elanous 0.2.34 → 0.2.35

package/scripts/release-loop/gate-radius-live.ts

@@ -0,0 +1,177 @@
+/** A hard rehearsal's immutable gate evidence may select the next release's cut tests, but never authorizes a carry. */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { changedFilesBetween, planPartialRegate, testFileOfId, type PartialPlan } from './gate-partial.js';
+import { CODE_FILE, gitClosureTree, testsReachingChanged } from './gate-closure.js';
+import { versionOnlyBumps } from './gate-radius-shadow.js';
+import { gateAssignableTestsAtCommit, gateBaselineReceipt, type GateBaselineReceipt } from './gate-baseline-receipt.js';
+import { parsePodPool, remoteImageId } from '../../src/task-orchestrator/surfaces/pod-pool.js';
+import { podCommandImageFor } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const DIGEST = /^sha256:[0-9a-f]{64}$/i;
+const TEST = /\.test\.(?:tsx?|jsx?|mts|cts)$/;
+
+export function hardRehearsalGateVersion(version: string, runId: string): string {
+  const id = /^hard-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.exec(runId)?.[1];
+  if (!/^\d+\.\d+\.\d+$/.test(version) || !id) throw new Error('invalid hard rehearsal gate identity');
+  return `${version}-rc.${BigInt(`0x${id.replaceAll('-', '')}`).toString(10)}`;
+}
+
+export function hardRehearsalGateArgs(version: string, runId: string, commit: string, previous: string, pool: string): string[] {
+  return ['scripts/release-loop/gate-node.ts', '--commit', commit, '--version', hardRehearsalGateVersion(version, runId),
+    '--baseline-version', previous, '--executor', 'pod', '--pod-pool', pool, '--pod-shards', '12', '--rehearsal-baseline', '--json'];
+}
+
+export interface LiveRadiusDecision { plan: PartialPlan | null; reason: string; rehearsalRunId?: string }
+
+/** Read the image ID on every candidate host before deciding. A later Job must still prove its actual image. */
+export function preflightGateImageDigest(pool: string): string | null {
+  try {
+    const image = podCommandImageFor([], true);
+    const members = parsePodPool(pool);
+    if (!members.length) return null;
+    const ids = members.map((member) => {
+      if (member.sshHost) return remoteImageId(member, image);
+      const result = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      return result.status === 0 ? result.stdout.trim() : null;
+    });
+    return ids.every((id) => id && DIGEST.test(id) && id === ids[0]) ? ids[0]! : null;
+  } catch { return null; }
+}
+
+/** The current sweep ID and exact root inventory prevent stale Pod logs from proving a new partial run's image. */
+export function partialGateImagesMatch(root: string, version: string, digest: string, commit: string,
+  sweep: { id: string; shards: number; files: readonly string[] } | undefined): boolean {
+  if (!SHA.test(commit) || !sweep || !/^[0-9a-f-]{36}$/i.test(sweep.id)
+    || !Number.isSafeInteger(sweep.shards) || sweep.shards < 1) return false;
+  try {
+    const dir = join(root, 'release', version, 'gate-logs', 'cut-partial');
+    const names = readdirSync(dir).filter((name) => /^pod-\d+(?:-[\w-]+)?\.json$/.test(name));
+    const allRows = names.map((name) => ({ name, ...JSON.parse(readFileSync(join(dir, name), 'utf8')) as {
+      commit?: string; sweepId?: string; shardCount?: number; files?: unknown; imageDigest?: string;
+      attemptId?: string; parentAttempt?: string } }));
+    const rows = allRows.filter((row) => row.sweepId === sweep.id);
+    const roots = rows.filter((row) => /^pod-\d+\.json$/.test(row.name));
+    if (roots.length !== sweep.shards || roots.some((row) => row.shardCount !== sweep.shards
+      || row.commit !== commit || !Array.isArray(row.files) || !row.attemptId || row.imageDigest !== digest)) return false;
+    if (allRows.some((row) => /^pod-\d+\.json$/.test(row.name)
+      && row.commit === commit && row.sweepId !== sweep.id)) return false;
+    if (allRows.some((row) => row.commit === commit && !row.sweepId)) return false;
+    const indices = roots.map((row) => Number(/^pod-(\d+)\.json$/.exec(row.name)![1]));
+    if (new Set(indices).size !== sweep.shards || indices.some((index) => index < 0 || index >= sweep.shards)) return false;
+    const files = roots.flatMap((row) => row.files as string[]);
+    if (files.some((file) => typeof file !== 'string')
+      || JSON.stringify(files.sort()) !== JSON.stringify([...sweep.files].sort())) return false;
+    const attempts = new Set(roots.map((row) => row.attemptId));
+    let pending = allRows.filter((row) => !/^pod-\d+\.json$/.test(row.name));
+    for (let count = 0; pending.length && count < allRows.length; count++) {
+      const connected = pending.filter((row) => row.parentAttempt && attempts.has(row.parentAttempt));
+      if (!connected.length) break;
+      if (connected.some((row) => row.sweepId !== sweep.id || row.commit !== commit
+        || !row.attemptId || row.imageDigest !== digest)) return false;
+      for (const row of connected) attempts.add(row.attemptId);
+      pending = pending.filter((row) => !connected.includes(row));
+    }
+    return !pending.some((row) => row.sweepId === sweep.id || (row.commit === commit && !row.sweepId));
+  } catch { return false; }
+}
+
+/** Every missing or mismatched proof returns a full gate. The caller uses this only when no explicit resume plan exists. */
+export function planHardRehearsalRadius(input: { root: string; repo: string; version: string; forCommit: string;
+  graphPins: { graphSha: string; recipeSha: string } | null; envFingerprint: string;
+  imageDigest: string | null }): LiveRadiusDecision {
+  const full = (reason: string): LiveRadiusDecision => ({ plan: null, reason });
+  if (!/^\d+\.\d+\.\d+$/.test(input.version) || !SHA.test(input.forCommit)) return full('invalid release identity');
+  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest))
+    return full('current graph, environment or Pod image identity unmeasured');
+  try {
+    const stamps = ['hard-5h', 'hard-mid'].map((step) => {
+      const path = join(input.root, 'release', input.version, 'rehearsal', `${step}.json`);
+      if (!existsSync(path)) return null;
+      const stamp = JSON.parse(readFileSync(path, 'utf8')) as {
+        version?: string; step?: string; outcome?: string; sha?: string; endedAt?: string; hardGateRunId?: string;
+        hardGate?: { commit?: string; executor?: string; outcome?: string; introduced?: unknown[] };
+      };
