elanous 0.2.34 → 0.2.36

package/src/task-orchestrator/surfaces/pod-image-source.ts

@@ -14,9 +14,12 @@
  *   이미지는 표준판(elanous-harness)만 — 이 발사 경로는 lite 를 쓰지 않는다.
  */
 import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { SPAWN_SYNC_MAX_BUFFER } from '../../util/spawn-sync-output.js';
 import { debug } from '../../debug/log.js';
-import { memberHasRegistry, registryImageRef, type RemoteRun } from './pod-pool.js';
+import { memberHasRegistry, registryImageRef, syncPoolImages, parsePodPool, type PodPoolMember, type RemoteRun } from './pod-pool.js';
 
 const POD_IMAGE = 'elanous-harness';
 
@@ -59,6 +62,91 @@ export function resolvePodImageSource(
   return { kind: 'pinned', ref: podImageRef(registry, commit), commit, registry };
 }
 
+export interface PodShelfImage { readonly commit: string; readonly image: string; readonly action: 'fresh' | 'built' }
+
+export function resolvePodShelfRef(ref: string, cwd = process.cwd(), exec = spawnSync): string {
+  const requested = ref.trim();
+  if (!requested || requested.startsWith('-') || /[\s\x00-\x1f]/u.test(requested)) throw new Error('pod shelf: invalid ref');
+  const spec = /^#?(\d+)$/u.exec(requested);
+  if (spec) {
+    const pr = exec('gh', ['pr', 'view', spec[1]!, '--json', 'headRefOid', '--jq', '.headRefOid'], { cwd, encoding: 'utf8', timeout: 30_000 });
+    const sha = String(pr.stdout ?? '').trim().toLowerCase();
+    if (pr.status !== 0 || !/^[0-9a-f]{40}$/u.test(sha)) throw new Error(`pod shelf: PR head unavailable: ${requested}`);
+    return sha;
+  }
+  const git = exec('git', ['rev-parse', '--verify', `${requested}^{commit}`], { cwd, encoding: 'utf8', timeout: 30_000 });
+  const sha = String(git.stdout ?? '').trim().toLowerCase();
+  if (git.status !== 0 || !/^[0-9a-f]{40}$/u.test(sha)) throw new Error(`pod shelf: ref unavailable: ${requested}`);
+  return sha;
+}
+
+/** Checkout only the requested commit; syncPoolImages retains its per-host build lock and SHA12 registry check. */
+export async function putPodShelfImage(ref: string, pool: string, deps: {
+  resolve?: (ref: string) => string;
+  sync?: typeof syncPoolImages;
+  checkout?: (commit: string, dir: string) => void;
+  tempDir?: () => string;
+  remove?: (dir: string) => void;
+  hasRegistry?: (member: PodPoolMember) => boolean;
+} = {}): Promise<PodShelfImage> {
+  const members = parsePodPool(pool);
+  if (members.length !== 1 || !members[0]!.sshHost) throw new Error('pod shelf: one remote registry pool member is required');
+  const member: PodPoolMember = members[0]!;
+  if (!(deps.hasRegistry ?? memberHasRegistry)(member)) throw new Error('pod shelf: remote registry unavailable');
+  const commit = (deps.resolve ?? resolvePodShelfRef)(ref);
+  if (!/^[0-9a-f]{40}$/u.test(commit)) throw new Error('pod shelf: full commit required');
+  const registry = member.registry ?? podImageRegistry();
+  const image = podImageRef(registry, commit);
+  if (!deps.sync && registryImageRef(member, commit) === image) return { commit, image, action: 'fresh' };
+  const dir = (deps.tempDir ?? (() => mkdtempSync(join(tmpdir(), 'pod-shelf-'))))();
+  try {
+    if (deps.checkout) deps.checkout(commit, dir);
+    else {
+      const clone = spawnSync('git', ['clone', '-q', '--no-checkout', process.cwd(), dir], { encoding: 'utf8', timeout: 120_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (clone.status !== 0) throw new Error(`pod shelf: clone failed: ${clone.stderr}`);
