elanous 0.2.35 → 0.2.36

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -96,7 +96,7 @@ export function podTerminalRow(row: Record<string, unknown>): {
   return nestedPodResult(row);
 }
 
-export const POD_EXIT_CLASSES = ['oom-killed', 'deadline-exceeded', 'gh-login-failed', 'pod-secret', 'ask-reprompt', 'child-unconverged', 'child-error', 'no-result-line', 'unknown'] as const;
+export const POD_EXIT_CLASSES = ['oom-killed', 'deadline-exceeded', 'gh-login-failed', 'pod-secret', 'ask-reprompt', 'provider-error', 'child-unconverged', 'child-error', 'no-result-line', 'unknown'] as const;
 
 export type PodExitClass = typeof POD_EXIT_CLASSES[number];
 
@@ -108,6 +108,51 @@ const isPodErrorLine = (line: string): boolean =>
 
 const normalizePodLogLine = (line: string): string => line.replace(/\/home\/[^/\s]+\//gu, '~/').slice(0, 240);
 
+/**
+ * PROVIDER-ERROR-PRIORITY: 모델 호출 쪽이 죽은 줄(자격증명·쿼터·과부하·업스트림 5xx).
+ * 자식이 스스로 수렴 못 한 것과 사유가 다르므로 generic 실패(child-error/unknown)보다 먼저 분류한다.
+ */
+const POD_PROVIDER_ERROR_LINE =
+  /\bllm\.[a-z0-9_-]+ (?:credential|response|stream)\b.*\b(?:error|fail(?:ed|ure)?|denied|unavailable|overloaded|exhausted)\b|\b(?:rate[_ -]?limit|quota|credits?)\b.*\b(?:exceeded|exhausted|insufficient|hit)\b|\b(?:provider|upstream)\b.*\b(?:error|overloaded|unavailable|timed? out|5\d\d)\b|(?:프로바이더|제공자|모델)\s*(?:오류|호출 실패|한도 초과)/iu;
+
+/** provider error 줄인가 — bookkeeping 줄과 «파싱되는 JSON 줄»은 세지 않는다(classifyPodExit 의 줄 기준과 같다). */
+function isPodProviderErrorLine(line: string): boolean {
+  if (!line || isPodBookkeepingLine(line)) return false;
+  if (line.startsWith('{')) {
+    try {
+      const parsed: unknown = JSON.parse(line);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return false;
+    } catch { /* 일반 줄이 중괄호로 시작할 수 있다. */ }
+  }
+  return POD_PROVIDER_ERROR_LINE.test(line);
+}
+
+/**
+ * POD-FAIL-EVIDENCE-CAPTURE-FU — duplicate-cap 귀속: 마지막 «canonical» 자식 terminal 하나에만 실패를 붙인다.
+ * canonical 접두(`self`/`external`)가 아닌 lookalike kind 행은 건너뛰고, 마지막 canonical terminal 이 성공이거나
+ * 읽을 오류 줄이 bookkeeping 뿐이면 null — 더 오래된(다른 terminal 의) 실패를 재사용하지 않는다.
+ */
+export function podChildFailureAttribution(logs: string): { stage: string; error: string } | null {
+  for (const line of logs.split('\n').reverse()) {
+    if (!line.trimStart().startsWith('{')) continue;
+    let parsed: unknown;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
+    const row = parsed as Record<string, unknown>;
+    const terminal = podTerminalRow(row);
+    if (!terminal) continue;
+    if (terminal.ok !== false || typeof terminal.error !== 'string') return null;
+    const errorLines = terminal.error.replace(/\/home\/[^/\s]+\//gu, '~/').split(/\r\n|\n|\r/u)
+      .map((part) => part.trim())
+      .filter((part) => part.length > 0 && !isPodBookkeepingLine(part));
+    if (!errorLines.length) return null;
+    const first = errorLines[0]!.slice(0, 240);
+    const last = errorLines.at(-1)!.slice(0, 240);
+    return { stage: terminal.stage, error: first === last ? first : `${first}\n${last}` };
+  }
+  return null;
+}
+
 /** Classify a failed Pod using its terminal metadata and child output, without side effects. */
 export function classifyPodExit(input: {
   errorCode?: string | null;
@@ -131,12 +176,19 @@ export function classifyPodExit(input: {
 } {
   const logLines = input.logs.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean);
   let terminalResult: ReturnType<typeof podTerminalRow> = null;
-  for (const line of logLines) {
+  let lastTerminalIndex = -1;
+  let previousTerminalIndex = -1;
+  for (const [index, line] of logLines.entries()) {
     if (!line.startsWith('{')) continue;
     let parsed: unknown;
     try { parsed = JSON.parse(line); } catch { continue; }
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
-    terminalResult = podTerminalRow(parsed as Record<string, unknown>) ?? terminalResult;
+    const terminal = podTerminalRow(parsed as Record<string, unknown>);
+    if (!terminal) continue;
+    // 마지막 canonical terminal 만 유지 — 앞선 terminal 의 실패를 재사용하지 않는다(duplicate-cap).
+    previousTerminalIndex = lastTerminalIndex;
+    terminalResult = terminal;