+      return { step, stamp, ended: Date.parse(stamp.endedAt ?? '') };
+    }).filter((row): row is NonNullable<typeof row> => row !== null);
+    if (!stamps.length) return full('no clean hard rehearsal receipt');
+    if (stamps.some((row) => !Number.isFinite(row.ended))) return full('hard rehearsal completion time unmeasured');
+    stamps.sort((a, b) => b.ended - a.ended);
+    if (stamps.length > 1 && stamps[0]!.ended === stamps[1]!.ended) return full('hard rehearsal order ambiguous');
+    for (const { step, stamp } of stamps.slice(0, 1)) {
+      if (stamp.version !== input.version || stamp.step !== step || stamp.outcome !== 'ok' || !stamp.sha || !SHA.test(stamp.sha)
+        || stamp.hardGate?.outcome !== 'ok' || stamp.hardGate.commit !== stamp.sha || stamp.hardGate.executor !== 'pod'
+        || !Array.isArray(stamp.hardGate.introduced) || stamp.hardGate.introduced.length)
+        return full('latest hard rehearsal is not clean');
+      let gateVersion: string;
+      try { gateVersion = hardRehearsalGateVersion(input.version, stamp.hardGateRunId ?? ''); }
+      catch { return full('hard rehearsal run identity invalid'); }
+      const dir = join(input.root, 'release', gateVersion);
+      const verdict = JSON.parse(readFileSync(join(dir, 'gate-verdict.json'), 'utf8')) as {
+        commit?: string; outcome?: string; baselineReceipt?: GateBaselineReceipt };
+      const failures = JSON.parse(readFileSync(join(dir, 'gate-failures.json'), 'utf8')) as {
+        commit?: string; failures?: string[]; errors?: string[] };
+      const receipt = verdict.baselineReceipt;
+      if (verdict.commit !== stamp.sha || verdict.outcome !== 'ok' || failures.commit !== stamp.sha
+        || !Array.isArray(failures.failures) || failures.failures.length !== 0
+        || !Array.isArray(failures.errors) || failures.errors.length !== 0
+        || !receipt || receipt.schema !== 1 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
+        || receipt.graphSha !== input.graphPins.graphSha || receipt.recipeSha !== input.graphPins.recipeSha
+        || receipt.envFingerprint !== input.envFingerprint || receipt.imageDigest !== input.imageDigest.toLowerCase()
+        || !Number.isSafeInteger(receipt.files) || receipt.files < 1 || !Number.isSafeInteger(receipt.shards) || receipt.shards < 1)
+        return full('hard rehearsal receipt or current execution identity differs');
+      const recomputed = gateBaselineReceipt({ root: input.root, version: gateVersion, commit: stamp.sha,
+        fullSweep: true, graphPins: input.graphPins, envFingerprint: input.envFingerprint });
+      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest || recomputed.files !== receipt.files
+        || recomputed.shards !== receipt.shards) return full(`hard rehearsal Pod proof differs: ${recomputed.reason}`);
+      const ancestor = spawnSync('git', ['merge-base', '--is-ancestor', stamp.sha, input.forCommit], { cwd: input.repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (ancestor.status !== 0 || ancestor.error) return full('hard rehearsal commit is not an ancestor');
+      const expectedFiles = gateAssignableTestsAtCommit(input.repo, stamp.sha);
+      const measuredFiles = readdirSync(join(dir, 'gate-logs', 'cut')).filter((name) => /^pod-\d+\.json$/.test(name))
+        .flatMap((name) => {
+          const row = JSON.parse(readFileSync(join(dir, 'gate-logs', 'cut', name), 'utf8')) as { files?: unknown };
+          return Array.isArray(row.files) ? row.files : [];
+        });
+      if (!expectedFiles || JSON.stringify(measuredFiles.sort()) !== JSON.stringify(expectedFiles)
+        || measuredFiles.length !== receipt.files)
+        return full('hard rehearsal file inventory differs from receipt');
+      const tree = gitClosureTree(input.repo, input.forCommit);
+      const tests = tree.files.filter((file) => TEST.test(file));
+      const changed = changedFilesBetween(input.repo, stamp.sha, input.forCommit);
+      const bumps = versionOnlyBumps(input.repo, stamp.sha, input.forCommit, input.version, changed);
+      const effective = changed.filter((file) => !bumps.includes(file));
+      // A version-only JSON/lock bump is still observable to tests that read it. Follow those literal readers and
+      // opaque tests before removing the bump from the ordinary code-only partial planner.
+      const versionEnvReaders = bumps.includes('package.json')
+        ? tree.files.filter((file) => CODE_FILE.test(file) && tree.read(file)?.includes('npm_package_version')) : [];
+      const bumpRadius = bumps.length ? testsReachingChanged(tree, [...bumps, ...versionEnvReaders], tests) : null;
+      if (bumpRadius && !bumpRadius.ok) return full(bumpRadius.reason);
+      const planned = planPartialRegate({ version: input.version, priorCommit: stamp.sha, forCommit: input.forCommit,
+        changedFiles: effective, priorFailures: failures.failures, priorErrors: failures.errors ?? [],
+        existsAtTip: (file) => tree.files.includes(file),
+        closure: (code) => testsReachingChanged(tree, code, tests) });
+      if (!planned.ok && effective.length) return full(planned.reason);
+      let fileSet: string[];
+      let base: PartialPlan;
+      if (planned.ok) {
+        if (planned.plan.kind === 'carry' && !bumpRadius?.ok) return full('docs-only carry requires full gate across releases');
+        base = planned.plan.kind === 'carry' ? { ...planned.plan, kind: undefined } : planned.plan;
+        fileSet = planned.plan.files;
+      } else {
+        let priorFiles: string[];
+        try { priorFiles = [...failures.failures, ...(failures.errors ?? [])].map(testFileOfId); }
+        catch { return full('hard rehearsal failure ids unreadable'); }
+        base = { version: input.version, priorCommit: stamp.sha, forCommit: input.forCommit,
+          files: [], priorFailures: failures.failures, priorErrors: failures.errors ?? [] };
+        fileSet = priorFiles;
+      }
+      const files = [...new Set([...fileSet, ...(bumpRadius?.ok ? bumpRadius.tests : [])])].sort();
+      if (!files.length || files.some((file) => !tests.includes(file))) return full('empty or missing rehearsal radius requires full gate');
+      return { plan: { ...base, files }, reason: 'hard rehearsal receipt and import radius verified', rehearsalRunId: stamp.hardGateRunId };
+    }
+    return full('no clean hard rehearsal receipt');
+  } catch (error) { return full(`hard rehearsal evidence unreadable: ${String(error)}`); }
+}