+      const fetch = spawnSync('git', ['-C', dir, 'fetch', '-q', 'origin', commit], { encoding: 'utf8', timeout: 120_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (fetch.status !== 0) {
+        const remote = spawnSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+        if (remote.status !== 0) throw new Error(`pod shelf: fetch failed: ${fetch.stderr}`);
+        const fromOrigin = spawnSync('git', ['-C', dir, 'fetch', '-q', String(remote.stdout).trim(), commit], { encoding: 'utf8', timeout: 120_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+        if (fromOrigin.status !== 0) throw new Error(`pod shelf: fetch failed: ${fromOrigin.stderr}`);
+      }
+      const checkout = spawnSync('git', ['-C', dir, 'checkout', '--detach', commit], { encoding: 'utf8', timeout: 120_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (checkout.status !== 0) throw new Error(`pod shelf: checkout failed: ${checkout.stderr}`);
+    }
+    const sync = deps.sync ?? syncPoolImages;
+    const results = await sync([member], 'elanous-harness:local', commit, {
+      buildScript: join(dir, 'docker/harness/build.sh'),
+      ...(deps.sync ? {} : { ship: () => ({ ok: false, action: 'failed' as const, detail: 'shelf build failed; local image fallback prohibited' }) }),
+      remoteBuild: deps.sync ? undefined : async (host, cluster, registry) => {
+        const { spawn } = await import('node:child_process');
+        return new Promise((done) => {
+          const child = spawn('bash', [join(dir, 'docker/harness/build.sh')], { env: { ...process.env, ELANOUS_BUILD_REMOTE: host, ELANOUS_L2_CLUSTER: cluster, ...(registry ? { ELANOUS_BUILD_REGISTRY: registry } : {}) }, stdio: ['ignore', 'pipe', 'pipe'] });
+          let output = '';
+          child.stdout.on('data', (chunk) => { output += chunk; });
+          child.stderr.on('data', (chunk) => { output += chunk; });
+          child.on('close', (code) => done({ ok: code === 0, detail: output.slice(-300) }));
+          child.on('error', (error) => done({ ok: false, detail: error.message }));
+        });
+      },
+    });
+    const result = results.get(member.context);
+    if (!result?.ok || result.imageRef !== image) throw new Error(`pod shelf: image unavailable: ${result?.detail ?? image}`);
+    return { commit, image, action: result.action === 'fresh' ? 'fresh' : 'built' };
+  } finally { (deps.remove ?? ((path) => rmSync(path, { recursive: true, force: true })))(dir); }
+}
+
+export function listPodShelfImages(pool: string, run: RemoteRun): string[] {
+  const member = parsePodPool(pool)[0];
+  if (!member?.sshHost) throw new Error('pod shelf: remote pool member required');
+  const registry = member.registry ?? podImageRegistry();
+  const port = registry.slice(registry.lastIndexOf(':') + 1);
+  const result = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${port}/v2/elanous-harness/tags/list 2>/dev/null`);
+  if (result.status !== 0) throw new Error(`pod shelf: registry unavailable: ${result.stderr}`);
+  const tags: unknown = JSON.parse(result.stdout).tags;
+  return Array.isArray(tags) ? tags.filter((tag): tag is string => typeof tag === 'string' && /^[0-9a-f]{12}$/u.test(tag)).map((tag) => `${registry}/elanous-harness:${tag}`) : [];
+}
+
 export function podImageMissingMessage(ref: string): string {
   return `기준 이미지 ${ref} 가 레지스트리에 없다 — 레일이 굽기 전이다`;
 }

