp(0, 0)) or exit 127; syswrite($ready_w, "1") == 1 or exit 127; close $ready_w; exec @ARGV or exit 127; }',
+    'close $ready_w; my $ready = ""; unless (read($ready_r, $ready, 1) == 1) { kill 9, -$pid; kill 9, $pid; waitpid($pid, 0); exit 127; } close $ready_r;',
+    'local $SIG{ALRM} = sub { kill 9, -$pid; waitpid($pid, 0); exit 124; };',
+    'alarm $seconds; waitpid($pid, 0); alarm 0;',
+    'exit(($? & 127) ? 128 + ($? & 127) : ($? >> 8));',
+  ].join(' ');
+  return [
+    'PATH=$HOME/.bun/bin:/opt/homebrew/bin:/usr/local/bin:$PATH; export PATH',
+    'command -v perl >/dev/null 2>&1 || { echo "pwa remote requires perl" >&2; exit 127; }',
+    'D=$(mktemp -d /tmp/pwa-node-remote-XXXXXX) || exit 2',
+    `cleanup() { cd /tmp; rm -rf "$D"; git --git-dir=${remotePath(opts.mirror)} update-ref -d ${ref} 2>/dev/null; }`,
+    `trap 'cleanup' EXIT`,
+    `trap 'cleanup; trap - EXIT; exit 129' HUP`,
+    `trap 'cleanup; trap - EXIT; exit 130' INT`,
+    `trap 'cleanup; trap - EXIT; exit 143' TERM`,
+    `lim() { perl -e ${shQuote(supervisor)} ${limit} "$@"; }`,
+    `lim sh -c ${shQuote(body)} pwa-node "$D"`,
+  ].join('\n');
+}
+
+const COMMIT_40 = /^[0-9a-f]{40}$/;
+
+const tail = (text: string, n = 600): string => text.trim().slice(-n);
+
+function lastJson(stdout: string): Record<string, unknown> | undefined {
+  const line = stdout.split('\n').reverse().find((l) => l.trim().startsWith('{'));
+  if (!line) return undefined;
+  try {
+    const value: unknown = JSON.parse(line);
+    return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+  } catch { return undefined; }
+}
+
+/** Run the PWA scenario node on `host`. Never falls back to the local machine. */
+export function runPwaRemote(opts: PwaRemoteOptions, spawn: PwaRemoteSpawn = defaultSpawn): PwaRemoteResult {
+  const { host, mirror } = checkPwaRemote(opts.host, opts.mirror);
+  if (!COMMIT_40.test(opts.commit)) {
+    const error = `remote ${host} input refused: commit must be a full 40-hex sha (got ${JSON.stringify(opts.commit)}) — a short sha can name a different commit on the host mirror`;
+    debug.log('release-loop.pwa', 'remote-failed', { host, stage: 'input', rc: null, detail: error }, { level: 'warn' });
+    return { exitCode: 2, output: { verdict: 'error', commit: opts.commit, withCostly: opts.withCostly, executor: 'host', host, cells: [], error, remote: { stage: 'input', rc: null } } };
+  }
+  const timeoutMs = opts.timeoutMs ?? PWA_REMOTE_TIMEOUT_MS;
+  const base = { commit: opts.commit, withCostly: opts.withCostly, executor: 'host', host };
+  const started = Date.now();
+  debug.log('release-loop.pwa', 'remote-start', { host, mirror, commit: opts.commit, withCostly: opts.withCostly, reruns: opts.reruns });
+  const fail = (stage: PwaRemoteStage, run: Spawned | undefined, detail: string): PwaRemoteResult => {
+    const error = `remote ${host} ${stage} failed${run ? ` (rc=${run.rc})` : ''}: ${detail || 'no output'} — 원격 실패는 mbp 로 폴백하지 않는다`;
+    debug.log('release-loop.pwa', 'remote-failed', { host, stage, rc: run?.rc ?? null, detail: detail.slice(0, 600), elapsedMs: Date.now() - started }, { level: 'warn' });
+    return { exitCode: 2, output: { verdict: 'error', ...base, cells: [], error, remote: { stage, rc: run?.rc ?? null } } };
+  };
+
+  // ① mirror — a bare repo the commit can be pushed to (the gate uses the same one).
+  const ensure = `test -d ${remotePath(mirror)} || { mkdir -p "$(dirname ${remotePath(mirror)})" && git init --quiet --bare ${remotePath(mirror)}; }`;
+  const m = spawn('ssh', ['--', host, `sh -c ${shQuote(ensure)}`], { cwd: '/tmp', timeoutMs: 120_000 });
+  if (m.rc !== 0) return fail('mirror', m, tail(`${m.stderr}\n${m.error ?? ''}`));
+
+  // ② push the commit from the release machine.
+  const pushTarget = mirror.startsWith('~/') ? mirror.slice(2) : mirror;
+  const p = spawn('git', ['push', '--quiet', '--force', '--', `${host}:${pushTarget}`, `${opts.commit}:refs/elanous/pwa/${opts.commit}`], { cwd: opts.repo, timeoutMs: 600_000 });
+  if (p.rc !== 0) return fail('push', p, tail(`${p.stderr}\n${p.error ?? ''}`));
+
+  // ③ one call: clone · install · run the commit's own node there.
+  const script = remoteRunScript({ commit: opts.commit, mirror, withCostly: opts.withCostly, reruns: opts.reruns });
+  const r = spawn('ssh', ['--', host, `sh -c ${shQuote(script)}`], { cwd: '/tmp', timeoutMs });
+  const data = lastJson(r.stdout);
+  if (!data) return fail(r.rc === 0 ? 'parse' : LIMIT_RCS.has(r.rc) ? 'timeout' : 'run', r, tail(`${r.stderr}\n${r.error ?? ''}`));
+  const verdict = data.verdict;
+  const exitCode: 0 | 1 | 2 = verdict === 'pass' || verdict === 'flaky' ? (r.rc === 0 ? 0 : 2) : verdict === 'fail' ? 1 : 2;
+  debug.log('release-loop.pwa', 'remote-result', { host, verdict: typeof verdict === 'string' ? verdict : null, rc: r.rc, exitCode, elapsedMs: Date.now() - started });
+  return { exitCode, output: { ...data, ...base, ...(exitCode === 2 && typeof data.error !== 'string' ? { error: `remote ${host} run rc=${r.rc} verdict=${String(verdict)}: ${tail(r.stderr, 300)}` } : {}) } };
+}