+    lastTerminalIndex = index;
   }
   const hasResultLine = terminalResult !== null;
   if (!terminalResult && input.result) terminalResult = podTerminalRow(input.result);
@@ -148,12 +200,19 @@ export function classifyPodExit(input: {
     try { const parsed = JSON.parse(line); return !!parsed && typeof parsed === 'object' && !Array.isArray(parsed); } catch { return false; }
   };
   const hasErrorLine = logLines.some((line) => !isPodBookkeepingLine(line) && !isParsedJsonLine(line) && isPodErrorLine(line));
+  // 동일 terminal 직전만: 마지막 canonical terminal 에 딸린 구간(직전 terminal 다음 ~ 마지막 terminal)의 줄만
+  // provider error 근거로 쓴다 — 오래된 terminal 의 실패를 재사용하지 않는다(duplicate-cap).
+  const attributionLines = lastTerminalIndex === -1
+    ? logLines
+    : logLines.slice(previousTerminalIndex + 1, lastTerminalIndex);
+  const providerError = attributionLines.some((line) => isPodProviderErrorLine(line));
   let exitClass: PodExitClass;
   if (input.errorCode === 'pod-secret') exitClass = 'pod-secret';
   else if (input.jobReason === 'DeadlineExceeded') exitClass = 'deadline-exceeded';
   else if (input.containerReason === 'OOMKilled') exitClass = 'oom-killed';
   else if (input.containerExitCode === 7) exitClass = 'gh-login-failed';
   else if (askReprompt) exitClass = 'ask-reprompt';
+  else if (providerError) exitClass = 'provider-error';
   else if (terminalResult?.stage && terminalResult.ok === false) exitClass = 'child-unconverged';
   else if (!hasResultLine && hasErrorLine) exitClass = 'child-error';
   else if (!hasResultLine) exitClass = 'no-result-line';
@@ -245,3 +304,156 @@ export function extractPodFailureReason(input: {
   const why = input.logTailReason?.trim() || (input.logs.trim() ? '로그에 읽을 수 있는 오류 줄 없음' : '자식 로그 비어 있음');
   return `사유 못 읽음: ${normalizePodLogLine(why)}`;
 }
+
+// JOB-FAILURE-TERMINATION-CAPTURE — the Kubernetes facts of a failed Job, read once at the failure verdict
+//   (Job Failed condition · result marker early exit) before GC removes the Job and its Pod. Unobserved stays
+//   `unknown` — `no-result-line` is never promoted to OOM or deadline here. Only these scalar fields are kept:
+//   no Pod env, Secret, or describe output.
+export type PodTerminationPath = 'job-failed-condition' | 'result-marker';
+export type PodTerminationUnknown = 'unknown';
+
+export interface PodTermination {
+  job: string;
+  path: PodTerminationPath;
+  observedAt: string;
+  /** `ok` only when the Job read names this launch's uid · `unavailable`: failed (NotFound after GC · API error),
+   *  a different or missing uid, or no launch uid to attribute it to. */
+  jobLookup: 'ok' | 'unavailable';
+  /** This launch's Job uid (the attribution key) — `unknown` when the launcher had none, and then nothing is attributed. */
+  jobUid: string | PodTerminationUnknown;
+  jobConditionReason: string | PodTerminationUnknown;
+  /** The Job's configured `spec.activeDeadlineSeconds` — a setting, not evidence the deadline fired. */
+  activeDeadlineSeconds: number | PodTerminationUnknown;
+  /** From the Job Failed condition reason `DeadlineExceeded` only. */
+  deadlineExceeded: boolean | PodTerminationUnknown;
+  /** `terminated`: the latest child container of this uid has a terminated state · without one, the Pod phase
+   *  (`running` · `pending`) or `unknown` (any other or unread phase) · `absent`: no Pod of this uid. */
+  podLookup: 'terminated' | 'running' | 'pending' | 'unknown' | 'absent' | 'unavailable';
+  containerReason: string | PodTerminationUnknown;
+  exitCode: number | PodTerminationUnknown;
+  finishedAt: string | PodTerminationUnknown;
+  /** From `state.terminated.reason === 'OOMKilled'` only (never from exit code 137). */
+  oomKilled: boolean | PodTerminationUnknown;
+}
+
+/** Job Failed condition reason first: the classification takes column one, the capture all three, from one read. */
+export const POD_TERMINATION_JOB_JSONPATH = '{.status.conditions[?(@.type=="Failed")].reason}{"\\t"}{.spec.activeDeadlineSeconds}{"\\t"}{.metadata.uid}';
+/**
+ * One row per Pod of this Job name. The first three columns keep the classification read's layout