package/src/task-orchestrator/surfaces/pod-launch-history.ts

@@ -0,0 +1,133 @@
+/**
+ * POD-LAUNCH-PROVENANCE slice 2 — TA/harness si-task Jobs.
+ *
+ * ① `siTaskPodProvenance` fills the shared provenance set (pod-provenance.ts · #29650) for a si-task Job from the
+ *    launch env the parent already has (owner · seat · task card · checklist slot · entrance stamp). It never builds
+ *    labels itself — `podProvenanceMetadata` stays the one builder.
+ * ② The history is append-only rows on the parent's existing run ledger (`pod-launch-started` when the Job is
+ *    applied, `pod-launch-finished` at the terminal verdict) — no new store. `readPodLaunchHistory(runId)` answers
+ *    «who launched which Pod, when and why, and how did it end» from that ledger alone.
+ */
+import { userInfo } from 'node:os';
+import { LAUNCH_SEATS, resolveLaunchStamp } from '../../harness/launch-stamp.js';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../../self-implement/run-ledger.js';
+import type { PodProvenance } from './pod-provenance.js';
+import type { PodWorkIdentity } from './pod-pool.js';
+
+export const POD_LAUNCH_STARTED_EVENT = 'pod-launch-started';
+export const POD_LAUNCH_FINISHED_EVENT = 'pod-launch-finished';
+
+export interface SiTaskProvenanceInput {
+  env: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>;
+  /** The child runId this Job runs as (`ELANOUS_RUN_ID` inside the Pod). */
+  runId: string;
+  parentRunId?: string;
+  workIdentity: PodWorkIdentity;
+  /** ISO-8601 UTC. */
+  requestedAt: string;
+  feature: string;
+  launchHost?: string;
+  commit?: string | null;
+  version?: string;
+  memReq?: string;
+  shard?: string;
+}
+
+const text = (value: string | undefined | null): string | undefined => {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+};
+
+function osUser(): string | undefined {
+  try { return text(userInfo().username); } catch { return undefined; }
+}
+
+/**
+ * The si-task identity. Actor order: the Job owner the dispatcher named → the launch stamp actor (seat · session · loop)
+ * → the OS user. `pool` is deliberately absent: `ELANOUS_POD_POOL` is read as pool config by the child harness.
+ */
+export function siTaskPodProvenance(input: SiTaskProvenanceInput): Partial<PodProvenance> {
+  const env = input.env as NodeJS.ProcessEnv;
+  const identity = input.workIdentity;
+  const stamp = resolveLaunchStamp({}, env);
+  const ownerId = text(identity.ownerId);
+  const stampActor = text(stamp.actor);
+  const user = text(env.USER) ?? text(env.LOGNAME) ?? osUser();
+  const actor = ownerId ?? stampActor ?? user;
+  const actorKind = ownerId && identity.ownerKind
+    ? (identity.ownerKind === 'steward' || identity.ownerKind === 'orchestrator' ? 'loop' : identity.ownerKind)
+    : stampActor && (LAUNCH_SEATS as readonly string[]).includes(stampActor) ? 'seat'
+      : stampActor && stampActor === text(env.ELANOUS_LOOP_NAME) ? 'loop'
+        : actor ? 'human' : undefined;
+  const authoring = identity.work === 'authoring';
+  const entrance = stamp.entrance !== 'unknown' ? stamp.entrance : identity.taskCard ? 'tasks-hand' : undefined;
+  const firstLine = input.feature.split('\n', 1)[0]?.trim().slice(0, 160) ?? '';
+  const reason = [identity.taskCard ? `TA ${identity.taskCard}` : undefined, firstLine || undefined].filter(Boolean).join(' · ');
+  return {
+    ...(actorKind ? { actorKind } : {}),
+    ...(actor ? { actor } : {}),
+    kind: 'si-task',
+    run: input.runId,
+    phase: authoring ? 'authoring' : 'impl',
+    requestedAt: input.requestedAt,
+    character: identity.taskCard ? 'ta-child' : authoring ? 'author-child' : 'harness-child',
+    ...(entrance ? { entrance } : {}),
+    ...(text(identity.slotId) ? { cell: identity.slotId } : {}),
+    ...(text(input.version) ? { version: input.version } : {}),
+    ...(text(input.commit) ? { commit: input.commit! } : {}),
+    ...(text(input.launchHost) ? { launchHost: input.launchHost } : {}),
+    ...(text(input.shard) ? { shard: input.shard } : {}),
+    ...(text(input.memReq) ? { memReq: input.memReq } : {}),
+    ...(text(input.parentRunId) ? { parent: input.parentRunId } : {}),
+    ...(reason ? { reason } : {}),
+  };
+}
+
+/** `elanous.ai/<key>` annotations → `{ <key>: value }` for the started row (full values, not the 63-char labels). */
+export function provenanceRowFromAnnotations(annotations: Readonly<Record<string, string>>): Record<string, string> {
+  const row: Record<string, string> = {};
+  for (const [key, value] of Object.entries(annotations)) if (key.startsWith('elanous.ai/')) row[key.slice('elanous.ai/'.length)] = value;
+  return row;
+}
+
+export interface PodLaunchRecord {
+  job: string;
+  run: string;
+  attempt: number | null;
+  startedAt: string | null;
+  provenance: Record<string, string>;
+  finished: { at: string | null; phase: string; exitCode: number | null; reason: string } | null;
+}
+
+const str = (value: unknown): string | undefined => (typeof value === 'string' && value ? value : undefined);
+
+/** Rebuild launch records from one run ledger. Rows pair on job·run; an unpaired row stays visible (never dropped). */
+export function readPodLaunchHistory(runId: string, dir: string = runLedgerDir()): PodLaunchRecord[] {
+  const entries: RunLedgerEntry[] = loadRunLedger(runId, dir) ?? [];
+  const records: PodLaunchRecord[] = [];
+  const open = new Map<string, PodLaunchRecord>();
+  for (const entry of entries) {
+    if (entry.event !== POD_LAUNCH_STARTED_EVENT && entry.event !== POD_LAUNCH_FINISHED_EVENT) continue;
+    const job = str(entry.data.job) ?? 'unknown';
+    const run = str(entry.data.run) ?? 'unknown';
+    const key = `${job}\u0000${run}`;
+    if (entry.event === POD_LAUNCH_STARTED_EVENT) {
+      const provenance: Record<string, string> = {};
+      const raw = entry.data.provenance;
+      if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+        for (const [name, value] of Object.entries(raw as Record<string, unknown>)) if (typeof value === 'string') provenance[name] = value;
+      }
+      const record: PodLaunchRecord = { job, run, attempt: typeof entry.data.attempt === 'number' ? entry.data.attempt : null,
+        startedAt: entry.timestamp ?? null, provenance, finished: null };
+      records.push(record);
+      open.set(key, record);
+      continue;
+    }
+    const finished = { at: entry.timestamp ?? null, phase: str(entry.data.phase) ?? 'unknown',
+      exitCode: typeof entry.data.exitCode === 'number' ? entry.data.exitCode : null, reason: str(entry.data.reason) ?? 'unknown' };
+    const started = open.get(key);
+    if (started && !started.finished) { started.finished = finished; open.delete(key); continue; }
+    records.push({ job, run, attempt: typeof entry.data.attempt === 'number' ? entry.data.attempt : null, startedAt: null, provenance: {}, finished });
+  }
+  return records;
+}