package/scripts/release-loop/gate-radius-shadow.ts

@@ -38,7 +38,7 @@ function blob(repo: string, commit: string, file: string): unknown {
 }
 
 /** Remove only the fields version-node itself changes; any other JSON difference leaves a full shadow plan. */
-function versionOnlyBumps(repo: string, from: string, to: string, version: string, changed: readonly string[]): string[] {
+export function versionOnlyBumps(repo: string, from: string, to: string, version: string, changed: readonly string[]): string[] {
   if (!changed.includes('package.json')) return [];
   const prior = blob(repo, from, 'package.json') as Record<string, unknown>;
   const next = blob(repo, to, 'package.json') as Record<string, unknown>;

package/scripts/release-loop/node-verdict.ts

@@ -72,6 +72,17 @@ export function cutoffNotesEmpty(data: Record<string, unknown> | undefined): boo
   return Array.isArray(data?.escalate) && (data.escalate as Array<{ kind?: string }>).some((item) => item?.kind === 'notes-empty');
 }
 
+/**
+ * RELEASE-PWA-NODE-RESILIENCE ① — the pwa node's argv. `release.loop.pwaRemote` (copied into the run input) picks
+ * the SSH host the suite runs on; absent = this machine (today's argv, byte-identical). One setting, like `gateRemote`.
+ */
+export function pwaNodeArgs(commit: string, input: Record<string, unknown>): string[] {
+  const remote = input.pwaRemote;
+  if (remote !== undefined && (typeof remote !== 'string' || !remote.trim())) throw new Error(`release.loop.pwaRemote must be an ssh host: ${String(remote)}`);
+  return ['scripts/release-loop/pwa-scenarios-node.ts', '--commit', commit, '--with-costly', '--json',
+    ...(typeof remote === 'string' ? ['--remote', remote.trim()] : [])];
+}
+
 // Existing cutoff/PWA/TUI programs have different output conventions; normalize them at the graph boundary.
 if (import.meta.main) {
   const node = process.argv[2];
@@ -84,7 +95,7 @@ if (import.meta.main) {
     const predecessor = node === 'pwa' ? 'gate' : node === 'tui' ? 'upgrade' : 'version-release';
     if (context.outputs[predecessor]?.outcome !== 'ok') throw new Error(`${predecessor} did not pass`);
     const args = node === 'cutoff' ? ['scripts/release-loop/cutoff.ts', '--version', version, '--cutoff', commit, '--baseline', `v${context.input.previousVersion}`, '--json']
-      : node === 'pwa' ? ['scripts/release-loop/pwa-scenarios-node.ts', '--commit', commit, '--with-costly', '--json']
+      : node === 'pwa' ? pwaNodeArgs(commit, context.input)
       : node === 'tui' ? ['scripts/release-loop/tui-sim-node.ts', '--commit', commit, '--json'] : (() => { throw new Error(`unknown node: ${node}`); })();
     const run = runCommand('bun', args);
     if (run.stderr) process.stderr.write(run.stderr);

package/scripts/release-loop/npm-publish-node.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { sendOutbound } from '../../src/domains/outbound-alert.js';
 import { effectiveInstanceRoot, prodInstanceRoot } from '../../src/instance/resolve.js';
@@ -10,8 +10,11 @@ import { emitNodeResult, readGraphContext, type GraphContext } from './node-verd
 import { prereleaseKind } from './release-version.js';
 