+ * (`creation · terminated.reason · terminated.exitCode`, empty when the child has no status yet), so the
+ * Failed-condition path reads Pods once for both; `finishedAt` follows, then `|phase · owner Job uid`.
+ */
+export const POD_TERMINATION_PODS_JSONPATH = '{range .items[*]}{.metadata.creationTimestamp}{"\\t"}{range .status.containerStatuses[?(@.name=="child")]}{.state.terminated.reason}{"\\t"}{.state.terminated.exitCode}{"\\t"}{.state.terminated.finishedAt}{end}{"\\t"}{"\\t"}{"\\t"}{"|"}{.status.phase}{"\\t"}{.metadata.ownerReferences[?(@.kind=="Job")].uid}{"\\n"}{end}';
+
+type PodTerminationKubectl = (args: readonly string[]) => { status: number | null; stdout: string; stderr: string };
+
+const POD_TERMINATION_WORD = /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/;
+const JOB_UID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+const terminationWord = (value: string | undefined): string => {
+  const text = value?.trim() ?? '';
+  return POD_TERMINATION_WORD.test(text) ? text : 'unknown';
+};
+const terminationCount = (value: string | undefined): number | PodTerminationUnknown => {
+  const text = value?.trim() ?? '';
+  return /^\d{1,10}$/.test(text) ? Number(text) : 'unknown';
+};
+const terminationInstant = (value: string | undefined): string => {
+  const text = value?.trim() ?? '';
+  return /^\d{4}-\d{2}-\d{2}T[\d:.]+Z$/.test(text) && Number.isFinite(Date.parse(text)) ? text : 'unknown';
+};
+
+/** Two reads (the Job · its Pods), each fail-soft: a failed or thrown read is `unavailable`, never an inferred value. */
+export function readPodTermination(input: { kubectl: PodTerminationKubectl; namespace: string; job: string; path: PodTerminationPath;
+  /** This launch's Job uid — the only attribution key. A same-name Job of another round (OOM retry · relaunch)
+   *  is not this verdict's state; without it every Job/Pod fact stays unobserved. */
+  jobUid: string | undefined;
+  /** The Failed-condition path's own Job read of `POD_TERMINATION_JOB_JSONPATH` (null: it threw) — not read again,
+   *  so a GC between the verdict and the capture cannot turn an observed reason into `unknown`. */
+  jobRead?: { status: number | null; stdout: string } | null;
+  /** The Failed-condition path's own Pods read of `POD_TERMINATION_PODS_JSONPATH` (null: it threw) — not read again. */
+  podsRead?: { status: number | null; stdout: string } | null;
+  now?: () => Date }): PodTermination {
+  const { kubectl, namespace, job, path } = input;
+  const read = (args: readonly string[]): { status: number | null; stdout: string } | null => {
+    try { return kubectl(args); } catch { return null; }
+  };
+  const jobRead = 'jobRead' in input ? input.jobRead ?? null
+    : read(['-n', namespace, 'get', 'job', job, '-o', `jsonpath=${POD_TERMINATION_JOB_JSONPATH}`]);
+  const [reasonText, deadlineText, uidText] = jobRead?.status === 0 ? jobRead.stdout.replace(/\r?\n$/, '').split('\t') : [];
+  const readUid = JOB_UID.test(uidText?.trim() ?? '') ? uidText!.trim() : undefined;
+  const jobUid = input.jobUid && JOB_UID.test(input.jobUid) ? input.jobUid : undefined;
+  // A read without a uid, or with another uid, is not this launch's Job.
+  const jobOk = jobRead?.status === 0 && jobUid !== undefined && readUid === jobUid;
+  const jobConditionReason = jobOk ? terminationWord(reasonText) : 'unknown';
+  const podsRead = 'podsRead' in input ? input.podsRead ?? null
+    : read(['-n', namespace, 'get', 'pods', '-l', `job-name=${job}`, '-o', `jsonpath=${POD_TERMINATION_PODS_JSONPATH}`]);
+  let podLookup: PodTermination['podLookup'] = 'unavailable';
+  let containerReason = 'unknown';
+  let exitCode: PodTermination['exitCode'] = 'unknown';
+  let finishedAt = 'unknown';
+  // Without a uid the rows cannot be attributed to this Job — they stay unread rather than borrowed from another round.
+  if (podsRead?.status === 0 && jobUid) {
+    // The latest Pod owned by this Job uid only.
+    const rows = podsRead.stdout.split('\n').map((line) => {
+      const cut = line.lastIndexOf('\t|');
+      const [created, reason, exit, finished] = (cut >= 0 ? line.slice(0, cut) : line).split('\t');
+      const [phase, owner] = cut >= 0 ? line.slice(cut + 2).split('\t') : [];