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -236,6 +236,10 @@ export interface ExternalGitHubProbe {
   githubHttps: boolean | null;
   measuredAt: string | null;
   reason: string | null;
+  /** Name of the disposable Pod for matching this reading with its Kubernetes logs. */
+  podName?: string;
+  /** Unmodified stdout from `kubectl logs` for this Pod (only present when readable). */
+  podLog?: string;
 }
 const DNS_CACHE_MS = 10 * 60_000;
 const DNS_STALE_OK_MS = 30 * 60_000;
@@ -261,9 +265,11 @@ export function probePoolGitHub(context: string, kubectl: PoolKubectl = leaseKub
       if (typeof record?.at !== 'number' || now() < record.at || now() - record.at >= 60_000) return null;
       if (typeof record.measuredAt !== 'string' || ![true, false].includes(record.externalDns as boolean) ||
           ![true, false, null].includes(record.githubHttps as boolean | null) ||
-          !(record.reason === null || typeof record.reason === 'string')) return null;
+          !(record.reason === null || typeof record.reason === 'string') ||
+          typeof record.podName !== 'string' || typeof record.podLog !== 'string') return null;
       return { externalDns: record.externalDns as boolean, githubHttps: record.githubHttps as boolean | null,
-        measuredAt: record.measuredAt, reason: record.reason as string | null };
+        measuredAt: record.measuredAt, reason: record.reason as string | null,
+        podName: record.podName, podLog: record.podLog };
     } catch { return null; }
   };
   const fresh = cached();
@@ -285,6 +291,7 @@ export function probePoolGitHub(context: string, kubectl: PoolKubectl = leaseKub
     const shared = cached();
     if (shared) return shared;
     const result = runPoolGitHubProbe(context, kubectl, new Date(now()).toISOString());
+    debug.log('pod.lease', 'github-egress-probe', { context, ...result });
     if (result.measuredAt !== null) {
       const temp = `${cache}.${randomUUID()}.tmp`;
       try { writeFileSync(temp, JSON.stringify({ ...result, at: now() }), { mode: 0o600 }); renameSync(temp, cache); }
@@ -300,16 +307,18 @@ export function probePoolGitHub(context: string, kubectl: PoolKubectl = leaseKub
 function runPoolGitHubProbe(context: string, kubectl: PoolKubectl, measuredAt: string): ExternalGitHubProbe {
   const name = `elanous-egress-${randomUUID().slice(0, 12)}`;
   const base = ['--context', context, '--request-timeout=15s'];
-  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
   let created = false;
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason,
+    ...(created ? { podName: name } : {}) });
   try {
     const manifest = JSON.stringify({ apiVersion: 'v1', kind: 'Pod', metadata: { name, namespace: 'elanous-test', labels: { 'elanous.probe': 'github-egress' } }, spec: {
       restartPolicy: 'Never', activeDeadlineSeconds: 35, automountServiceAccountToken: false,
       containers: [{ name: 'probe', image: 'busybox:1.36', command: ['sh', '-c',
-        'if nslookup github.com >/dev/null 2>&1; then echo EXTERNAL_DNS_OK; if wget -q -T 8 -O /dev/null https://github.com/; then echo GITHUB_HTTPS_OK; else echo GITHUB_HTTPS_FAILED; fi; else echo EXTERNAL_DNS_FAILED; fi'],
+        'if nslookup github.com 2>&1; then echo EXTERNAL_DNS_OK; if wget -T 8 -O /dev/null https://github.com/ 2>&1; then echo GITHUB_HTTPS_OK; else echo GITHUB_HTTPS_FAILED; fi; else echo EXTERNAL_DNS_FAILED; fi'],
       resources: { requests: { cpu: '0', memory: '16Mi' }, limits: { cpu: '100m', memory: '64Mi' } } }],
     } });
-    if (kubectl([...base, 'create', '-f', '-'], manifest).status !== 0) return unknown('probe create failed');
+    const createdPod = kubectl([...base, 'create', '-f', '-'], manifest);
+    if (createdPod.status !== 0) return unknown(`probe create failed${createdPod.stderr.trim() ? `: ${createdPod.stderr.trim().split('\n').pop()!.slice(0, 160)}` : ''}`);
     created = true;
     const waited = kubectl([...base, '-n', 'elanous-test', 'wait', '--for=jsonpath={.status.phase}=Succeeded', `pod/${name}`, '--timeout=25s']);
     const podResult = kubectl([...base, '-n', 'elanous-test', 'get', `pod/${name}`, '-o', 'json']);
@@ -327,10 +336,10 @@ function runPoolGitHubProbe(context: string, kubectl: PoolKubectl, measuredAt: s
     const httpsOk = markers.includes('GITHUB_HTTPS_OK');
     const httpsFail = markers.includes('GITHUB_HTTPS_FAILED');
     if (dnsFail && !dnsOk && !httpsOk && !httpsFail)
-      return { externalDns: false, githubHttps: null, measuredAt, reason: 'external DNS failed' };
+      return { externalDns: false, githubHttps: null, measuredAt, reason: 'external DNS failed', podName: name, podLog: logs.stdout };
     if (dnsOk && !dnsFail && httpsOk !== httpsFail)
-      return { externalDns: true, githubHttps: httpsOk, measuredAt, reason: httpsFail ? 'GitHub HTTPS failed' : null };
-    return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+      return { externalDns: true, githubHttps: httpsOk, measuredAt, reason: httpsFail ? 'GitHub HTTPS failed' : null, podName: name, podLog: logs.stdout };
+    return { ...unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout'), podLog: logs.stdout };
   } catch { return unknown('probe failed'); }
   finally {
     if (created) try { kubectl([...base, '-n', 'elanous-test', 'delete', `pod/${name}`, '--ignore-not-found=true', '--wait=false']); }

