elanous 0.2.34 → 0.2.36

package/src/task-agent/task-parent-role-llm.ts

@@ -0,0 +1,36 @@
+/** Parent-only role selection for Task Agent launches. The child model is a separate axis. */
+import { parseRoleLlmFlags } from '../llm/role-llm-cli.js';
+import { isModelRole, parseRoleLlmEntry, roleLlmEnvName, type ModelRole, type RoleLlmSpec } from '../user-config.js';
+
+const PARENT_ROLES = new Set<ModelRole>(['planning', 'classify', 'audit', 'review']);
+
+export function taskParentRoleEnv(values: readonly string[]): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const value of values) {
+    const at = value.indexOf('=');
+    const role = value.slice(0, at);
+    if (at < 1 || !isModelRole(role) || !PARENT_ROLES.has(role)) {
+      throw new Error(`--role-llm 부모 역할이 아니다: ${JSON.stringify(value)}`);
+    }
+    let spec: RoleLlmSpec;
+    const raw = value.slice(at + 1);
+    if (raw.startsWith('{')) {
+      let parsed: unknown;
+      try { parsed = JSON.parse(raw); }
+      catch { throw new Error(`--role-llm JSON 을 읽을 수 없다: ${role}`); }
+      const entry = parseRoleLlmEntry(parsed);
+      if (!entry.ok) throw new Error(`--role-llm ${role}: ${entry.reason}`);
+      spec = entry.spec;
+    } else {
+      const parsed = parseRoleLlmFlags([value]);
+      if (!parsed.ok) throw new Error(`--role-llm ${parsed.message}`);
+      const selected = parsed.overrides[role];
+      if (!selected) throw new Error(`--role-llm 선택한 역할이 비었다: ${role}`);
+      spec = selected;
+    }
+    const name = roleLlmEnvName(role);
+    if (env[name] !== undefined) throw new Error(`--role-llm 같은 부모 역할을 두 번 고정했다: ${role}`);
+    env[name] = JSON.stringify(spec);
+  }
+  return env;
+}