+      return { created: created ?? '', reason, exit, finished, phase: phase?.trim(), owner: owner?.trim() };
+    });
+    const owned = rows.filter((row) => row.created && Number.isFinite(Date.parse(row.created)) && row.owner === jobUid)
+      .sort((a, b) => Date.parse(b.created) - Date.parse(a.created));
+    const latest = owned[0];
+    // Two Pods of this uid created at the same instant (a Job retry): which one is «this» failure is not knowable.
+    const tied = latest !== undefined && owned.length > 1 && Date.parse(owned[1]!.created) === Date.parse(latest.created);
+    if (!latest) podLookup = 'absent';
+    else if (tied) podLookup = 'unknown';
+    else {
+      const { reason, exit, finished, phase } = latest;
+      containerReason = terminationWord(reason);
+      exitCode = terminationCount(exit);
+      finishedAt = terminationInstant(finished);
+      podLookup = containerReason !== 'unknown' || exitCode !== 'unknown' ? 'terminated'
+        : phase === 'Running' ? 'running' : phase === 'Pending' ? 'pending' : 'unknown';
+    }
+  }
+  return {
+    job, path, observedAt: (input.now?.() ?? new Date()).toISOString(),
+    jobLookup: jobOk ? 'ok' : 'unavailable',
+    jobUid: jobUid ?? 'unknown',
+    jobConditionReason,
+    activeDeadlineSeconds: jobOk ? terminationCount(deadlineText) : 'unknown',
+    deadlineExceeded: jobConditionReason === 'unknown' ? 'unknown' : jobConditionReason === 'DeadlineExceeded',
+    podLookup, containerReason, exitCode, finishedAt,
+    oomKilled: podLookup === 'terminated' && containerReason !== 'unknown' ? containerReason === 'OOMKilled' : 'unknown',
+  };
+}
+
+/** Ledger → incident: only a well-formed record of `job` (the current attempt's Job) is carried; anything else is dropped. */
+export function parsePodTermination(value: unknown, job: string): PodTermination | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const row = value as Record<string, unknown>;
+  const oneOf = (v: unknown, allowed: readonly unknown[]) => allowed.includes(v);
+  const wordOrUnknown = (v: unknown) => typeof v === 'string' && (v === 'unknown' || POD_TERMINATION_WORD.test(v));
+  const numberOrUnknown = (v: unknown) => v === 'unknown' || (typeof v === 'number' && Number.isSafeInteger(v) && v >= 0);
+  const boolOrUnknown = (v: unknown) => v === 'unknown' || typeof v === 'boolean';
+  if (row.job !== job || !oneOf(row.path, ['job-failed-condition', 'result-marker'])
+    || typeof row.observedAt !== 'string' || !Number.isFinite(Date.parse(row.observedAt))
+    || !oneOf(row.jobLookup, ['ok', 'unavailable']) || !wordOrUnknown(row.jobConditionReason)
+    || !(row.jobUid === 'unknown' || (typeof row.jobUid === 'string' && JOB_UID.test(row.jobUid)))
+    || !numberOrUnknown(row.activeDeadlineSeconds) || !boolOrUnknown(row.deadlineExceeded)
+    || !oneOf(row.podLookup, ['terminated', 'running', 'pending', 'unknown', 'absent', 'unavailable'])
+    || !wordOrUnknown(row.containerReason) || !numberOrUnknown(row.exitCode)
+    || !(row.finishedAt === 'unknown' || (typeof row.finishedAt === 'string' && terminationInstant(row.finishedAt) !== 'unknown'))
+    || !boolOrUnknown(row.oomKilled)) return undefined;
+  // Facts are attributed through the uid only: a record claiming Job or Pod facts without one is contradictory.
+  if (row.jobUid === 'unknown' && (row.jobLookup !== 'unavailable' || row.podLookup !== 'unavailable')) return undefined;
+  return {
+    job, path: row.path as PodTerminationPath, observedAt: row.observedAt,
+    jobLookup: row.jobLookup as PodTermination['jobLookup'], jobUid: row.jobUid as string, jobConditionReason: row.jobConditionReason as string,
+    activeDeadlineSeconds: row.activeDeadlineSeconds as PodTermination['activeDeadlineSeconds'],
+    deadlineExceeded: row.deadlineExceeded as PodTermination['deadlineExceeded'],
+    podLookup: row.podLookup as PodTermination['podLookup'], containerReason: row.containerReason as string,
+    exitCode: row.exitCode as PodTermination['exitCode'], finishedAt: row.finishedAt as string,
+    oomKilled: row.oomKilled as PodTermination['oomKilled'],
+  };
+}

