elanous 0.2.36 → 0.2.38

package/src/task-agent/map-reduce.ts

@@ -0,0 +1,158 @@
+/**
+ * MAPREDUCE-FANOUT backend. Inventory and card execution are ports so the CLI can
+ * bind the existing checklist/draft readers and tasks hand Pod launcher separately.
+ * A run snapshots its inventory before any card starts; one terminal row belongs
+ * to each item. This module never changes a checklist or closes a PR.
+ */
+import { randomUUID } from 'node:crypto';
+import { debug } from '../debug/log.js';
+import {
+  appendMapRunRow, createMapRun, readMapRun, reduceMapRun,
+  type MapRecipe, type MapRowKind, type MapRunRow, type MapRunStart,
+} from './map-run-ledger.js';
+
+export type MapSource = 'landed-but-yellow' | 'drafts';
+export interface MapItem { id: string }
+export interface MapInventory<T extends MapItem> {
+  items: readonly T[];
+  complete: boolean;
+  snapshotTime: string;
+  snapshotRef: string;
+  recipeSha: string;
+  mainSha: string;
+  checklistSnapshotPath: string | null;
+  requestedPool: string;
+  selectedPool: string | null;
+  imageCommit: string | null;
+  /** A failed inventory is recorded as a suppressed HOLD row. */
+  reason?: string;
+}
+export interface MapCard {
+  id: string;
+  itemId: string;
+  mapRunId: string;
+  recipe: MapRecipe;
+  text: string;
+}
+export interface MapContext {
+  mapRunId: string;
+  recipe: MapRecipe;
+  source: MapSource;
+  dryRun: boolean;
+}
+export interface MapPorts<T extends MapItem> {
+  inventory: (recipe: MapRecipe, source: MapSource, limit: number | undefined) => Promise<MapInventory<T>>;
+  /** Pure card authoring. Do not persist or launch here. */
+  buildCard: (item: T, context: MapContext) => MapCard;
+  /** Production adapter must launch through tasks hand and wait for its terminal recipe result. */
+  launchCard: (card: MapCard, item: T, context: MapContext) => Promise<MapRunRow>;
+  /** Optional pure preview; default dry-run yields a HOLD without invoking launchCard. */
+  previewCard?: (card: MapCard, item: T, context: MapContext) => MapRunRow | Promise<MapRunRow>;
+  log?: (event: string, data: Record<string, unknown>) => void;
+}
+export interface MapRequest {
+  recipe: MapRecipe;
+  source: MapSource;
+  limit?: number;
+  concurrency?: number;
+  dryRun?: boolean;
+  root?: string;
+  mapRunId?: string;
+}
+export interface MapResult { mapRunId: string; expected: number; observed: number; dryRun: boolean }
+
+const validPairs: Readonly<Record<MapRecipe, MapSource>> = {
+  'green-close': 'landed-but-yellow', 'draft-close': 'drafts',
+};
+const idPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/;
+
+function checkPositive(value: number | undefined, label: string): void {
+  if (value !== undefined && (!Number.isSafeInteger(value) || value < 1)) throw new Error(`map ${label} must be a positive integer`);
+}
+function hold(context: MapContext, itemId: string | null, reason: string, suppressed = false): MapRunRow {
+  return { event: 'row', mapRunId: context.mapRunId, itemId, recipe: context.recipe,
+    kind: 'hold', verdict: 'hold', reason, evidence: [], ...(suppressed ? { rowsSuppressed: true, pr: null } : {}) };
+}
+function record(log: MapPorts<MapItem>['log'], event: string, data: Record<string, unknown>): void {
+  try { (log ?? ((name, fields) => debug.log('task-agent.map-reduce', name, fields)))(event, data); }
+  catch { /* diagnostics must not turn a completed item into a failed one */ }
+}
+
+/** Bounded workers, with no unbounded Promise.all fanout. Default is a read-only preview. */
+export async function mapInventory<T extends MapItem>(request: MapRequest, ports: MapPorts<T>): Promise<MapResult> {
+  if (validPairs[request.recipe] !== request.source) throw new Error('map recipe/source mismatch');
+  checkPositive(request.limit, 'limit');
+  checkPositive(request.concurrency, 'concurrency');
+  const concurrency = request.concurrency ?? 2;
+  const dryRun = request.dryRun !== false;
+  const mapRunId = request.mapRunId ?? `map-${randomUUID()}`;
+  if (!idPattern.test(mapRunId)) throw new Error('map invalid run id');
+  const context: MapContext = { mapRunId, recipe: request.recipe, source: request.source, dryRun };
+  const inventory = await ports.inventory(request.recipe, request.source, request.limit);
+  // A limit is a selection boundary, not permission to silently truncate a partial inventory.
+  const items = inventory.complete ? inventory.items.slice(0, request.limit) : [];
+  const start: MapRunStart = { event: 'start', mapRunId, recipe: request.recipe,