package/src/task-agent/tier-split.ts

@@ -0,0 +1,196 @@
+/**
+ * TIER-SPLIT-BEFORE-LAUNCH (0.2.35 P0) — `tasks hand --tier 상|특 --live` 를 한 덩어리로 쏘지 않고, 저작 분해
+ * (TC TIER-SIZED-DECOMPOSE `decomposeToTierSizedSlices`)가 만든 «중 이하 조각»으로 나눠 조각마다 hand 발사한다.
+ * 대표: «최우선으로 중·하 난이도로 쪼개기를 정착 · 구독 sol 은 웬만해선 소진 안 함».
+ *
+ * - 분해 규칙은 TC 몫 — 여기는 그 함수를 «주입 seam» 으로 받는다. 기본 seam 은 이 파일 한 곳(`DEFAULT_TIER_SIZED_DECOMPOSE`)에서만 정한다.
+ * - 분해기 «미배선»(seam 에 undefined 명시) = `decomposer-unavailable` → 종전처럼 한 덩어리 발사 ⊕ 기록. 기본 seam 은 TC 함수다.
+ * - 분해 «실패»(ok:false · throw · 불가피 이유 없는 상 조각 · 빈/잘못된 조각) → 발사 0 · 카드 failed(history `tier-split-failed`).
+ * - 관측: `debug.log('task-agent.hand', 'tier-split', {cid, fromTier, outcome, reason?, slices, unavoidable,
+ *   countScope:'accepted-slices', totalSlices, highSlices, unavoidableCount, unavoidableReasons})`.
+ */
+import { randomBytes } from 'node:crypto';
+import { resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { handTask, nextMoveFor, parseChildLlm, taskAgentStatePath, updateTaskCard, writeTaskCards, TASK_CARD_PREFIX, type HandTaskOptions, type HandTaskResult, type TaskCard } from './task-hand.js';
+
+// 분해 규칙·타입 정본 = TC `src/self-implement/goal-author-decompose.ts`(TIER-SIZED-DECOMPOSE · #29987).
+import { decomposeToTierSizedSlices, type SizedSlice, type TierSizedDecomposeResult } from '../self-implement/goal-author-decompose.js';
+import { DEVICE_FIRST_STEP } from '../self-implement/device-first.js';
+export type { SizedSlice, TierSizedDecomposeResult };
+export type TierSizedDecompose = (goal: string, opts?: { signal?: AbortSignal; repositoryRoot?: string }) => Promise<TierSizedDecomposeResult>;
+
+/** 기본 분해기 — TC `decomposeToTierSizedSlices`. seam 에 undefined 를 명시하면 «미배선»(decomposer-unavailable). */
+export const DEFAULT_TIER_SIZED_DECOMPOSE: TierSizedDecompose | undefined = decomposeToTierSizedSlices;
+
+export const TIER_SPLIT_UNAVAILABLE = 'decomposer-unavailable';
+
+/** 분해 시간 상한 — LLM 이 매달려도 디스패처의 손 넘김 한 번을 끝없이 붙잡지 않는다. 넘으면 막힘(decompose-timeout). */
+export const TIER_SPLIT_DECOMPOSE_TIMEOUT_MS = 300_000;
+
+/** 조각이 부모 칸에서 물려받는 줄 머리 — hand 의 골 검사(완료 경계 셋)와 계약·경계 문맥. */
+const INHERITED_PARENT_LABELS = /^\s*(?:[-*]\s*)?(현재 계약|완료 경계 코드|완료 경계 실물|완료 경계 증거 명령|경계|증거 보충)\s*:/;
+
+/**
+ * 조각 hand 문면 = 조각 골(대상 경로·동작 — 첫 줄 유지) ⊕ 조각 표지 ⊕ 부모 칸의 계약·완료 경계·경계 줄.
+ * 분해기의 조각 골은 짧은 제목뿐이라 그대로 넘기면 hand 의 골 검사(완료 경계 누락)가 막는다(10-21 DEVICE-FIRST-AUTHORING 발사 0).
+ * 부모에 그 줄이 없으면 아무것도 더하지 않는다 — 검사가 지금처럼 거부한다(보수 쪽).
+ */
+export function composeSliceHandText(sliceGoal: string, parentText: string, marker: { index: number; total: number; fromTier: '상' | '특'; cid: string | null }): string {
+  const sliceLines = sliceGoal.trim().split('\n');
+  const sliceHas = new Set(sliceLines.map((line) => INHERITED_PARENT_LABELS.exec(line)?.[1]).filter(Boolean));
+  const inherited = parentText.split('\n').filter((line) => {
+    const label = INHERITED_PARENT_LABELS.exec(line)?.[1];
+    return label !== undefined && !sliceHas.has(label);
+  });
+  // The slice marker also carries review scope. Device slices now own their
+  // completion boundary, so inherited can be empty while the marker is needed.
+  if (inherited.length === 0 && (marker.total < 2 || !sliceGoal.includes(`동작: ${DEVICE_FIRST_STEP}`))) return sliceGoal;
+  const tag = `조각 ${marker.index}/${marker.total} — 부모 ${marker.cid ?? '(칸 없음)'}(${marker.fromTier}) 를 중 이하로 나눈 몫. 아래 계약·완료 경계는 부모 칸에서 물려받았다 — 이 조각 범위만 채운다.`;
+  return [...sliceLines, tag, ...inherited].join('\n');
+}
+
+export type TierSplitPlan =
+  | { kind: 'split'; slices: SizedSlice[] }
+  | { kind: 'blocked'; reason: string };
+
+/** 순수 판정 — 분해 결과 → 발사 계획. 이유 없는 상 조각이 하나라도 있으면 결과 전체를 실패로 본다(이유 없는 상 0). */
+export function planTierSplit(result: TierSizedDecomposeResult): TierSplitPlan {
+  if (!result.ok) return { kind: 'blocked', reason: `decompose-failed: ${result.reason}` };
+  if (result.slices.length === 0) return { kind: 'blocked', reason: 'no-slices' };
+  for (const [index, slice] of result.slices.entries()) {
+    if (!['하', '중', '상'].includes(slice.tier)) return { kind: 'blocked', reason: `invalid-slice-tier: #${index + 1} ${String(slice.tier)}` };
+    if (!slice.goal?.trim()) return { kind: 'blocked', reason: `empty-slice-goal: #${index + 1}` };
+    if (slice.tier === '상' && !slice.unavoidable?.trim()) return { kind: 'blocked', reason: `unjustified-상-slice: #${index + 1}` };
+  }
+  const deviceSlices = result.slices.filter((slice) => slice.deviceFirst === 'device-test');
+  if (deviceSlices.length === 0 && result.slices.some((slice) => slice.deviceFirst === 'feature'))
+    return { kind: 'blocked', reason: 'device-first-stage-missing' };
+  if (deviceSlices.length > 0 && (deviceSlices.length !== 1 || result.slices[0]?.deviceFirst !== 'device-test'
+    || result.slices.slice(1).some((slice) => slice.deviceFirst !== 'feature')))
+    return { kind: 'blocked', reason: 'device-first-order-invalid' };
+  return { kind: 'split', slices: result.slices };
+}
+
+export interface TierSplitSliceOutcome { slice: SizedSlice; result?: HandTaskResult; error?: string }
+export type TierSplitHandResult =
+  | { kind: 'whole'; result: HandTaskResult; reason?: string }
+  | { kind: 'blocked'; result: HandTaskResult; reason: string }
+  | { kind: 'split'; group: string; fromTier: '상' | '특'; slices: TierSplitSliceOutcome[] };
+
+export interface TierSplitHandOptions extends HandTaskOptions {
+  /** 분해기 seam — 키를 안 주면 기본(`DEFAULT_TIER_SIZED_DECOMPOSE`) · undefined 를 명시하면 «미배선». */
+  decompose?: TierSizedDecompose;
+  /** 분해 시간 상한(시험 주입) — 기본 `TIER_SPLIT_DECOMPOSE_TIMEOUT_MS`. */
+  decomposeTimeoutMs?: number;
+}
+
+function record(data: Record<string, unknown>): void {
+  try { debug.log('task-agent.hand', 'tier-split', data); } catch { /* fail-soft */ }
+}
+
+function acceptedSliceCounts(slices: readonly SizedSlice[]) {
+  const unavoidableReasons = slices.filter((slice) => slice.tier === '상').map((slice) => slice.unavoidable!.trim());
+  // planTierSplit rejects every high slice without a reason, so the accepted
+  // high count and unavoidable count coincide. Keep both for the board axes.
+  return { countScope: 'accepted-slices' as const, totalSlices: slices.length, highSlices: unavoidableReasons.length,
+    unavoidableCount: unavoidableReasons.length, unavoidableReasons };
+}
+
+/**
+ * `tasks hand` 의 발사 앞단. 분해는 `--live` ⊕ tier 상|특 일 때만 — 중·하·tier 없음·shadow 는 `handTask` 그대로(분해 호출 0).