package/src/task-orchestrator/surfaces/pod-launch-history.ts

@@ -0,0 +1,133 @@
+/**
+ * POD-LAUNCH-PROVENANCE slice 2 — TA/harness si-task Jobs.
+ *
+ * ① `siTaskPodProvenance` fills the shared provenance set (pod-provenance.ts · #29650) for a si-task Job from the
+ *    launch env the parent already has (owner · seat · task card · checklist slot · entrance stamp). It never builds
+ *    labels itself — `podProvenanceMetadata` stays the one builder.
+ * ② The history is append-only rows on the parent's existing run ledger (`pod-launch-started` when the Job is
+ *    applied, `pod-launch-finished` at the terminal verdict) — no new store. `readPodLaunchHistory(runId)` answers
+ *    «who launched which Pod, when and why, and how did it end» from that ledger alone.
+ */
+import { userInfo } from 'node:os';
+import { LAUNCH_SEATS, resolveLaunchStamp } from '../../harness/launch-stamp.js';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../../self-implement/run-ledger.js';
+import type { PodProvenance } from './pod-provenance.js';
+import type { PodWorkIdentity } from './pod-pool.js';
+
+export const POD_LAUNCH_STARTED_EVENT = 'pod-launch-started';
+export const POD_LAUNCH_FINISHED_EVENT = 'pod-launch-finished';
+
+export interface SiTaskProvenanceInput {
+  env: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>;
+  /** The child runId this Job runs as (`ELANOUS_RUN_ID` inside the Pod). */
+  runId: string;
+  parentRunId?: string;
+  workIdentity: PodWorkIdentity;
+  /** ISO-8601 UTC. */
+  requestedAt: string;
+  feature: string;
+  launchHost?: string;
+  commit?: string | null;
+  version?: string;
+  memReq?: string;
+  shard?: string;
+}
+
+const text = (value: string | undefined | null): string | undefined => {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+};
+
+function osUser(): string | undefined {
+  try { return text(userInfo().username); } catch { return undefined; }
+}
+
+/**
+ * The si-task identity. Actor order: the Job owner the dispatcher named → the launch stamp actor (seat · session · loop)
+ * → the OS user. `pool` is deliberately absent: `ELANOUS_POD_POOL` is read as pool config by the child harness.
+ */
+export function siTaskPodProvenance(input: SiTaskProvenanceInput): Partial<PodProvenance> {
+  const env = input.env as NodeJS.ProcessEnv;
+  const identity = input.workIdentity;
+  const stamp = resolveLaunchStamp({}, env);
+  const ownerId = text(identity.ownerId);
+  const stampActor = text(stamp.actor);
+  const user = text(env.USER) ?? text(env.LOGNAME) ?? osUser();
+  const actor = ownerId ?? stampActor ?? user;
+  const actorKind = ownerId && identity.ownerKind
+    ? (identity.ownerKind === 'steward' || identity.ownerKind === 'orchestrator' ? 'loop' : identity.ownerKind)
+    : stampActor && (LAUNCH_SEATS as readonly string[]).includes(stampActor) ? 'seat'
+      : stampActor && stampActor === text(env.ELANOUS_LOOP_NAME) ? 'loop'
+        : actor ? 'human' : undefined;
+  const authoring = identity.work === 'authoring';
+  const entrance = stamp.entrance !== 'unknown' ? stamp.entrance : identity.taskCard ? 'tasks-hand' : undefined;
+  const firstLine = input.feature.split('\n', 1)[0]?.trim().slice(0, 160) ?? '';
+  const reason = [identity.taskCard ? `TA ${identity.taskCard}` : undefined, firstLine || undefined].filter(Boolean).join(' · ');
+  return {
+    ...(actorKind ? { actorKind } : {}),
+    ...(actor ? { actor } : {}),
+    kind: 'si-task',
+    run: input.runId,
+    phase: authoring ? 'authoring' : 'impl',
+    requestedAt: input.requestedAt,
+    character: identity.taskCard ? 'ta-child' : authoring ? 'author-child' : 'harness-child',
+    ...(entrance ? { entrance } : {}),
+    ...(text(identity.slotId) ? { cell: identity.slotId } : {}),
+    ...(text(input.version) ? { version: input.version } : {}),
+    ...(text(input.commit) ? { commit: input.commit! } : {}),
+    ...(text(input.launchHost) ? { launchHost: input.launchHost } : {}),
+    ...(text(input.shard) ? { shard: input.shard } : {}),
+    ...(text(input.memReq) ? { memReq: input.memReq } : {}),
+    ...(text(input.parentRunId) ? { parent: input.parentRunId } : {}),
+    ...(reason ? { reason } : {}),
+  };
+}
+
+/** `elanous.ai/<key>` annotations → `{ <key>: value }` for the started row (full values, not the 63-char labels). */
+export function provenanceRowFromAnnotations(annotations: Readonly<Record<string, string>>): Record<string, string> {
+  const row: Record<string, string> = {};
+  for (const [key, value] of Object.entries(annotations)) if (key.startsWith('elanous.ai/')) row[key.slice('elanous.ai/'.length)] = value;
+  return row;
+}
+
+export interface PodLaunchRecord {
+  job: string;
+  run: string;
+  attempt: number | null;
+  startedAt: string | null;
+  provenance: Record<string, string>;
+  finished: { at: string | null; phase: string; exitCode: number | null; reason: string } | null;
+}
+
+const str = (value: unknown): string | undefined => (typeof value === 'string' && value ? value : undefined);
+
+/** Rebuild launch records from one run ledger. Rows pair on job·run; an unpaired row stays visible (never dropped). */
+export function readPodLaunchHistory(runId: string, dir: string = runLedgerDir()): PodLaunchRecord[] {
+  const entries: RunLedgerEntry[] = loadRunLedger(runId, dir) ?? [];
+  const records: PodLaunchRecord[] = [];
+  const open = new Map<string, PodLaunchRecord>();
+  for (const entry of entries) {
+    if (entry.event !== POD_LAUNCH_STARTED_EVENT && entry.event !== POD_LAUNCH_FINISHED_EVENT) continue;
+    const job = str(entry.data.job) ?? 'unknown';
+    const run = str(entry.data.run) ?? 'unknown';
+    const key = `${job}\u0000${run}`;
+    if (entry.event === POD_LAUNCH_STARTED_EVENT) {
+      const provenance: Record<string, string> = {};
+      const raw = entry.data.provenance;
+      if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+        for (const [name, value] of Object.entries(raw as Record<string, unknown>)) if (typeof value === 'string') provenance[name] = value;
+      }
+      const record: PodLaunchRecord = { job, run, attempt: typeof entry.data.attempt === 'number' ? entry.data.attempt : null,
+        startedAt: entry.timestamp ?? null, provenance, finished: null };
+      records.push(record);
+      open.set(key, record);
+      continue;
+    }
+    const finished = { at: entry.timestamp ?? null, phase: str(entry.data.phase) ?? 'unknown',
+      exitCode: typeof entry.data.exitCode === 'number' ? entry.data.exitCode : null, reason: str(entry.data.reason) ?? 'unknown' };
+    const started = open.get(key);
+    if (started && !started.finished) { started.finished = finished; open.delete(key); continue; }
+    records.push({ job, run, attempt: typeof entry.data.attempt === 'number' ? entry.data.attempt : null, startedAt: null, provenance: {}, finished });
+  }
+  return records;
+}