 type Result = { outcome: 'ok' | 'fail'; verdict: 'pass' | 'fail'; summary: string; npm?: 'published' | 'already-published' | 'staged-not-visible'; humanAction?: 'npm-support' };
-type Exec = (command: string, args: string[], env?: NodeJS.ProcessEnv) => { status: number | null; stdout: string; stderr: string };
+type ExecResult = { status: number | null; stdout: string; stderr: string; durationMs?: number; signal?: NodeJS.Signals | null };
+type Exec = (command: string, args: string[], env?: NodeJS.ProcessEnv) => ExecResult;
 type Registry = (url: string) => Promise<{ status: number; body: unknown }>;
+const REGISTRY_FETCH_TIMEOUT_MS = 15_000;
+type PublishSpawn = { version: string; durationMs: number; status: number | null; signal: NodeJS.Signals | null };
 export interface NpmPublishDeps {
   exec?: Exec;
   registry?: Registry;
@@ -21,16 +24,27 @@ export interface NpmPublishDeps {
   productionRoot?: string;
   alert?: (text: string, kind: string) => boolean;
   log?: (version: string, waitedMinutes: number) => void;
+  publishSpawn?: (event: PublishSpawn) => void;
 }
 
 const exec: Exec = (command, args, env) => {
+  const startedAt = performance.now();
   const result = spawnSync(command, args, { encoding: 'utf8', env: env ?? process.env, maxBuffer: 1024 * 1024, timeout: 300_000 });
-  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? String(result.error ?? '') };
-};
-const registry: Registry = async (url) => {
-  const response = await fetch(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(15_000) });
-  return { status: response.status, body: response.ok ? await response.json() : null };
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? String(result.error ?? ''), durationMs: Math.ceil(performance.now() - startedAt), signal: result.signal };
 };
+export async function fetchNpmRegistry(url: string, timeoutMs = REGISTRY_FETCH_TIMEOUT_MS): Promise<{ status: number; body: unknown }> {
+  const timeout = AbortSignal.timeout(timeoutMs);
+  let response: Response;
+  try {
+    response = await fetch(url, { headers: { accept: 'application/json' }, signal: timeout });
+    return { status: response.status, body: response.ok ? await response.json() : null };
+  }
+  catch (error) {
+    if (timeout.aborted) throw Object.assign(new Error(`registry request exceeded ${timeoutMs}ms`), { name: 'NpmRegistryFetchTimeoutError', timeoutMs });
+    throw error;
+  }
+}
+const registry: Registry = fetchNpmRegistry;
 const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
 const PACKAGE_URL = 'https://registry.npmjs.org/elanous';
 
@@ -44,6 +58,33 @@ function metadata(value: unknown): { name?: string; version?: string } {
   if (!value || typeof value !== 'object') return {};
   return value as { name?: string; version?: string };
 }
+function registryFailure(error: unknown, url: string): Error {
+  const name = error instanceof Error ? error.name : '';
+  const message = error instanceof Error ? error.message : String(error);
+  const endpoint = (() => { try { return new URL(url).pathname; } catch { return url; } })();
+  if (name === 'NpmRegistryFetchTimeoutError') {
+    const timeoutMs = error && typeof error === 'object' && 'timeoutMs' in error && typeof error.timeoutMs === 'number' ? error.timeoutMs : REGISTRY_FETCH_TIMEOUT_MS;
+    return new Error(`npm registry fetch timeout after ${timeoutMs}ms (${endpoint || '/'})`);
+  }
+  return new Error(`npm registry fetch failed (${endpoint || '/'}): ${message}`);
+}
+function publishLogDirectory(context: GraphContext, stateDir: string): string {
+  const contextLocation = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (contextLocation && !contextLocation.trimStart().startsWith('{')) {
+    const contextPath = resolve(contextLocation);
+    const runDirectory = dirname(contextPath);
+    const runDirectoryName = basename(runDirectory);
+    if (basename(contextPath).endsWith('.json') && runDirectoryName.endsWith('.json.contexts')) {
+      const pathRunId = runDirectoryName.slice(0, -'.json.contexts'.length);
+      if (context.runId && pathRunId !== context.runId) throw new Error('npm publish graph context runId/path mismatch');
+      return join(runDirectory, 'npm-publish');
+    }
+  }
+  if (context.runId && /^[a-zA-Z0-9._-]+$/.test(context.runId))
+    return join(stateDir, 'graph-runs', 'release-loop', `${context.runId}.json.contexts`, 'npm-publish');
+  // Direct non-graph calls have no run folder; retain compatibility in their version output directory.
+  return join(stateDir, 'release', context.input.version, 'npm-publish');
+}
 