+ */
+export async function handTaskWithTierSplit(opts: TierSplitHandOptions): Promise<TierSplitHandResult> {
+  const { decompose: injected, decomposeTimeoutMs = TIER_SPLIT_DECOMPOSE_TIMEOUT_MS, ...hand } = opts;
+  const fromTier = hand.tier;
+  if (!hand.live || (fromTier !== '상' && fromTier !== '특')) return { kind: 'whole', result: await handTask(hand) };
+  const decompose = 'decompose' in opts ? injected : DEFAULT_TIER_SIZED_DECOMPOSE;
+  const cid = hand.checklistId ?? null;
+  if (!decompose) {
+    record({ cid, fromTier, outcome: 'whole', reason: TIER_SPLIT_UNAVAILABLE, slices: [], unavoidable: [], ...acceptedSliceCounts([]) });
+    return { kind: 'whole', result: await handTask(hand), reason: TIER_SPLIT_UNAVAILABLE };
+  }
+  let plan: TierSplitPlan;
+  const controller = new AbortController();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timedOut = new Promise<'timeout'>((resolve) => { timer = setTimeout(() => { controller.abort(); resolve('timeout'); }, decomposeTimeoutMs); });
+  try {
+    const raced = await Promise.race([decompose(hand.text.trim(), { signal: controller.signal,
+      ...(hand.project ? { repositoryRoot: resolve(hand.project.target) } : {}) }), timedOut]);
+    plan = raced === 'timeout' ? { kind: 'blocked', reason: `decompose-timeout: ${decomposeTimeoutMs}ms` } : planTierSplit(raced);
+  } catch (error) {
+    plan = { kind: 'blocked', reason: `decompose-threw: ${String((error as Error)?.message ?? error).slice(0, 200)}` };
+  } finally { clearTimeout(timer); }
+  if (plan.kind === 'blocked') {
+    record({ cid, fromTier, outcome: 'blocked', reason: plan.reason, slices: [], unavoidable: [], ...acceptedSliceCounts([]) });
+    return { kind: 'blocked', result: await handTask({ ...hand, tierSplitBlocked: plan.reason }), reason: plan.reason };
+  }
+  const group = `${TASK_CARD_PREFIX}split-${randomBytes(4).toString('hex')}`;
+  const total = plan.slices.length;
+  const counts = acceptedSliceCounts(plan.slices);
+  const unavoidable = counts.unavoidableReasons;
+  // 조각은 새 카드다 — 호출자 id·pr·goalId 를 조각마다 복제하면 «PR: #N» 조회·수확이 엇갈린다. 버린 것은 기록에 남긴다.
+  const dropped = { ...(hand.id ? { id: hand.id } : {}), ...(hand.cardFields?.pr !== undefined ? { pr: hand.cardFields.pr } : {}), ...(hand.cardFields?.goalId !== undefined ? { goalId: hand.cardFields.goalId } : {}) };
+  record({ cid, fromTier, outcome: 'split', group, ...(Object.keys(dropped).length ? { dropped } : {}), slices: plan.slices.map((s) => ({ tier: s.tier, files: s.files, behaviours: s.behaviours })), unavoidable: [...unavoidable],
+    ...counts });
+  const { id: _wholeId, cardFields, ...rest } = hand;
+  const base = { ...rest, ...(cardFields?.handed !== undefined ? { cardFields: { handed: cardFields.handed } } : {}) };
+  const slices: TierSplitSliceOutcome[] = [];
+  // Device-first plans use the existing mission advance engine: only the test/device card starts.
+  // Feature cards carry an explicit `after` edge and `tasks advance` requires a merged PR before launch.
+  if (plan.slices[0]?.deviceFirst === 'device-test') {
+    const now = (hand.now ?? (() => new Date()))().toISOString();
+    const ids = plan.slices.map((_slice, index) => `${group}-${index + 1}`);
+    const mission: TaskCard = { id: group, text: hand.text, createdAt: now, status: 'handed', history: [],
+      pieces: ids, splitSource: 'device-first-tier-split', ...(hand.checklistId ? { checklistId: hand.checklistId } : {}),
+      ...(hand.seat ? { seat: hand.seat } : {}) };
+    const drafts: TaskCard[] = plan.slices.map((slice, index) => ({
+      id: ids[index]!, text: composeSliceHandText(slice.goal, hand.text, { index: index + 1, total, fromTier, cid }),
+      createdAt: now, status: 'handed', history: [], mission: group,
+      after: index === 0 ? [] : [ids[0]!], tier: slice.tier,
+      tierSplit: { group, fromTier, index: index + 1, total, ...(slice.tier === '상' ? { unavoidable: slice.unavoidable!.trim() } : {}) },
+      ...(hand.checklistId ? { checklistId: hand.checklistId } : {}),
+      ...(hand.seat ? { seat: hand.seat } : {}),
+      ...(hand.project ? { project: hand.project } : {}),
+      ...(hand.completion ? { completion: hand.completion } : {}),
+      ...(hand.taLand ? { taLand: true as const } : {}),
+      ...(hand.childLlm ? { childLlm: parseChildLlm(hand.childLlm, hand.childLlmEffort) } : {}),
+      ...(hand.parentRoleLlm?.length ? { parentRoleLlm: [...hand.parentRoleLlm] } : {}),
+    }));
+    writeTaskCards(hand.statePath ?? taskAgentStatePath(), [mission, ...drafts]);
+    const markFirstLaunchFailure = (reason: string) => {
+      updateTaskCard(hand.statePath ?? taskAgentStatePath(), group, (card) => card ? {
+        ...card, status: 'failed', history: [...card.history, { at: new Date().toISOString(),
+          event: 'device-first-launch-failed', detail: reason }],
+      } : undefined);
+    };
+    for (const [index, slice] of plan.slices.entries()) {
+      if (index > 0) {
+        slices.push({ slice, result: { card: drafts[index]!, move: nextMoveFor(drafts[index]!), mode: hand.live ? 'live' : 'shadow', launched: false } });
+        continue;
+      }
+      try {
+        const result = await handTask({ ...base, id: ids[0], text: drafts[0]!.text, tier: slice.tier,
+          mission: group, after: [], tierSplit: drafts[0]!.tierSplit });
+        slices.push({ slice, result });
+        if (hand.live && !result.launched) markFirstLaunchFailure(`first card not launched: ${result.card.status}`);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        slices.push({ slice, error: reason });
+        markFirstLaunchFailure(reason);
+      }
+    }
+    record({ cid, fromTier, outcome: 'device-first-deferred', group, first: ids[0], blockedUntilLanded: ids.slice(1) });
+    return { kind: 'split', group, fromTier, slices };
+  }
+  for (const [index, slice] of plan.slices.entries()) {
+    try {
+      const result = await handTask({ ...base, text: composeSliceHandText(slice.goal, hand.text, { index: index + 1, total, fromTier, cid }), tier: slice.tier,
+        tierSplit: { group, fromTier, index: index + 1, total, ...(slice.tier === '상' ? { unavoidable: slice.unavoidable!.trim() } : {}) } });
+      slices.push({ slice, result });
+    } catch (error) {
+      slices.push({ slice, error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { kind: 'split', group, fromTier, slices };
+}