package/src/task-orchestrator/surfaces/pod-manifest-test-normalize.ts

@@ -12,6 +12,17 @@ export function stablePodManifestText(applied: Array<Record<string, any>>): stri
   let snapshots = 0;
   for (const manifest of manifests) {
     if (manifest.kind !== 'Job') continue;
+    // POD-LAUNCH-PROVENANCE — the request time and the 8-char run/parent labels are per launch like the run id.
+    for (const meta of [manifest.metadata, manifest.spec?.template?.metadata]) {
+      for (const bag of [meta?.labels, meta?.annotations]) {
+        if (!bag) continue;
+        if (bag['elanous.ai/requested-at'] !== undefined) bag['elanous.ai/requested-at'] = '<requested-at>';
+        if (meta?.labels === bag) for (const key of ['elanous.ai/run', 'elanous.ai/parent']) if (bag[key] !== undefined) bag[key] = '<run-label>';
+      }
+    }
+    for (const container of manifest.spec?.template?.spec?.containers ?? []) {
+      for (const entry of container.env ?? []) if (entry.name === 'ELANOUS_POD_REQUESTED_AT') entry.value = '<requested-at>';
+    }
     for (const container of manifest.spec?.template?.spec?.containers ?? []) {
       for (const entry of container.env ?? []) {
         if (entry.name !== BUDGET_SNAPSHOT_ENV) continue;

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -89,14 +89,29 @@ function defaultLocalImageInspect(image: string): { status: number | null; stdou
   return { status: r.status, stdout: r.stdout ?? '' };
 }
 
+/** 레지스트리 안 이미지 이름 — `docker/harness/build.sh` 의 full/lite 규칙 그대로. */
+function podRegistryImageName(image: string): string {
+  return image === 'elanous-harness-lite:local' ? 'elanous-harness-lite' : 'elanous-harness';
+}
+
+/** 레지스트리 태그 = 커밋 앞 12자리 (build.sh:295 와 같은 규칙). */
+function podRegistryTag(commit: string): string {
+  return commit.slice(0, 12);
+}
+
+/** 노드 로컬 레지스트리의 HTTP 포트 — 호스트에서는 같은 포트의 localhost 로 조회한다. */
+function memberRegistryPort(member: PodPoolMember): string {
+  const registry = memberRegistry(member);
+  return registry.slice(registry.lastIndexOf(':') + 1);
+}
+
 /** 이 커밋의 이미지가 노드 레지스트리에 있나 — 있으면 클러스터 안 이미지 주소. */
 export function registryImageRef(member: PodPoolMember, commit: string | null, run: RemoteRun = defaultRemoteRun, image = 'elanous-harness:local'): string | null {
   if (!member.sshHost || !commit) return null;
-  const imageName = image === 'elanous-harness-lite:local' ? 'elanous-harness-lite' : 'elanous-harness';
-  const tag = commit.slice(0, 12);
+  const imageName = podRegistryImageName(image);
+  const tag = podRegistryTag(commit);
   const registry = memberRegistry(member);
-  const port = registry.slice(registry.lastIndexOf(':') + 1);
-  const r = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${port}/v2/${imageName}/tags/list 2>/dev/null`);
+  const r = run(member.sshHost, `curl -fsS --max-time 5 http://localhost:${memberRegistryPort(member)}/v2/${imageName}/tags/list 2>/dev/null`);
   if (r.status !== 0) return null;
   try {
     const tags = (JSON.parse(r.stdout) as { tags?: string[] }).tags ?? [];
@@ -104,6 +119,54 @@ export function registryImageRef(member: PodPoolMember, commit: string | null, r
   } catch { return null; }
 }
 