package/src/task-orchestrator/surfaces/pod-manifest-test-normalize.ts

@@ -1,11 +1,28 @@
 import { BUDGET_SNAPSHOT_ENV } from '../../execution-loop/launch-gate.js';
 
-// Preserve the manifest contract except for two values generated per launch.
+/** The Pod push fence embeds a different six-hex run key in each independent launch. */
+export function stablePodRunGuard(text: string): string {
+  return text.replace(/pr-create-r[0-9a-f]{6}-/g, 'pr-create-r<run>-')
+    .replace(/-r[0-9a-f]{6}(?=[-|*])/g, '-r<run>');
+}
+
+// Preserve the manifest contract except for the budget timestamp and run identities generated per launch.
 export function stablePodManifestText(applied: Array<Record<string, any>>): string {
   const manifests = structuredClone(applied.filter((entry) => entry.kind === 'Job' || entry.kind === 'Secret'));
   let snapshots = 0;
   for (const manifest of manifests) {
     if (manifest.kind !== 'Job') continue;
+    // POD-LAUNCH-PROVENANCE — the request time and the 8-char run/parent labels are per launch like the run id.
+    for (const meta of [manifest.metadata, manifest.spec?.template?.metadata]) {
+      for (const bag of [meta?.labels, meta?.annotations]) {
+        if (!bag) continue;
+        if (bag['elanous.ai/requested-at'] !== undefined) bag['elanous.ai/requested-at'] = '<requested-at>';
+        if (meta?.labels === bag) for (const key of ['elanous.ai/run', 'elanous.ai/parent']) if (bag[key] !== undefined) bag[key] = '<run-label>';
+      }
+    }
+    for (const container of manifest.spec?.template?.spec?.containers ?? []) {
+      for (const entry of container.env ?? []) if (entry.name === 'ELANOUS_POD_REQUESTED_AT') entry.value = '<requested-at>';
+    }
     for (const container of manifest.spec?.template?.spec?.containers ?? []) {
       for (const entry of container.env ?? []) {
         if (entry.name !== BUDGET_SNAPSHOT_ENV) continue;
@@ -19,5 +36,5 @@ export function stablePodManifestText(applied: Array<Record<string, any>>): stri
     }
   }
   if (snapshots === 0) throw new Error('manifest comparison requires a budget snapshot');
-  return JSON.stringify(manifests).replace(/run-[0-9a-f-]{36}/g, 'run-<id>');
+  return stablePodRunGuard(JSON.stringify(manifests).replace(/run-[0-9a-f-]{36}/g, 'run-<id>'));
 }

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -89,14 +89,29 @@ function defaultLocalImageInspect(image: string): { status: number | null; stdou
   return { status: r.status, stdout: r.stdout ?? '' };
 }
 
+/** 레지스트리 안 이미지 이름 — `docker/harness/build.sh` 의 full/lite 규칙 그대로. */
+function podRegistryImageName(image: string): string {
+  return image === 'elanous-harness-lite:local' ? 'elanous-harness-lite' : 'elanous-harness';
+}
+
+/** 레지스트리 태그 = 커밋 앞 12자리 (build.sh:295 와 같은 규칙). */
+function podRegistryTag(commit: string): string {
+  return commit.slice(0, 12);
+}
+
+/** 노드 로컬 레지스트리의 HTTP 포트 — 호스트에서는 같은 포트의 localhost 로 조회한다. */
+function memberRegistryPort(member: PodPoolMember): string {
+  const registry = memberRegistry(member);
+  return registry.slice(registry.lastIndexOf(':') + 1);
+}
+
 /** 이 커밋의 이미지가 노드 레지스트리에 있나 — 있으면 클러스터 안 이미지 주소. */
 export function registryImageRef(member: PodPoolMember, commit: string | null, run: RemoteRun = defaultRemoteRun, image = 'elanous-harness:local'): string | null {
   if (!member.sshHost || !commit) return null;
-  const imageName = image === 'elanous-harness-lite:local' ? 'elanous-harness-lite' : 'elanous-harness';
-  const tag = commit.slice(0, 12);
+  const imageName = podRegistryImageName(image);
+  const tag = podRegistryTag(commit);
   const registry = memberRegistry(member);
-  const port = registry.slice(registry.lastIndexOf(':') + 1);
-  const r = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${port}/v2/${imageName}/tags/list 2>/dev/null`);
+  const r = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${memberRegistryPort(member)}/v2/${imageName}/tags/list 2>/dev/null`);
   if (r.status !== 0) return null;
   try {
     const tags = (JSON.parse(r.stdout) as { tags?: string[] }).tags ?? [];
@@ -104,6 +119,54 @@ export function registryImageRef(member: PodPoolMember, commit: string | null, r
   } catch { return null; }
 }
 