package/src/task-agent/work-order-build.ts

@@ -6,6 +6,7 @@ export interface BuildWorkOrderInput {
   lifeId?: string;
   priority?: string;
   peers?: string;
+  boundary?: string;
 }
 
 /** Build the normalized nine-field core from already-grounded inputs; no CLI, filesystem, or launch side effects. */
@@ -16,6 +17,7 @@ export function buildWorkOrder(input: BuildWorkOrderInput): WorkOrder {
     version: input.version,
     priority: input.priority,
     peers: input.peers,
+    boundary: input.boundary,
   }));
   if (!parsed.ok) throw new Error(parsed.reason);
   return parsed.order;

package/src/task-agent/work-order.ts

@@ -79,8 +79,9 @@ export function parseWorkOrder(source: string): ParseWorkOrderResult {
   const unknownFields: string[] = [];
   const cells = {} as Record<WorkOrderField, string>;
   for (const field of WORK_ORDER_FIELDS) {
-    const text = cellText(record[field]);
-    if (text === WORK_ORDER_UNKNOWN) unknownFields.push(field);
+    const value = record[field];
+    const text = cellText(value);
+    if (value == null || (typeof value === 'string' && !value.trim())) unknownFields.push(field);
     cells[field] = text;
   }
   return { ok: true, order: { cellId: rawCellId.trim(), ...cells, unknownFields } };

package/src/task-orchestrator/generator-prompt.ts

@@ -10,10 +10,13 @@
  */
 import type { DecomposeInput } from './generator.js';
 import type { ProposalValidationError } from './generator-schema.js';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { resolve } from 'node:path';
 
 export type DecomposePromptProfile = 'goal-author-coarse';
 
-export const GOAL_AUTHOR_COARSE_MAX_SLICES = 6;
+/** TaskGenerator's safety ceiling, not an authoring target; goal-author splits by slice size. */
+export const GOAL_AUTHOR_SIZE_SAFETY_MAX_SLICES = 15;
 
 export interface BuildPromptOptions {
   maxTasks: number;
@@ -39,6 +42,35 @@ const CODING_GOAL_KINDS: ReadonlySet<string> = new Set([
   'agentic',
 ]);
 