+/** 레지스트리 HTTP 한 번 — 노드에서 `curl -fsS --max-time 5`(registryImageRef 와 같은 규칙). 실패면 null. */
+function registryHttpGet(member: PodPoolMember, path: string, run: RemoteRun, accept?: string): string | null {
+  if (!member.sshHost) return null;
+  const header = accept ? `-H 'Accept: ${accept}' ` : '';
+  const r = run(member.sshHost, `curl -fsS --max-time 5 ${header}http://localhost:${memberRegistryPort(member)}/v2/${path} 2>/dev/null`);
+  return r.status === 0 && r.stdout.trim() ? r.stdout : null;
+}
+
+function registryLabelValue(raw: unknown): string | null {
+  return typeof raw === 'string' && raw.trim() && raw !== '<no value>' ? raw.trim() : null;
+}
+
+/**
+ * GATE-REGISTRY-IMAGE-FASTPATH (0.2.36): 레지스트리 HTTP 만으로 이 커밋 태그 이미지의 config label 을 읽는다 —
+ * 노드 Docker 데몬(`docker image inspect`)을 부르지 않는다. 태그 결손 · HTTP 오류 · manifest list(단일 config 없음) ·
+ * 비JSON 은 null 이다(판정하지 않고 종전 경로로 떨어진다).
+ *   GET /v2/<이미지>/manifests/<커밋12> → config.digest → GET /v2/<이미지>/blobs/<digest> → config.Labels
+ */
+export function registryImageLabels(member: PodPoolMember, image: string, commit: string | null, run: RemoteRun = defaultRemoteRun): { commit: string | null; skills: string | null } | null {
+  if (!member.sshHost || !commit) return null;
+  const imageName = podRegistryImageName(image);
+  const manifest = registryHttpGet(member, `${imageName}/manifests/${podRegistryTag(commit)}`, run, 'application/vnd.docker.distribution.manifest.v2+json');
+  if (!manifest) return null;
+  let digest: string | undefined;
+  try { digest = (JSON.parse(manifest) as { config?: { digest?: string } }).config?.digest; } catch { return null; }
+  if (!digest) return null;
+  // config digest 는 `sha256:<64 hex>` — 이 형태가 아니면 경로에 넣지 않는다.
+  if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) return null;
+  const blob = registryHttpGet(member, `${imageName}/blobs/${digest}`, run);
+  if (!blob) return null;
+  let labels: Record<string, unknown> | undefined;
+  try { labels = (JSON.parse(blob) as { config?: { Labels?: Record<string, unknown> } }).config?.Labels; } catch { return null; }
+  if (!labels || typeof labels !== 'object') return null;
+  return { commit: registryLabelValue(labels['elanous.commit']), skills: registryLabelValue(labels['elanous.pod-skills']) };
+}
+
+/**
+ * 이 커밋 태그의 이미지 label 이 이번 발사 값과 모두 맞나 — 맞으면 Docker 조회 없이 그 판을 쓸 수 있다.
+ * 커밋 label 은 발사 커밋과 «정확히» 같아야 한다(태그가 다른 판을 가리키는 경우를 거른다).
+ * `localSkillsDigest` 가 없으면(모르는 값) 커밋 label 만 본다 — syncPoolImages 의 종전 skillsSame 과 같은 뜻.
+ */
+export function registryImageLabelsMatch(member: PodPoolMember, image: string, commit: string | null, opts: { localSkillsDigest?: string | null; run?: RemoteRun } = {}): boolean {
+  if (!commit) return false;
+  const labels = registryImageLabels(member, image, commit, opts.run ?? defaultRemoteRun);
+  if (!labels || labels.commit !== commit) return false;
+  return opts.localSkillsDigest == null || labels.skills === opts.localSkillsDigest;
+}
+
 /** IMAGE-ONE-SOURCE: 이 멤버의 노드에 레지스트리 컨테이너가 있나(syncPoolImages 의 판정과 같은 명령). 로컬 멤버는 false. */
 export function memberHasRegistry(member: PodPoolMember, run: RemoteRun = defaultRemoteRun): boolean {
   if (!member.sshHost) return false;
@@ -873,6 +936,15 @@ export async function syncPoolImages(members: readonly PodPoolMember[], image: s
   await Promise.all(members.map(async (m) => {
     const t0 = Date.now();
     if (!m.sshHost) { results.set(m.context, { ok: true, action: 'local', detail: 'this machine', ms: 0 }); return; }
+    // ⭐ GATE-REGISTRY-IMAGE-FASTPATH (0.2.36 · OP): 레지스트리 커밋 태그의 config label(commit ⊕ pod-skills)이 이번 발사
+    //   값과 같으면 노드 Docker 데몬을 «한 번도» 부르지 않고 그 커밋 ref 로 끝난다 — 데몬 조회가 느려도 gate 첫 Pod 이 뜬다.
+    //   태그 결손 · label 불일치 · HTTP 오류면 아래 종전 경로(원격 inspect → 노드 빌드 → 통째 전송)가 그대로 판정한다.
+    if (localCommit && registryImageLabelsMatch(m, image, localCommit, { ...(deps.localSkillsDigest !== undefined ? { localSkillsDigest: deps.localSkillsDigest } : {}), run })) {
+      const imageRef = `${memberRegistry(m)}/${podRegistryImageName(image)}:${podRegistryTag(localCommit)}`;
+      debug.log('pod.pool', 'image-fresh-registry-label', { context: m.context, host: m.sshHost, commit: localCommit, imageRef, skills: deps.localSkillsDigest ?? null, waitedMs: 0 });
+      results.set(m.context, { ok: true, action: 'fresh', detail: localCommit.slice(0, 12), ms: Date.now() - t0, imageRef });
+      return;
+    }
     const before = remoteImageCommit(m, image, run);
     const skillsNow = deps.localSkillsDigest;
     const refBefore = registryImageRef(m, localCommit, run, image);

package/src/task-orchestrator/surfaces/pod-provenance.ts

@@ -17,6 +17,8 @@ export interface PodProvenance {
   commit?: string;
   shard?: string;
   reason?: string;
+  /** Parent runId / lease id — whose child this Pod is. Label keeps the first 8 characters like run/commit. */
+  parent?: string;
   pool?: string;
   cpuReq?: string;
   memReq?: string;
@@ -28,11 +30,15 @@ const required = ['actorKind', 'actor', 'kind', 'run', 'phase', 'requestedAt'] a
 const names: Record<keyof PodProvenance, string> = {
   actorKind: 'actor-kind', actor: 'actor', kind: 'kind', run: 'run', phase: 'phase', requestedAt: 'requested-at',
   character: 'character', launchHost: 'launch-host', entrance: 'entrance', graphNode: 'graph-node', cell: 'cell',
-  version: 'version', commit: 'commit', shard: 'shard', reason: 'reason',
+  version: 'version', commit: 'commit', shard: 'shard', reason: 'reason', parent: 'parent',
   pool: 'pool', cpuReq: 'cpu-req', memReq: 'mem-req',
   warmReused: 'warm-reused', argv: 'argv',
 };
 