package/scripts/release-loop/pwa-scenarios-node.ts

@@ -3,6 +3,10 @@
  * Release-loop ④ — run the PWA scenario suite on one commit, in isolation, and print one verdict.
  *
  *   bun scripts/release-loop/pwa-scenarios-node.ts --commit <sha> [--with-costly] [--reruns 2] [--json]
+ *     [--remote <ssh-host> [--remote-mirror <path>]]
+ *
+ * `--remote` (release.loop.pwaRemote) runs the same steps on that host — see pwa-remote.ts.
+ * A remote failure is reported as `error` (exit 2); it never falls back to this machine.
  *
  * Steps: temp worktree at <sha> → `nexus build` → isolated nexus (`--test`, leased test port)
  * → warm-up pass (discarded — the first page load after boot is slow and made T4a/N5a fail on the
@@ -18,14 +22,17 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { decideVerdict, exitCodeFor, idsToRerun, type CellRun, type NodeVerdict } from './pwa-node-verdict';
 import { envLiteral } from '../../src/platform/env-literal.js';
+import { checkPwaRemote, runPwaRemote } from './pwa-remote';
 
-interface Options { commit: string; withCostly: boolean; reruns: number; json: boolean }
+interface Options { commit: string; withCostly: boolean; reruns: number; json: boolean; remote?: string; remoteMirror?: string }
 
-function parseArgs(argv: readonly string[]): Options {
+export function parseArgs(argv: readonly string[]): Options {
   const opts: Options = { commit: '', withCostly: false, reruns: 2, json: false };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === '--commit') opts.commit = argv[++i] ?? '';
+    else if (arg === '--remote') opts.remote = argv[++i] ?? '';
+    else if (arg === '--remote-mirror') opts.remoteMirror = argv[++i] ?? '';
     else if (arg === '--with-costly') opts.withCostly = true;
     else if (arg === '--json') opts.json = true;
     else if (arg === '--reruns') opts.reruns = Number(argv[++i] ?? '2');
@@ -33,6 +40,8 @@ function parseArgs(argv: readonly string[]): Options {
   }
   if (!/^[0-9a-f]{7,40}$/i.test(opts.commit)) throw new Error('--commit <sha> is required');
   if (!Number.isInteger(opts.reruns) || opts.reruns < 0 || opts.reruns > 5) throw new Error('--reruns must be 0..5');
+  if (opts.remoteMirror !== undefined && opts.remote === undefined) throw new Error('--remote-mirror requires --remote');
+  if (opts.remote !== undefined) checkPwaRemote(opts.remote, opts.remoteMirror);
   return opts;
 }
 