+/** Read the existing device sources at authoring time; the LLM has no file tools in this phase. */
+let deviceInventoryCache: string[] | undefined;
+function deviceInventory(): string[] {
+  if (deviceInventoryCache) return deviceInventoryCache;
+  const root = resolve(import.meta.dir, '../..');
+  const fallback = ['- Device inventory unavailable in this installation; verify a named device before claiming it exists.'];
+  if (!existsSync(resolve(root, 'src/ux-sim'))) return deviceInventoryCache = fallback;
+  try {
+    const files = readdirSync(resolve(root, 'src/ux-sim'))
+      .filter((name) => name.endsWith('.ts') && !name.endsWith('.test.ts')).sort();
+    const monkey = readFileSync(resolve(root, 'src/ux-sim/event-monkey.ts'), 'utf8');
+    const kinds = monkey.match(/export const EVENT_MONKEY_KINDS = \[([\s\S]*?)\] as const;/)?.[1]
+      ?.match(/'[^']+'/g)?.map((kind) => kind.slice(1, -1)) ?? [];
+    let rows: string[] = [];
+    try {
+      const manual = readFileSync(resolve(root, 'docs/manual/MANUAL-ux-simulation-devices-2026-08-23.md'), 'utf8');
+      rows = manual.split('\n').filter((line) => line.startsWith('|') && line.includes('`src/ux-sim/'));
+    } catch { /* Published packages omit docs/manual; source catalog still applies. */ }
+    return deviceInventoryCache = [
+      `- src/ux-sim files: ${files.join(', ')}`,
+      `- event-monkey kinds: ${kinds.join(', ')}`,
+      ...(rows.length ? [] : ['- manual §1 table unavailable in this installation; use the source files and event kinds above.']),
+      ...rows.map((row) => `- manual §1: ${row.replace(/\s*\|\s*/g, ' · ').slice(0, 500)}`),
+    ];
+  } catch {
+    return deviceInventoryCache = fallback;
+  }
+}
+
 export function buildDecomposePrompt(
   input: DecomposeInput,
   opts: BuildPromptOptions
@@ -53,7 +85,7 @@ export function buildDecomposePrompt(
   lines.push(
     'You are the monad-agent Task Orchestrator decomposition planner.',
     isGoalAuthorCoarse
-      ? `Break the objective into 1-${GOAL_AUTHOR_COARSE_MAX_SLICES} larger, concrete implementation slices.`
+      ? 'Break the objective into implementation slices that a low or medium tier model can finish. Split by slice size, not a target number of slices; the task count limit is only a safety ceiling.'
       : 'Break the objective into 3-7 concrete, single-responsibility tasks.',
     '',
     '## Output (STRICT JSON)',
@@ -119,9 +151,10 @@ export function buildDecomposePrompt(
     '- ★ Complete dependsOn contracts: if a phase CONSUMES another phase\'s output, that producing phase MUST be in this phase\'s `dependsOn` (by index). A consumer with no dependsOn on its producer looks like an ungrounded/orphan dependency to the critique. Trace every consumed symbol to either grounding (exists) or a dependsOn phase (produced this mission).',
     ...(isGoalAuthorCoarse
       ? [
-        '- Coarse scope: permit a larger implementation slice when its related definition, tests, and runtime wiring are necessary for an executable end-to-end path; do not split those related concerns into sibling tasks.',
-        '- One implementation run can complete a large multi-file slice, including its tests, so do not split work that fits in one run.',
-        '- Keep a coarse slice focused on one executable outcome, but it may combine related implementation concerns and exceed the default small-scope LOC guidance.',
+        '- Goal-author size: each slice should touch at most 4 target files, change at most 2 behaviors, and create at most 2 files. Count tests and runtime wiring among target files.',
+        '- Prefer low tier (at most 2 files, 1 behavior, 1 new file), then medium tier (at most 4 files, 2 behaviors, 2 new files). Do not make a high tier slice merely to reduce the number of slices.',
+        '- Keep the executable dependency path through dependsOn; split oversized work into dependent slices rather than hiding multiple behaviors in one title.',
+        '- A high tier slice is allowed only when it cannot be split further without breaking an inseparable operation. State its unavoidable reason in the rationale.',
       ]
       : [
         '- Small scope: keep each task ≈≤250 LOC of change. If a step is bigger, split it into sibling tasks or defer to a recursive decompose (depth) rather than one giant task.',
@@ -155,13 +188,29 @@ export function buildDecomposePrompt(
   if (isGoalAuthorCoarse) {
     lines.push(
       '',
-      '## Goal-author coarse slicing (follow strictly)',
-      '- Prefer fewer, larger implementation slices over small single-concern tasks; use the task budget as a ceiling, not a target.',
-      '- Keep related definition, tests, and runtime wiring together when they are required to make one implementation slice executable end-to-end.',
-      '- A slice may cover multiple related concerns and a larger change scope when splitting them would leave a definition unwired or an execution path incomplete.',
-      '- Every slice title MUST name at least one actual file path or function name because only the title is passed to the next stage; coarse slices must remain grounded and verifiable.',
+      '## Goal-author size-bounded slicing (follow strictly)',
+      '- Use the task budget as a safety ceiling, not a target. Add dependent slices whenever one slice would exceed medium size.',
+      '- Give each slice an executable outcome with tests or runtime wiring inside its size limit; place further wiring in a dependent slice.',
+      '- Every slice title MUST name at least one actual file path or function name because only the title is passed to the next stage; slices must remain grounded and verifiable.',
+      '- Every task JSON must include files, behaviours, newFiles and tier. Example: {"index":0,"title":"대상 경로: src/a.ts · 동작: 연결","files":1,"behaviours":1,"newFiles":0,"tier":"low","surface":{"kind":"llm-direct","prompt":"wire src/a.ts"}}.',
+      '- Only the title reaches the sizing fallback: start it with "대상 경로:" and name all touched paths; add one "동작:" clause per changed behavior and "신규 경로:" for each new file. Keep the title within 80 characters by splitting oversized work.',
       '- Fold non-code investigation or design into the implementation slice that needs it; do not emit it as a standalone slice.',
-      '- Use dependsOn only for genuine ordering between independently completable slices; do not split related definition and runtime wiring merely to create sibling tasks.',
+      '- Use dependsOn for genuine ordering between independently completable slices, including definition before dependent runtime wiring.',
+    );
+    // ── 장치 우선 분해 (DEVICE-FIRST-AUTHORING · 대표 10-21 18:1x 골 저작 지침) ──
+    // 골 저작의 검증 계획(TDD) 절이 무대·층을 고를 때 그 시험에 필요한 mock 장치·주입 사건 정의의
+    // 존재를 먼저 확인하게 한다. 장치가 없으면 «실물 없음»으로 초록이 막히므로 첫 조각이 장치 조각이 된다.
+    lines.push(
+      '',
+      '## Device-first decomposition (DEVICE-FIRST-AUTHORING — follow strictly)',
+      '### Existing device inventory (read from this checkout; use these names before proposing a new device)',
+      ...deviceInventory(),
+      '- The objective\'s verification plan (검증 계획/TDD) section picks a stage and ladder tier (무대·층) — e.g. a `src/ux-sim/*` stage at L2 (fake-llm·fake-bin·fake-clock). BEFORE writing slices, CHECK whether the mock device or injected event definition that this verification plan needs ALREADY EXISTS: look in `src/ux-sim/*`, the §1 device table of `docs/manual/MANUAL-ux-simulation-devices-2026-08-23.md`, and the event-monkey event kinds.',
+      '- Two branches — exactly one applies per needed device:',
+      '  - Device EXISTS: its name MUST go into the verification plan wording — the slice that tests the feature carries the device\'s exact name (device file / §1 table row / event kind) in its acceptance criteria and reuses the device; never re-create it.',
+      '  - Device MISSING: the FIRST slice MUST be a device slice that develops that device feature first — the mock device or injected event definition under `src/ux-sim/*` — and every slice that tests the feature depends on it (구현할 때 해당 시험 mock 장치나 이벤트 정의가 있나 확인하고, 없으면 그 장치 피처를 먼저 개발).',
+      '- Do NOT create the device itself here beyond emitting that device slice (장치 자체는 만들지 않는다 — 조각으로 내보낼 뿐); consumer slices reference it only via dependsOn.',
+      '- Device slices obey the same size bounds and acceptance bar as every other slice — the size rules (TIER-SIZED-DECOMPOSE) and the green-judgment rules are UNCHANGED.',
     );
   }
 