 export async function runNpmPublish(context: GraphContext = readGraphContext(), deps: NpmPublishDeps = {}): Promise<Result> {
   const version = context.input.version;
@@ -68,9 +109,16 @@ export async function runNpmPublish(context: GraphContext = readGraphContext(),
     const pkg = metadata(JSON.parse(archive.stdout));
     if (pkg.name !== 'elanous' || pkg.version !== version) throw new Error('npm archive package name/version mismatch');
     const inspect = async (): Promise<{ visible: boolean; tagged: boolean }> => {
-      const [manifest, tags] = await Promise.all([readRegistry(`${PACKAGE_URL}/${version}`), readRegistry(PACKAGE_URL)]);
-      if (manifest.status !== 200 && manifest.status !== 404) throw new Error(`npm registry version lookup failed (${manifest.status})`);
-      if (tags.status !== 200) throw new Error(`npm registry tags lookup failed (${tags.status})`);
+      const versionUrl = `${PACKAGE_URL}/${version}`;
+      const tagsUrl = PACKAGE_URL;
+      let manifest: { status: number; body: unknown };
+      let tags: { status: number; body: unknown };
+      const read = (url: string) => readRegistry(url).catch((error: unknown) => { throw registryFailure(error, url); });
+      [manifest, tags] = await Promise.all([read(versionUrl), read(tagsUrl)]);
+      if (manifest.status !== 200 && manifest.status !== 404)
+        throw new Error(`npm registry version lookup failed (${manifest.status}; ${new URL(versionUrl).pathname})`);
+      if (tags.status !== 200)
+        throw new Error(`npm registry tags lookup failed (${tags.status}; ${new URL(tagsUrl).pathname})`);
       const tagged = tags.body && typeof tags.body === 'object' && 'dist-tags' in tags.body
         ? (tags.body as { 'dist-tags'?: Record<string, unknown> })['dist-tags']?.[distTag] : undefined;
       if (manifest.status === 200 && (metadata(manifest.body).name !== 'elanous' || metadata(manifest.body).version !== version))
@@ -90,7 +138,13 @@ export async function runNpmPublish(context: GraphContext = readGraphContext(),
       try {
         const npmrc = join(dir, 'npmrc');
         writeFileSync(npmrc, `//registry.npmjs.org/:_authToken=${token}\n`, { mode: 0o600, flag: 'wx' });
-        published = run('npm', ['publish', candidate, '--ignore-scripts', '--tag', distTag, '--access', 'public'], { ...process.env, NPM_CONFIG_USERCONFIG: npmrc });
+        const logDir = publishLogDirectory(context, stateDir);
+        mkdirSync(logDir, { recursive: true, mode: 0o700 });
+        chmodSync(logDir, 0o700);
+        const publishStartedAt = performance.now();
+        published = run('npm', ['publish', candidate, '--ignore-scripts', '--tag', distTag, '--access', 'public', '--logs-dir', logDir], { ...process.env, NPM_CONFIG_USERCONFIG: npmrc });
+        const durationMs = published.durationMs ?? Math.ceil(performance.now() - publishStartedAt);
+        try { (deps.publishSpawn ?? ((event) => debug.log('release-loop.npm', 'publish-spawn', event)))({ version, durationMs, status: published.status, signal: published.signal ?? null }); } catch { /* telemetry must not mask publish result */ }
       } finally { rmSync(dir, { recursive: true, force: true }); }
       const output = `${published.stdout}\n${published.stderr}`;
       const staged = published.status !== 0 && /\bE409\b/i.test(output) && /previously staged/i.test(output);

package/scripts/release-loop/probe-pod-host-dirs-live.ts

@@ -20,6 +20,8 @@ function option(name: string, fallback?: string): string {
 }
 
 async function main(): Promise<void> {
+  const actor = process.env.ELANOUS_SEAT?.trim() || process.env.USER?.trim() || process.env.LOGNAME?.trim();
+  if (!actor) throw new Error('pod provenance actor missing: ELANOUS_SEAT or USER/LOGNAME required');
   const context = option('context');
   const host = option('host');
   const cluster = option('cluster', 'elanous-pool');
@@ -51,6 +53,9 @@ async function main(): Promise<void> {
       let completed = false;
       try {
         const result = await runPodCommand({
+          provenance: { actorKind: process.env.ELANOUS_SEAT?.trim() ? 'seat' : 'human', actor, character: 'host-dirs-probe',
+            entrance: 'probe', kind: 'probe', run: name, phase: 'exec', requestedAt: new Date().toISOString(),
+            reason: `host directory probe ${arm}` },
           command: ['sh', '-c', 'printf cache-ok > /bun-cache/.host-dir-probe && printf slots-ok > /gate-install-slots/.host-dir-probe && test "$(cat /bun-cache/.host-dir-probe)" = cache-ok && test "$(cat /gate-install-slots/.host-dir-probe)" = slots-ok && rm /bun-cache/.host-dir-probe /gate-install-slots/.host-dir-probe && echo HOST_DIRS_WRITTEN'],
           name,
           namespace, image, imageCommit: null, deadlineSeconds: 120, pollMs: 1_000, statusUnreadableMs: 30_000,