+/** 레지스트리 HTTP 한 번 — 노드에서 `curl -fsS --max-time 5`(registryImageRef 와 같은 규칙). 실패면 null. */
+function registryHttpGet(member: PodPoolMember, path: string, run: RemoteRun, accept?: string): string | null {
+  if (!member.sshHost) return null;
+  const header = accept ? `-H 'Accept: ${accept}' ` : '';
+  const r = run(member.sshHost, `curl -fsS --max-time 5 ${header}http://localhost:${memberRegistryPort(member)}/v2/${path} 2>/dev/null`);
+  return r.status === 0 && r.stdout.trim() ? r.stdout : null;
+}
+
+function registryLabelValue(raw: unknown): string | null {
+  return typeof raw === 'string' && raw.trim() && raw !== '<no value>' ? raw.trim() : null;
+}
+
+/**
+ * GATE-REGISTRY-IMAGE-FASTPATH (0.2.36): 레지스트리 HTTP 만으로 이 커밋 태그 이미지의 config label 을 읽는다 —
+ * 노드 Docker 데몬(`docker image inspect`)을 부르지 않는다. 태그 결손 · HTTP 오류 · manifest list(단일 config 없음) ·
+ * 비JSON 은 null 이다(판정하지 않고 종전 경로로 떨어진다).
+ *   GET /v2/<이미지>/manifests/<커밋12> → config.digest → GET /v2/<이미지>/blobs/<digest> → config.Labels
+ */
+export function registryImageLabels(member: PodPoolMember, image: string, commit: string | null, run: RemoteRun = defaultRemoteRun): { commit: string | null; skills: string | null } | null {
+  if (!member.sshHost || !commit) return null;
+  const imageName = podRegistryImageName(image);
+  const manifest = registryHttpGet(member, `${imageName}/manifests/${podRegistryTag(commit)}`, run, 'application/vnd.docker.distribution.manifest.v2+json');
+  if (!manifest) return null;
+  let digest: string | undefined;
+  try { digest = (JSON.parse(manifest) as { config?: { digest?: string } }).config?.digest; } catch { return null; }
+  if (!digest) return null;
+  // config digest 는 `sha256:<64 hex>` — 이 형태가 아니면 경로에 넣지 않는다.
+  if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) return null;
+  const blob = registryHttpGet(member, `${imageName}/blobs/${digest}`, run);
+  if (!blob) return null;
+  let labels: Record<string, unknown> | undefined;
+  try { labels = (JSON.parse(blob) as { config?: { Labels?: Record<string, unknown> } }).config?.Labels; } catch { return null; }
+  if (!labels || typeof labels !== 'object') return null;
+  return { commit: registryLabelValue(labels['elanous.commit']), skills: registryLabelValue(labels['elanous.pod-skills']) };
+}
+
+/**
+ * 이 커밋 태그의 이미지 label 이 이번 발사 값과 모두 맞나 — 맞으면 Docker 조회 없이 그 판을 쓸 수 있다.
+ * 커밋 label 은 발사 커밋과 «정확히» 같아야 한다(태그가 다른 판을 가리키는 경우를 거른다).
+ * `localSkillsDigest` 가 없으면(모르는 값) 커밋 label 만 본다 — syncPoolImages 의 종전 skillsSame 과 같은 뜻.
+ */
+export function registryImageLabelsMatch(member: PodPoolMember, image: string, commit: string | null, opts: { localSkillsDigest?: string | null; run?: RemoteRun } = {}): boolean {
+  if (!commit) return false;
+  const labels = registryImageLabels(member, image, commit, opts.run ?? defaultRemoteRun);
+  if (!labels || labels.commit !== commit) return false;
+  return opts.localSkillsDigest == null || labels.skills === opts.localSkillsDigest;
+}
+
 /** IMAGE-ONE-SOURCE: 이 멤버의 노드에 레지스트리 컨테이너가 있나(syncPoolImages 의 판정과 같은 명령). 로컬 멤버는 false. */
 export function memberHasRegistry(member: PodPoolMember, run: RemoteRun = defaultRemoteRun): boolean {
   if (!member.sshHost) return false;
@@ -873,6 +936,15 @@ export async function syncPoolImages(members: readonly PodPoolMember[], image: s
   await Promise.all(members.map(async (m) => {
     const t0 = Date.now();
     if (!m.sshHost) { results.set(m.context, { ok: true, action: 'local', detail: 'this machine', ms: 0 }); return; }
+    // ⭐ GATE-REGISTRY-IMAGE-FASTPATH (0.2.36 · OP): 레지스트리 커밋 태그의 config label(commit ⊕ pod-skills)이 이번 발사
+    //   값과 같으면 노드 Docker 데몬을 «한 번도» 부르지 않고 그 커밋 ref 로 끝난다 — 데몬 조회가 느려도 gate 첫 Pod 이 뜬다.
+    //   태그 결손 · label 불일치 · HTTP 오류면 아래 종전 경로(원격 inspect → 노드 빌드 → 통째 전송)가 그대로 판정한다.
+    if (localCommit && registryImageLabelsMatch(m, image, localCommit, { ...(deps.localSkillsDigest !== undefined ? { localSkillsDigest: deps.localSkillsDigest } : {}), run })) {
+      const imageRef = `${memberRegistry(m)}/${podRegistryImageName(image)}:${podRegistryTag(localCommit)}`;
+      debug.log('pod.pool', 'image-fresh-registry-label', { context: m.context, host: m.sshHost, commit: localCommit, imageRef, skills: deps.localSkillsDigest ?? null, waitedMs: 0 });
+      results.set(m.context, { ok: true, action: 'fresh', detail: localCommit.slice(0, 12), ms: Date.now() - t0, imageRef });
+      return;
+    }
     const before = remoteImageCommit(m, image, run);
     const skillsNow = deps.localSkillsDigest;
     const refBefore = registryImageRef(m, localCommit, run, image);