package/src/task-orchestrator/surfaces/pod-account-broker.ts

@@ -126,8 +126,17 @@ export function planPodAccounts(
 export function planOwnerCodexMirrorCandidates(candidates: readonly RotationCandidate[], options: {
   accountOrder: readonly string[];
   thresholdPercentByAccount?: Readonly<Record<string, unknown>>;
+  creditsAllowed?: boolean;
+  creditReserve?: number;
 }): RotationCandidate[] {
   const usable = new Set(planPodAccounts(candidates, { thresholdPercentByAccount: options.thresholdPercentByAccount }).usable);
+  // The parent has to install an access mirror before the remote Pod can use its
+  // credit fallback. Only a measured balance above the reserve admits that mirror.
+  if (usable.size === 0 && options.creditsAllowed) {
+    const reserve = typeof options.creditReserve === 'number' && Number.isFinite(options.creditReserve) && options.creditReserve >= 0
+      ? options.creditReserve : CODEX_CREDIT_RESERVE_DEFAULT;
+    return creditCandidatesByBalance(candidates, reserve);
+  }
   const rank = (name: string): number => {
     const index = options.accountOrder.indexOf(name);
     return index < 0 ? options.accountOrder.length : index;
@@ -149,6 +158,39 @@ export function ownerCodexMirrorCandidate(candidates: readonly RotationCandidate
   });
 }
 