package/scripts/release-loop/pwa-remote.ts

@@ -0,0 +1,166 @@
+// RELEASE-PWA-NODE-RESILIENCE ① (0.2.36 · 대표 10-20 «PWA 단계도 원격에서»): the release `pwa` node can run its
+// scenario suite on an SSH host (`release.loop.pwaRemote`, e.g. node-b) instead of the busy release machine.
+// 0.2.34 (10-20 18:50~19:13): at 1-min load 100+ on mbp the CDP attach went past 5s and T1b failed twice on reruns,
+// while the same commit alone passed — the release machine's load, not the PWA, decided the verdict.
+//
+// Same shape as the gate's host executor (`--gate-executor host` · `gateRemote` · `gateRemoteMirror`):
+//   ① ensure the bare mirror on the host  ② push the commit to `refs/elanous/pwa/<sha>`
+//   ③ one ssh call: clone the mirror at <sha> into a temp dir, install, run THAT commit's
+//      `pwa-scenarios-node.ts` locally there, print its JSON verdict, remove the temp dir.
+// ⛔ No silent fallback: when any step fails the node reports `error` with the stage and the host's own words
+// and exits 2. It never reruns the suite on the release machine.
+import { spawnSync } from 'node:child_process';
+import { debug } from '../../src/debug/log.js';
+
+/** `[user@]host`. A leading `-` is refused separately (ssh/git would read it as an option — `-oProxyCommand=…`). */
+export const PWA_REMOTE_HOST_PATTERN = /^(?:[\w.-]+@)?[\w.-]+$/;
+export const DEFAULT_PWA_REMOTE_MIRROR = '~/mirror/elanous-agent.git';
+/** Build (≤15m) + boot + warm-up + suite + reruns on the host; the local ssh deadline is only a backstop. */
+export const PWA_REMOTE_TIMEOUT_MS = 75 * 60_000;
+/** The host kills its own work first (shorter than the local backstop) so the temp clone and the ref are cleaned there. */
+export const PWA_REMOTE_LIMIT_SECONDS = 70 * 60;
+/** rc of a run the Perl supervisor stopped after its deadline. */
+const LIMIT_RCS = new Set([124]);
+
+export type PwaRemoteStage = 'input' | 'mirror' | 'push' | 'run' | 'timeout' | 'parse';
+
+export interface PwaRemoteOptions {
+  host: string;
+  commit: string;
+  withCostly: boolean;
+  reruns: number;
+  /** Bare mirror on the host (absolute or `~/…`). Default = the gate's mirror. */
+  mirror?: string;
+  /** Local repository that holds `commit` (pushed from here). */
+  repo: string;
+  timeoutMs?: number;
+}
+
+export interface PwaRemoteResult {
+  /** Exit code for the graph node: 0 pass/flaky · 1 fail · 2 could not run. */
+  exitCode: 0 | 1 | 2;
+  output: Record<string, unknown>;
+}
+
+interface Spawned { rc: number; stdout: string; stderr: string; error?: string }
+export type PwaRemoteSpawn = (cmd: string, args: string[], opts: { cwd: string; timeoutMs: number }) => Spawned;
+
+const defaultSpawn: PwaRemoteSpawn = (cmd, args, opts) => {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^(https?|all)_proxy$/i.test(k)));
+  const r = spawnSync(cmd, args, { cwd: opts.cwd, env, encoding: 'utf8', timeout: opts.timeoutMs, killSignal: 'SIGKILL', maxBuffer: 64 * 1024 * 1024 });
+  return { rc: r.status ?? 255, stdout: r.stdout ?? '', stderr: r.stderr ?? '', ...(r.error ? { error: String(r.error) } : {}) };
+};
+
+export const shQuote = (value: string): string => `'${value.replace(/'/g, `'\\''`)}'`;
+
+/** Validate the host and mirror before anything is spawned. */
+export function checkPwaRemote(host: unknown, mirror: unknown): { host: string; mirror: string } {
+  if (typeof host === 'string' && host.trim().startsWith('-')) throw new Error(`invalid pwa remote host: ${host.trim()} — a leading «-» would be read as an ssh/git option`);
+  if (typeof host !== 'string' || !PWA_REMOTE_HOST_PATTERN.test(host.trim())) throw new Error(`invalid pwa remote host: ${String(host)}`);
+  const m = mirror === undefined ? DEFAULT_PWA_REMOTE_MIRROR : mirror;
+  if (typeof m !== 'string' || !/^(?:\/|~\/)[\w./-]+$/.test(m) || m.split('/').includes('..')) throw new Error(`invalid pwa remote mirror path: ${String(m)}`);
+  return { host: host.trim(), mirror: m };
+}
+
+/** `~/x` stays unquoted at the front so the remote shell expands it; the rest is quoted. */
+function remotePath(path: string): string {
+  return path.startsWith('~/') ? `"$HOME"/${shQuote(path.slice(2))}` : shQuote(path);
+}
+
+/**
+ * The single remote script for step ③ — `sh -c` so the remote login shell (zsh on node-b) does not change its meaning.
+ * - Limit: Perl supervises a separate process group at PWA_REMOTE_LIMIT_SECONDS.
+ *   On timeout it kills the group, including the shell's children, then exits 124.
+ * - Cleanup: traps on EXIT · HUP · INT · TERM remove the temp clone and this run's mirror ref `refs/elanous/pwa/<sha>`
+ *   on success and failure alike — the ref only had to live until the clone fetched it, and deleting «our own» ref
+ *   (not a sweep of `refs/elanous/pwa/*`) cannot race another run on a different commit.
+ */
+export function remoteRunScript(opts: { commit: string; mirror: string; withCostly: boolean; reruns: number; limitSeconds?: number }): string {
+  const sha = shQuote(opts.commit);
+  const ref = shQuote(`refs/elanous/pwa/${opts.commit}`);
+  const limit = String(opts.limitSeconds ?? PWA_REMOTE_LIMIT_SECONDS);
+  const nodeArgs = ['--commit', opts.commit, '--json', '--reruns', String(opts.reruns), ...(opts.withCostly ? ['--with-costly'] : [])].map(shQuote).join(' ');
+  const body = [
+    `git clone --quiet --shared --no-checkout ${remotePath(opts.mirror)} "$1/repo" >&2 || exit 2`,
+    `cd "$1/repo" && git fetch --quiet origin ${ref} >&2 && git checkout --quiet --detach ${sha} >&2 || exit 2`,
+    'bun install --frozen-lockfile >&2 || exit 2',
+    '(cd apps/pwa && bun install --frozen-lockfile) >&2 || exit 2',