package/src/task-orchestrator/surfaces/pod-provenance.ts

@@ -0,0 +1,82 @@
+import { redactSecretText } from '../../debug/log.js';
+
+/** The work that owns a Pod. Job metadata is the current view; pod.provenance events retain history. */
+export interface PodProvenance {
+  actorKind: string;
+  actor: string;
+  kind: string;
+  run: string;
+  phase: string;
+  requestedAt: string;
+  character?: string;
+  launchHost?: string;
+  entrance?: string;
+  graphNode?: string;
+  cell?: string;
+  version?: string;
+  commit?: string;
+  shard?: string;
+  reason?: string;
+  /** Parent runId / lease id — whose child this Pod is. Label keeps the first 8 characters like run/commit. */
+  parent?: string;
+  pool?: string;
+  cpuReq?: string;
+  memReq?: string;
+  warmReused?: boolean;
+  argv?: string;
+}
+
+const required = ['actorKind', 'actor', 'kind', 'run', 'phase', 'requestedAt'] as const;
+const names: Record<keyof PodProvenance, string> = {
+  actorKind: 'actor-kind', actor: 'actor', kind: 'kind', run: 'run', phase: 'phase', requestedAt: 'requested-at',
+  character: 'character', launchHost: 'launch-host', entrance: 'entrance', graphNode: 'graph-node', cell: 'cell',
+  version: 'version', commit: 'commit', shard: 'shard', reason: 'reason', parent: 'parent',
+  pool: 'pool', cpuReq: 'cpu-req', memReq: 'mem-req',
+  warmReused: 'warm-reused', argv: 'argv',
+};
+
+/** Every child env name the set can carry (`ELANOUS_POD_<KEY>`). */
+export const POD_PROVENANCE_ENV_NAMES: readonly string[] = Object.values(names)
+  .map((name) => `ELANOUS_POD_${name.toUpperCase().replaceAll('-', '_')}`);
+
+const labelValue = (value: string): string => {
+  const cleaned = value.toLowerCase().replace(/[^a-z0-9._-]/g, '-').replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, '');
+  return cleaned.slice(0, 63).replace(/[^a-z0-9]+$/g, '') || 'unknown';
+};
+
+export interface PodProvenanceMetadata {
+  labels: Record<string, string>;
+  annotations: Record<string, string>;
+  env: Array<{ name: string; value: string }>;
+  missing: string[];
+}
+
+/** A gate reports missing identity as `unknown`; every other launch refuses it before kubectl apply. */
+export function podProvenanceMetadata(input: Partial<PodProvenance> | undefined, gate = false): PodProvenanceMetadata {
+  const missing = required.filter((key) => typeof input?.[key] !== 'string' || !input?.[key]?.trim());
+  if (missing.length && !gate) throw new Error(`pod provenance missing: ${missing.map((key) => names[key]).join(', ')}`);
+  const values: Record<string, string> = {};
+  for (const [key, name] of Object.entries(names) as Array<[keyof PodProvenance, string]>) {
+    const raw = input?.[key];
+    if (raw === undefined || raw === null || raw === '') continue;
+    const value = String(raw).trim();
+    if (!value) continue;
+    // Metadata and env are observable by many users. Never carry a raw secret through an identity field.
+    const redacted = redactSecretText(value);
+    if (redacted !== value && key !== 'reason' && key !== 'argv') throw new Error(`pod provenance secret in ${name}`);
+    values[name] = redacted;
+  }
+  for (const key of missing) values[names[key]] = 'unknown';
+  // The launch reason is observable even when the caller cannot supply one.
+  values.reason ??= 'unknown';
+  const labels: Record<string, string> = {};
+  const annotations: Record<string, string> = {};
+  const env: Array<{ name: string; value: string }> = [];
+  for (const [name, value] of Object.entries(values)) {
+    const label = name === 'run' || name === 'commit' || name === 'parent' ? value.slice(0, 8) : value;
+    if (name !== 'reason' && name !== 'argv') labels[`elanous.ai/${name}`] = labelValue(label);
+    annotations[`elanous.ai/${name}`] = value;
+    env.push({ name: `ELANOUS_POD_${name.toUpperCase().replaceAll('-', '_')}`, value });
+  }
+  return { labels, annotations, env, missing: missing.map((key) => names[key]) };
+}