+export interface OwnerCodexMirrorAccount { account: string; usedPercent: number | null; thresholdPercent: number; expiresAt: number }
+
+/** The remote may rotate only across the accounts HQ actually installed in this launch snapshot. */
+export function parseOwnerCodexMirrorAccounts(raw: string): OwnerCodexMirrorAccount[] {
+  let parsed: unknown;
+  try { parsed = JSON.parse(raw); } catch { throw new Error('HQ Codex 미러 계정 목록이 잘못됐다'); }
+  if (!Array.isArray(parsed) || parsed.length === 0 || parsed.length > 16) throw new Error('HQ Codex 미러 계정 목록이 잘못됐다');
+  const seen = new Set<string>();
+  return parsed.map((item: unknown) => {
+    if (!item || typeof item !== 'object') throw new Error('HQ Codex 미러 계정 항목이 잘못됐다');
+    const value = item as Record<string, unknown>;
+    const { account, usedPercent, thresholdPercent, expiresAt } = value;
+    if (typeof account !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(account) || seen.has(account)
+      || (usedPercent !== null && (typeof usedPercent !== 'number' || !Number.isFinite(usedPercent) || usedPercent < 0 || usedPercent > 100))
+      || typeof thresholdPercent !== 'number' || !Number.isFinite(thresholdPercent) || thresholdPercent <= 0 || thresholdPercent > 100
+      || typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= 0)
+      throw new Error('HQ Codex 미러 계정 항목이 잘못됐다');
+    seen.add(account);
+    return { account, usedPercent: usedPercent as number | null, thresholdPercent, expiresAt };
+  });
+}
+
+/** Do not plan a Pod against an access token that might expire while it starts and runs. */
+export function freshOwnerCodexMirrorAccounts(accounts: readonly OwnerCodexMirrorAccount[], now = Date.now()): OwnerCodexMirrorAccount[] {
+  return accounts.filter(({ expiresAt }) => expiresAt > now + 3 * 60 * 60 * 1000);
+}
+
+export function selectOwnerCodexMirrorCandidates(candidates: readonly RotationCandidate[], accounts: readonly OwnerCodexMirrorAccount[]): RotationCandidate[] {
+  const selected = accounts.flatMap(({ account, usedPercent }) => ownerCodexMirrorCandidate(candidates, account, usedPercent ?? undefined));
+  if (selected.length !== accounts.length) throw new Error('HQ Codex 미러 계정 일부가 원격 auth-store 후보에 없다');
+  return selected;
+}
+
 /** Job 마다 다음 계정 — 잔량 순으로 돌려 가며. 쓸 계정이 없으면 만들 때 이유를 대고 던진다. */
 export function makePodAccountBroker(plan: PodAccountPlan): () => string {
   if (plan.usable.length === 0) {

package/src/task-orchestrator/surfaces/pod-child-providers.ts

@@ -9,7 +9,7 @@
  */
 // BEDROCK-PROVIDER ② (0.2.24) — bedrock 은 «이름 있는 AWS Secret» 이 클러스터에 있을 때만 뜬다(pod-bedrock-child.ts · 발사 전 거부).
 // ZAI-POD-CHILD (0.2.24) — glm 은 Z.ai GLM Coding Plan(정액 구독) · «이름 있는 ZAI Secret» 이 클러스터에 있을 때만 뜬다(pod-zai-child.ts · 발사 전 거부 · 동시 상한 넘치면 정책대로).
-export const POD_CHILD_PROVIDERS = ['openai-codex', 'grok', 'openrouter', 'anthropic', 'bedrock', 'glm'] as const;
+export const POD_CHILD_PROVIDERS = ['openai-codex', 'grok', 'openrouter', 'opengateway', 'anthropic', 'bedrock', 'glm'] as const;
 export type PodChildProvider = typeof POD_CHILD_PROVIDERS[number];
 