+    `exec bun scripts/release-loop/pwa-scenarios-node.ts ${nodeArgs}`,
+  ].join('\n');
+  // Arm the deadline only after the child confirms its new group exists. Otherwise a busy host
+  // can deliver SIGALRM between fork and setpgrp, making kill(-pid) miss every descendant.
+  const supervisor = [
+    'my $seconds = shift;',
+    'pipe(my $ready_r, my $ready_w) or exit 127;',
+    'my $pid = fork(); defined($pid) or exit 127;',
+    'if ($pid == 0) { close $ready_r; defined(setpgrp(0, 0)) or exit 127; syswrite($ready_w, "1") == 1 or exit 127; close $ready_w; exec @ARGV or exit 127; }',
+    'close $ready_w; my $ready = ""; unless (read($ready_r, $ready, 1) == 1) { kill 9, -$pid; kill 9, $pid; waitpid($pid, 0); exit 127; } close $ready_r;',
+    'local $SIG{ALRM} = sub { kill 9, -$pid; waitpid($pid, 0); exit 124; };',
+    'alarm $seconds; waitpid($pid, 0); alarm 0;',
+    'exit(($? & 127) ? 128 + ($? & 127) : ($? >> 8));',
+  ].join(' ');
+  return [
+    'PATH=$HOME/.bun/bin:/opt/homebrew/bin:/usr/local/bin:$PATH; export PATH',
+    'command -v perl >/dev/null 2>&1 || { echo "pwa remote requires perl" >&2; exit 127; }',
+    'D=$(mktemp -d /tmp/pwa-node-remote-XXXXXX) || exit 2',
+    `cleanup() { cd /tmp; rm -rf "$D"; git --git-dir=${remotePath(opts.mirror)} update-ref -d ${ref} 2>/dev/null; }`,
+    `trap 'cleanup' EXIT`,
+    `trap 'cleanup; trap - EXIT; exit 129' HUP`,
+    `trap 'cleanup; trap - EXIT; exit 130' INT`,
+    `trap 'cleanup; trap - EXIT; exit 143' TERM`,
+    `lim() { perl -e ${shQuote(supervisor)} ${limit} "$@"; }`,
+    `lim sh -c ${shQuote(body)} pwa-node "$D"`,
+  ].join('\n');
+}
+
+const COMMIT_40 = /^[0-9a-f]{40}$/;
+
+const tail = (text: string, n = 600): string => text.trim().slice(-n);
+
+function lastJson(stdout: string): Record<string, unknown> | undefined {
+  const line = stdout.split('\n').reverse().find((l) => l.trim().startsWith('{'));
+  if (!line) return undefined;
+  try {
+    const value: unknown = JSON.parse(line);
+    return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+  } catch { return undefined; }
+}
+
+/** Run the PWA scenario node on `host`. Never falls back to the local machine. */
+export function runPwaRemote(opts: PwaRemoteOptions, spawn: PwaRemoteSpawn = defaultSpawn): PwaRemoteResult {
+  const { host, mirror } = checkPwaRemote(opts.host, opts.mirror);
+  if (!COMMIT_40.test(opts.commit)) {
+    const error = `remote ${host} input refused: commit must be a full 40-hex sha (got ${JSON.stringify(opts.commit)}) — a short sha can name a different commit on the host mirror`;
+    debug.log('release-loop.pwa', 'remote-failed', { host, stage: 'input', rc: null, detail: error }, { level: 'warn' });
+    return { exitCode: 2, output: { verdict: 'error', commit: opts.commit, withCostly: opts.withCostly, executor: 'host', host, cells: [], error, remote: { stage: 'input', rc: null } } };
+  }
+  const timeoutMs = opts.timeoutMs ?? PWA_REMOTE_TIMEOUT_MS;
+  const base = { commit: opts.commit, withCostly: opts.withCostly, executor: 'host', host };
+  const started = Date.now();
+  debug.log('release-loop.pwa', 'remote-start', { host, mirror, commit: opts.commit, withCostly: opts.withCostly, reruns: opts.reruns });
+  const fail = (stage: PwaRemoteStage, run: Spawned | undefined, detail: string): PwaRemoteResult => {
+    const error = `remote ${host} ${stage} failed${run ? ` (rc=${run.rc})` : ''}: ${detail || 'no output'} — 원격 실패는 mbp 로 폴백하지 않는다`;
+    debug.log('release-loop.pwa', 'remote-failed', { host, stage, rc: run?.rc ?? null, detail: detail.slice(0, 600), elapsedMs: Date.now() - started }, { level: 'warn' });
+    return { exitCode: 2, output: { verdict: 'error', ...base, cells: [], error, remote: { stage, rc: run?.rc ?? null } } };
+  };
+
+  // ① mirror — a bare repo the commit can be pushed to (the gate uses the same one).
+  const ensure = `test -d ${remotePath(mirror)} || { mkdir -p "$(dirname ${remotePath(mirror)})" && git init --quiet --bare ${remotePath(mirror)}; }`;
+  const m = spawn('ssh', ['--', host, `sh -c ${shQuote(ensure)}`], { cwd: '/tmp', timeoutMs: 120_000 });
+  if (m.rc !== 0) return fail('mirror', m, tail(`${m.stderr}\n${m.error ?? ''}`));
+
+  // ② push the commit from the release machine.
+  const pushTarget = mirror.startsWith('~/') ? mirror.slice(2) : mirror;
+  const p = spawn('git', ['push', '--quiet', '--force', '--', `${host}:${pushTarget}`, `${opts.commit}:refs/elanous/pwa/${opts.commit}`], { cwd: opts.repo, timeoutMs: 600_000 });
+  if (p.rc !== 0) return fail('push', p, tail(`${p.stderr}\n${p.error ?? ''}`));
+
+  // ③ one call: clone · install · run the commit's own node there.
+  const script = remoteRunScript({ commit: opts.commit, mirror, withCostly: opts.withCostly, reruns: opts.reruns });
+  const r = spawn('ssh', ['--', host, `sh -c ${shQuote(script)}`], { cwd: '/tmp', timeoutMs });
+  const data = lastJson(r.stdout);
+  if (!data) return fail(r.rc === 0 ? 'parse' : LIMIT_RCS.has(r.rc) ? 'timeout' : 'run', r, tail(`${r.stderr}\n${r.error ?? ''}`));
+  const verdict = data.verdict;
+  const exitCode: 0 | 1 | 2 = verdict === 'pass' || verdict === 'flaky' ? (r.rc === 0 ? 0 : 2) : verdict === 'fail' ? 1 : 2;
+  debug.log('release-loop.pwa', 'remote-result', { host, verdict: typeof verdict === 'string' ? verdict : null, rc: r.rc, exitCode, elapsedMs: Date.now() - started });
+  return { exitCode, output: { ...data, ...base, ...(exitCode === 2 && typeof data.error !== 'string' ? { error: `remote ${host} run rc=${r.rc} verdict=${String(verdict)}: ${tail(r.stderr, 300)}` } : {}) } };
+}