@@ -65,6 +74,13 @@ async function main(): Promise<number> {
   let opts: Options;
   try { opts = parseArgs(process.argv.slice(2)); } catch (e) { log(String(e)); return 2; }
   const repo = resolve('.');
+  if (opts.remote !== undefined) {
+    log(`remote ${opts.remote} · ${opts.commit.slice(0, 10)}`);
+    const remote = runPwaRemote({ host: opts.remote, ...(opts.remoteMirror ? { mirror: opts.remoteMirror } : {}), commit: opts.commit, withCostly: opts.withCostly, reruns: opts.reruns, repo });
+    if (opts.json) console.log(JSON.stringify(remote.output));
+    else console.log(`pwa-node: ${String(remote.output.verdict)} · ${opts.commit.slice(0, 10)} · host ${opts.remote}${typeof remote.output.error === 'string' ? `\n  error: ${remote.output.error}` : ''}`);
+    return remote.exitCode;
+  }
   const work = mkdtempSync(join(tmpdir(), 'pwa-node-'));
   const worktree = join(work, 'tree');
   let nexusPid: number | undefined;
@@ -137,4 +153,4 @@ async function main(): Promise<number> {
   return verdict ? exitCodeFor(verdict.verdict) : 2;
 }
 
-process.exit(await main());
+if (import.meta.main) process.exit(await main());

package/scripts/release-loop/resume-cap.ts

@@ -0,0 +1,56 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { DecisionLedger } from '../../src/decisions/decision-ledger.js';
+import type { GraphRunState } from '../../src/graph-runner/runner.js';
+import { isReleaseVersion } from './release-version.js';
+
+export const RELEASE_RESUME_LIMIT = 2;
+
+/** Called under the OP seat flock, before any branch-tip or graph-run mutation. */
+export function reserveReleaseResumeAttempt(state: GraphRunState, root: string, options: {
+  now?: () => Date;
+  openCard?: (version: string, runId: string, reason: string) => string;
+  /** Under the OP flock, check capacity before tip preflight without consuming an attempt. */
+  checkOnly?: boolean;
+  /** A dry-run reports the cap without creating an OP decision card. */
+  noDecision?: boolean;
+} = {}): { attempt: number; path: string } {
+  const version = (state.input as { version?: unknown } | undefined)?.version;
+  if (typeof version !== 'string' || !isReleaseVersion(version) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(state.runId))
+    throw new Error('release resume cap requires a valid saved version and run id');
+  const path = join(root, 'release', version, 'resume-attempts', `${state.runId}.json`);
+  const card = options.openCard ?? ((v: string, id: string, reason: string) => {
+    const ref = `release-resume-cap:${v}:${id}`;
+    return new DecisionLedger({ stateDir: root, now: options.now }).raiseOnce({
+      title: `${v} release resume limit: ${id}`, category: 'scope',
+      scqa: { s: `Release ${v} run ${id} has reached its two-resume limit.`, c: reason,
+        q: 'Should this release be deferred or moved to the next version?' },
+      options: [{ key: 'a', label: 'Defer this release', consequence: 'Stop this run and reschedule the release.' },
+        { key: 'b', label: 'Move to next version', consequence: 'Stop this run and carry the work to a new release.' }],
+      recommendation: { skipped: true, reason: 'OP must choose the release disposition.' },
+      raisedBy: { agent: 'release-resume-cap', track: 'TC' }, refs: [ref],
+    }, ref).id;
+  });
+  const blocked = (reason: string): never => {
+    if (options.noDecision) throw new Error(`release resume limit reached: ${reason}`);
+    throw new Error(`release resume limit reached — decision ${card(version, state.runId, reason)}: ${reason}`);
+  };
+  if (options.noDecision && !options.checkOnly) throw new Error('noDecision requires checkOnly');
+  if (!existsSync(path) && state.resume) blocked('saved run was resumed before attempt counting; prior count is unknown');
+  const prior = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) as unknown : { version, runId: state.runId, attempts: [] };
+  if (!prior || typeof prior !== 'object' || Array.isArray(prior)) throw new Error('release resume attempts ledger invalid');
+  const saved = prior as { version?: unknown; runId?: unknown; attempts?: unknown };
+  if (saved.version !== version || saved.runId !== state.runId || !Array.isArray(saved.attempts)
+    || saved.attempts.some(value => typeof value !== 'string' || !Number.isFinite(Date.parse(value))))
+    throw new Error('release resume attempts ledger invalid');
+  if (saved.attempts.length >= RELEASE_RESUME_LIMIT) blocked(`${saved.attempts.length} resumes already recorded`);
+  if (options.checkOnly) return { attempt: saved.attempts.length + 1, path };
+  const at = (options.now ?? (() => new Date()))().toISOString();
+  const next = { version, runId: state.runId, attempts: [...saved.attempts, at] };
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try { writeFileSync(temp, `${JSON.stringify(next)}\n`, { mode: 0o600 }); renameSync(temp, path); }
+  finally { try { unlinkSync(temp); } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; } }
+  return { attempt: next.attempts.length, path };
+}