+/** Every child env name the set can carry (`ELANOUS_POD_<KEY>`). */
+export const POD_PROVENANCE_ENV_NAMES: readonly string[] = Object.values(names)
+  .map((name) => `ELANOUS_POD_${name.toUpperCase().replaceAll('-', '_')}`);
+
 const labelValue = (value: string): string => {
   const cleaned = value.toLowerCase().replace(/[^a-z0-9._-]/g, '-').replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, '');
   return cleaned.slice(0, 63).replace(/[^a-z0-9]+$/g, '') || 'unknown';
@@ -67,7 +73,7 @@ export function podProvenanceMetadata(input: Partial<PodProvenance> | undefined,
   const annotations: Record<string, string> = {};
   const env: Array<{ name: string; value: string }> = [];
   for (const [name, value] of Object.entries(values)) {
-    const label = name === 'run' || name === 'commit' ? value.slice(0, 8) : value;
+    const label = name === 'run' || name === 'commit' || name === 'parent' ? value.slice(0, 8) : value;
     if (name !== 'reason' && name !== 'argv') labels[`elanous.ai/${name}`] = labelValue(label);
     annotations[`elanous.ai/${name}`] = value;
     env.push({ name: `ELANOUS_POD_${name.toUpperCase().replaceAll('-', '_')}`, value });

package/src/task-orchestrator/surfaces/pod-repair-commit.ts

@@ -3,6 +3,7 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
+import { classifyGateEnvDeficit, GATE_ENV_DEFICIT_HARVESTABLE_MARK } from '../../self-implement/gate-env-retry.js';
 
 export const REPAIR_REF = 'refs/elanous/repair/result';
 export const REPAIR_BUNDLE_MAX_BYTES = 5 * 1024 * 1024;
@@ -39,15 +40,29 @@ function completedWorktree(output: string): { path: string; runId: string } {
     let value: Record<string, unknown>;
     try { value = JSON.parse(line) as Record<string, unknown>; } catch { continue; }
     if (value.kind === 'self' && value.result && typeof value.result === 'object') value = value.result as Record<string, unknown>;
-    if (value.stage !== 'worktree-completed' || value.ok !== true || typeof value.worktreePath !== 'string'
+    const completed = value.stage === 'worktree-completed' && value.ok === true;
+    // The gate could not measure an environmental failure. Keep the implementation as a
+    // bundle for the pinned PR; the parent still has to review and rejudge that head.
+    const gate = value.gate && typeof value.gate === 'object' && !Array.isArray(value.gate)
+      ? value.gate as { passed?: unknown; log?: unknown; reflectGateFacts?: { introduced?: number; unknownReason?: string; childResponsibility?: string } }
+      : null;
+    const environmentHarvest = value.stage === 'gate-failed' && value.ok === false
+      && value.harvestable === true && typeof value.detail === 'string'
+      && value.detail.includes(GATE_ENV_DEFICIT_HARVESTABLE_MARK)
+      && gate?.passed === false
+      && gate.reflectGateFacts?.introduced === 0
+      && gate.reflectGateFacts?.childResponsibility === 'none'
+      && classifyGateEnvDeficit({ passed: false, ...(typeof gate.log === 'string' ? { log: gate.log } : {}),
+        ...(gate.reflectGateFacts ? { reflectGateFacts: gate.reflectGateFacts } : {}) }).envDeficit;
+    if ((!completed && !environmentHarvest) || typeof value.worktreePath !== 'string'
       || typeof value.runId !== 'string' || !value.runId)
-      throw new Error('repair child final result is not a successful worktree-only result');
+      throw new Error('repair child final result is neither successful worktree-only nor environment-deficit harvestable');
     return { path: value.worktreePath, runId: value.runId };
   }
   throw new Error('repair child did not return a successful worktree-only result');
 }
 
-/** Called in the Pod after the child exits successfully and before artifact export. */
+/** Called in the Pod after a successful child or a verified environment-deficit harvest. */
 export function writePodRepairCommit(input: { pr: number; baseHead: string; runId: string; output: string; repo: string; outbox: string }): PodRepairResult {
   if (!Number.isSafeInteger(input.pr) || input.pr < 1 || !SHA40.test(input.baseHead)) throw new Error('invalid repair PR or base head');
   if (!input.runId.trim()) throw new Error('repair parent run id missing');

package/src/task-orchestrator/surfaces/pod-si-warm-entry.ts

@@ -0,0 +1,16 @@
+/** Opt-in SI warm entry; the ordinary Pod spawn remains the default. */
+import { podSelfImplementSpawn, type PodSpawnOptions } from './self-implement-pod.js';
+
+export async function podSpawnWithSiWarm(base: PodSpawnOptions,
+  env: NodeJS.ProcessEnv = process.env) {
+  if (env.ELANOUS_SI_WARM_REUSE !== '1') return podSelfImplementSpawn(base);
+  const { acquireSiWarmChild, postprocessSiWarmChild } = await import('./pod-si-warm-host.js');
+  return podSelfImplementSpawn({ ...base,
+    siWarmAttempt: async input => {
+      const result = await acquireSiWarmChild(input, base);
+      return result.status === 'acquired' ? result.attempt : null;
+    },
+    siWarmHostPostprocess: (result, attempt, input) =>
+      postprocessSiWarmChild(input, result, attempt, base),
+  });
+}