package/src/task-orchestrator/surfaces/pod-repair-commit.ts

@@ -3,6 +3,7 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
+import { classifyGateEnvDeficit, GATE_ENV_DEFICIT_HARVESTABLE_MARK } from '../../self-implement/gate-env-retry.js';
 
 export const REPAIR_REF = 'refs/elanous/repair/result';
 export const REPAIR_BUNDLE_MAX_BYTES = 5 * 1024 * 1024;
@@ -39,15 +40,29 @@ function completedWorktree(output: string): { path: string; runId: string } {
     let value: Record<string, unknown>;
     try { value = JSON.parse(line) as Record<string, unknown>; } catch { continue; }
     if (value.kind === 'self' && value.result && typeof value.result === 'object') value = value.result as Record<string, unknown>;
-    if (value.stage !== 'worktree-completed' || value.ok !== true || typeof value.worktreePath !== 'string'
+    const completed = value.stage === 'worktree-completed' && value.ok === true;
+    // The gate could not measure an environmental failure. Keep the implementation as a
+    // bundle for the pinned PR; the parent still has to review and rejudge that head.
+    const gate = value.gate && typeof value.gate === 'object' && !Array.isArray(value.gate)
+      ? value.gate as { passed?: unknown; log?: unknown; reflectGateFacts?: { introduced?: number; unknownReason?: string; childResponsibility?: string } }
+      : null;
+    const environmentHarvest = value.stage === 'gate-failed' && value.ok === false
+      && value.harvestable === true && typeof value.detail === 'string'
+      && value.detail.includes(GATE_ENV_DEFICIT_HARVESTABLE_MARK)
+      && gate?.passed === false
+      && gate.reflectGateFacts?.introduced === 0
+      && gate.reflectGateFacts?.childResponsibility === 'none'
+      && classifyGateEnvDeficit({ passed: false, ...(typeof gate.log === 'string' ? { log: gate.log } : {}),
+        ...(gate.reflectGateFacts ? { reflectGateFacts: gate.reflectGateFacts } : {}) }).envDeficit;
+    if ((!completed && !environmentHarvest) || typeof value.worktreePath !== 'string'
       || typeof value.runId !== 'string' || !value.runId)
-      throw new Error('repair child final result is not a successful worktree-only result');
+      throw new Error('repair child final result is neither successful worktree-only nor environment-deficit harvestable');
     return { path: value.worktreePath, runId: value.runId };
   }
   throw new Error('repair child did not return a successful worktree-only result');
 }
 
-/** Called in the Pod after the child exits successfully and before artifact export. */
+/** Called in the Pod after a successful child or a verified environment-deficit harvest. */
 export function writePodRepairCommit(input: { pr: number; baseHead: string; runId: string; output: string; repo: string; outbox: string }): PodRepairResult {
   if (!Number.isSafeInteger(input.pr) || input.pr < 1 || !SHA40.test(input.baseHead)) throw new Error('invalid repair PR or base head');
   if (!input.runId.trim()) throw new Error('repair parent run id missing');

package/src/task-orchestrator/surfaces/pod-si-warm-entry.ts

@@ -0,0 +1,16 @@
+/** Opt-in SI warm entry; the ordinary Pod spawn remains the default. */
+import { podSelfImplementSpawn, type PodSpawnOptions } from './self-implement-pod.js';
+
+export async function podSpawnWithSiWarm(base: PodSpawnOptions,
+  env: NodeJS.ProcessEnv = process.env) {
+  if (env.ELANOUS_SI_WARM_REUSE !== '1') return podSelfImplementSpawn(base);
+  const { acquireSiWarmChild, postprocessSiWarmChild } = await import('./pod-si-warm-host.js');
+  return podSelfImplementSpawn({ ...base,
+    siWarmAttempt: async input => {
+      const result = await acquireSiWarmChild(input, base);
+      return result.status === 'acquired' ? result.attempt : null;
+    },
+    siWarmHostPostprocess: (result, attempt, input) =>
+      postprocessSiWarmChild(input, result, attempt, base),
+  });
+}