 /** 사람이 쓰는 별칭 → 정식 이름. */

package/src/task-orchestrator/surfaces/pod-child-reuse.ts

@@ -0,0 +1,146 @@
+import { decidePodReuseCleanup } from './pod-reuse-cleanup.js';
+import type { WarmWorkerKey } from './pod-warm-worker-protocol.js';
+
+/** An admitted si-v1 worker is identified by the pool, never by a Job name alone. */
+export interface ChildPodLease {
+  workerId: string;
+  podUid: string;
+  leaseId: string;
+  generation: number;
+  key: WarmWorkerKey;
+  sourceSha: string;
+}
+
+export interface ChildPodReuseCommandResult {
+  status: number | null;
+  stdout?: string;
+}
+
+export interface ChildPodCleanupReceipt {
+  clean: boolean;
+  reason: string;
+  /** Known residual lower bound; null means unmeasured surfaces and no observed residue. */
+  observedResidue: number | null;
+}
+
+/** Operations execute inside the admitted worker, after its child result and artifacts have been collected. */
+export interface ChildPodReuseOperations {
+  stopChildProcesses: (lease: ChildPodLease) => Promise<{ remaining: number }>;
+  git: (lease: ChildPodLease, args: readonly string[]) => Promise<ChildPodReuseCommandResult>;
+  removeRunCredentials: (lease: ChildPodLease) => Promise<{ remaining: number }>;
+  returnLease: (lease: ChildPodLease, receipt: ChildPodCleanupReceipt) => Promise<void>;
+  quarantine: (lease: ChildPodLease, receipt: ChildPodCleanupReceipt) => Promise<void>;
+  observe: (event: 'return-decision' | 'clean-failed' | 'quarantine-failed', data: Record<string, unknown>) => void;
+}
+
+export interface ChildPodReturnResult {
+  outcome: 'returned' | 'quarantined';
+  reason: string;
+}
+
+/**
+ * A completed child may return to the pool only after all four independent
+ * checks succeed. A missing return-decision observation also blocks return;
+ * the worker stays out of the lease pool until quarantine succeeds.
+ */
+export async function cleanAndReturnChildPod(
+  lease: ChildPodLease,
+  ops: ChildPodReuseOperations,
+): Promise<ChildPodReturnResult> {
+  const facts = { workerId: lease.workerId, podUid: lease.podUid,
+    leaseId: lease.leaseId, generation: lease.generation };
+  const log = (event: Parameters<ChildPodReuseOperations['observe']>[0], data: Record<string, unknown>) => {
+    try { ops.observe(event, { ...facts, ...data }); } catch { /* logging must not return an unsafe lease */ }
+  };
+  let reason = '';
+  let observedResidue = 0;
+  let processMeasured = false;
+  let gitMeasured = false;
+  let credentialsMeasured = false;
+  let credentialsRemoved = false;
+  try {
+    if (!lease.workerId || !lease.podUid || !lease.leaseId || !lease.key
+      || !Number.isSafeInteger(lease.generation) || lease.generation < 1
+      || !lease.key.context || !lease.key.architecture
+      || !/^sha256:[0-9a-f]{64}$/.test(lease.key.imageDigest)
+      || !/^[0-9a-f]{64}$/.test(lease.key.lockHash)
+      || !/^[0-9a-f]{40}$/.test(lease.sourceSha)) {
+      reason = 'invalid-lease';
+    } else {
+      const stopped = await ops.stopChildProcesses(lease);
+      if (Number.isSafeInteger(stopped.remaining) && stopped.remaining >= 0) {
+        observedResidue += stopped.remaining;
+        processMeasured = true;
+      }
+      if (!Number.isSafeInteger(stopped.remaining) || stopped.remaining !== 0) {
+        reason = 'child-processes-remain';
+      } else {
+        const plan = decidePodReuseCleanup({ base: lease.sourceSha, resetExitCode: 0,
+          cleanExitCode: 0, statusExitCode: 0, statusPorcelain: '' });
+        const reset = await ops.git(lease, plan.resetArgs);
+        if (reset.status !== 0) reason = 'reset-failed';
+        else {
+          const clean = await ops.git(lease, plan.cleanArgs);
+          if (clean.status !== 0) reason = 'clean-failed';
+          else {
+            const status = await ops.git(lease, plan.statusArgs);
+            if (status.status === 0 && typeof status.stdout === 'string') {
+              observedResidue += status.stdout.split('\0').filter(Boolean).length;
+              gitMeasured = true;
+            }
+            const decision = decidePodReuseCleanup({ base: lease.sourceSha,
+              resetExitCode: reset.status, cleanExitCode: clean.status,
+              statusExitCode: status.status, statusPorcelain: status.stdout ?? '' });
+            if (status.status === 0 && typeof status.stdout !== 'string') reason = 'status-unavailable';
+            else if (decision.outcome !== 'reuse') reason = decision.reason ?? 'worktree-not-clean';
+          }
+        }
+      }
+    }
+  } catch (error) {
+    reason = `cleanup-error:${error instanceof Error ? error.message : String(error)}`;
+  }
+  // A failed process or Git check never skips credential revocation.
+  try {
+    const credentials = await ops.removeRunCredentials(lease);
+    credentialsRemoved = credentials.remaining === 0;
+    if (Number.isSafeInteger(credentials.remaining) && credentials.remaining >= 0) {
+      observedResidue += credentials.remaining;
+      credentialsMeasured = true;
+    }
+    if (!credentialsRemoved && !reason) reason = 'credentials-remain';
+  } catch (error) {
+    const credentialReason = `credential-revoke-error:${error instanceof Error ? error.message : String(error)}`;
+    reason = reason ? `${reason};${credentialReason}` : credentialReason;
+  }
+  if (!reason && credentialsRemoved) {
+    try {
+      // Git clean and credential revocation can reveal child processes that appeared after the
+      // pre-cleanup survey. A lease returns clean only when the re-survey immediately before
+      // returnLease also reports zero remaining processes.
+      const resurvey = await ops.stopChildProcesses(lease);
+      if (!Number.isSafeInteger(resurvey.remaining) || resurvey.remaining !== 0) {
+        reason = 'child-processes-resurfaced';
+        if (Number.isSafeInteger(resurvey.remaining) && resurvey.remaining > 0) observedResidue += resurvey.remaining;
+      } else {
+        // Eligibility is observed only after the final process re-survey succeeds.
+        ops.observe('return-decision', { ...facts, outcome: 'eligible' });
+        await ops.returnLease(lease, { clean: true, reason: 'clean', observedResidue: 0 });
+        log('return-decision', { outcome: 'returned' });
+        return { outcome: 'returned', reason: 'clean' };
+      }
+    } catch (error) {
+      reason = `return-or-observation-error:${error instanceof Error ? error.message : String(error)}`;
+    }
+  }
+  log('clean-failed', { reason });
+  try { await ops.quarantine(lease, { clean: false, reason,
+    observedResidue: observedResidue > 0 || (processMeasured && gitMeasured && credentialsMeasured)
+      ? observedResidue : null }); }
+  catch (error) {
+    log('quarantine-failed', { reason, error: error instanceof Error ? error.message : String(error) });
+    throw error;
+  }
+  log('return-decision', { outcome: 'quarantined', reason });
+  return { outcome: 'quarantined', reason };
+}