package/scripts/release-loop/pwa-scenarios-node.ts

@@ -3,6 +3,10 @@
  * Release-loop ④ — run the PWA scenario suite on one commit, in isolation, and print one verdict.
  *
  *   bun scripts/release-loop/pwa-scenarios-node.ts --commit <sha> [--with-costly] [--reruns 2] [--json]
+ *     [--remote <ssh-host> [--remote-mirror <path>]]
+ *
+ * `--remote` (release.loop.pwaRemote) runs the same steps on that host — see pwa-remote.ts.
+ * A remote failure is reported as `error` (exit 2); it never falls back to this machine.
  *
  * Steps: temp worktree at <sha> → `nexus build` → isolated nexus (`--test`, leased test port)
  * → warm-up pass (discarded — the first page load after boot is slow and made T4a/N5a fail on the
@@ -18,14 +22,17 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { decideVerdict, exitCodeFor, idsToRerun, type CellRun, type NodeVerdict } from './pwa-node-verdict';
 import { envLiteral } from '../../src/platform/env-literal.js';
+import { checkPwaRemote, runPwaRemote } from './pwa-remote';
 
-interface Options { commit: string; withCostly: boolean; reruns: number; json: boolean }
+interface Options { commit: string; withCostly: boolean; reruns: number; json: boolean; remote?: string; remoteMirror?: string }
 
-function parseArgs(argv: readonly string[]): Options {
+export function parseArgs(argv: readonly string[]): Options {
   const opts: Options = { commit: '', withCostly: false, reruns: 2, json: false };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === '--commit') opts.commit = argv[++i] ?? '';
+    else if (arg === '--remote') opts.remote = argv[++i] ?? '';
+    else if (arg === '--remote-mirror') opts.remoteMirror = argv[++i] ?? '';
     else if (arg === '--with-costly') opts.withCostly = true;
     else if (arg === '--json') opts.json = true;
     else if (arg === '--reruns') opts.reruns = Number(argv[++i] ?? '2');
@@ -33,6 +40,8 @@ function parseArgs(argv: readonly string[]): Options {
   }
   if (!/^[0-9a-f]{7,40}$/i.test(opts.commit)) throw new Error('--commit <sha> is required');
   if (!Number.isInteger(opts.reruns) || opts.reruns < 0 || opts.reruns > 5) throw new Error('--reruns must be 0..5');
+  if (opts.remoteMirror !== undefined && opts.remote === undefined) throw new Error('--remote-mirror requires --remote');
+  if (opts.remote !== undefined) checkPwaRemote(opts.remote, opts.remoteMirror);
   return opts;
 }
 
@@ -65,6 +74,13 @@ async function main(): Promise<number> {
   let opts: Options;
   try { opts = parseArgs(process.argv.slice(2)); } catch (e) { log(String(e)); return 2; }
   const repo = resolve('.');
+  if (opts.remote !== undefined) {
+    log(`remote ${opts.remote} · ${opts.commit.slice(0, 10)}`);
+    const remote = runPwaRemote({ host: opts.remote, ...(opts.remoteMirror ? { mirror: opts.remoteMirror } : {}), commit: opts.commit, withCostly: opts.withCostly, reruns: opts.reruns, repo });
+    if (opts.json) console.log(JSON.stringify(remote.output));
+    else console.log(`pwa-node: ${String(remote.output.verdict)} · ${opts.commit.slice(0, 10)} · host ${opts.remote}${typeof remote.output.error === 'string' ? `\n  error: ${remote.output.error}` : ''}`);
+    return remote.exitCode;
+  }
   const work = mkdtempSync(join(tmpdir(), 'pwa-node-'));
   const worktree = join(work, 'tree');
   let nexusPid: number | undefined;
@@ -137,4 +153,4 @@ async function main(): Promise<number> {
   return verdict ? exitCodeFor(verdict.verdict) : 2;
 }
 
-process.exit(await main());
+if (import.meta.main) process.exit(await main());