+    recipeSha: inventory.recipeSha, snapshotTime: inventory.snapshotTime, snapshotRef: inventory.snapshotRef,
+    mainSha: inventory.mainSha, checklistSnapshotPath: inventory.checklistSnapshotPath,
+    inventoryComplete: inventory.complete, itemIds: items.map((item) => item.id),
+    requestedPool: inventory.requestedPool, selectedPool: inventory.selectedPool,
+    imageCommit: inventory.imageCommit, dryRun };
+  createMapRun(start, request.root);
+  record(ports.log, 'start', { mapRunId, recipe: request.recipe, source: request.source, count: items.length, concurrency, dryRun });
+  if (!inventory.complete) {
+    appendMapRunRow(hold(context, null, inventory.reason || 'inventory-incomplete', true), request.root);
+    record(ports.log, 'inventory-hold', { mapRunId, reason: inventory.reason ?? 'inventory-incomplete' });
+    return { mapRunId, expected: 0, observed: 1, dryRun };
+  }
+  let next = 0;
+  let observed = 0;
+  async function worker(): Promise<void> {
+    while (next < items.length) {
+      const item = items[next++]!;
+      let row: MapRunRow;
+      try {
+        const card = ports.buildCard(item, context);
+        if (!card || !idPattern.test(card.id) || card.itemId !== item.id || card.mapRunId !== mapRunId
+          || card.recipe !== request.recipe || !card.text.trim()) throw new Error('card identity mismatch');
+        row = dryRun
+          ? ports.previewCard ? await ports.previewCard(card, item, context) : hold(context, item.id, 'dry-run-preview')
+          : await ports.launchCard(card, item, context);
+        if (row.mapRunId !== mapRunId || row.itemId !== item.id || row.recipe !== request.recipe)
+          throw new Error('result identity mismatch');
+        row = { ...row, result: { ...row.result, cardId: card.id } };
+      } catch (error) {
+        row = hold(context, item.id, `map-item-failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      // The ledger validates recipe-specific evidence and rejects duplicate/unknown rows.
+      // An invalid result is a hard error; never launder it into a successful map run.
+      appendMapRunRow(row, request.root);
+      observed++;
+      record(ports.log, 'item', { mapRunId, itemId: item.id, kind: row.kind, reason: row.reason });
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
+  record(ports.log, 'finished', { mapRunId, expected: items.length, observed });
+  return { mapRunId, expected: items.length, observed, dryRun };
+}
+
+export interface MapReduceTable { mapRunId: string; markdown: string; writes: 0 }
+const countKinds: readonly MapRowKind[] = ['green-candidate', 'mock-pr', 'implementation-remains', 'harvest', 'close-candidate', 'hold'];
+function cell(value: unknown): string { return String(value ?? '').replaceAll('|', '\\|').replaceAll(/\r?\n/g, ' '); }
+
+/** Read-only aggregation. Applying green/close candidates belongs to a separate guarded reducer. */
+export function renderMapReduceTable(mapRunId: string, root?: string): MapReduceTable {
+  const { start, rows } = readMapRun(mapRunId, root);
+  const summary = reduceMapRun(mapRunId, root);
+  const lines = [
+    `# Map run ${cell(mapRunId)}`,
+    '',
+    `Recipe: ${start.recipe} · snapshot: ${cell(start.snapshotRef)} · dry-run: ${start.dryRun} · verdict: ${summary.verdict} (${summary.reason})`,
+    `Expected: ${summary.expected} · observed: ${summary.observed} · writes: 0`,
+    `Counts: ${countKinds.map((kind) => `${kind} ${summary.counts[kind]}`).join(' · ')}`,
+    '',
+    '| Item | Card | Result | PR | Reason |',
+    '| --- | --- | --- | --- | --- |',
+    ...rows.map((row) => `| ${cell(row.itemId ?? 'inventory')} | ${cell(row.result?.cardId)} | ${row.kind} | ${cell(row.pr)} | ${cell(row.reason)} |`),
+  ];
+  return { mapRunId, markdown: `${lines.join('\n')}\n`, writes: 0 };
+}

package/src/task-agent/map-run-ledger.ts

@@ -0,0 +1,226 @@
+/**
+ * MAPREDUCE-FANOUT: one immutable inventory snapshot, followed by one result per item.
+ * The reducer is read-only. A partial inventory or missing/duplicate result is a hold,
+ * never evidence for a checklist change or a draft close.
+ */
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, writeSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { withFileLockSync } from '../storage/file-lock.js';
+
+export type MapRecipe = 'green-close' | 'draft-close';
+export type MapRowKind = 'green-candidate' | 'mock-pr' | 'implementation-remains'
+  | 'harvest' | 'close-candidate' | 'hold';
+export type MapEvidenceVerdict = 'pass' | 'fail' | 'hold' | 'unmeasured';
+
+export interface MapRunStart {
+  event: 'start';
+  mapRunId: string;
+  recipe: MapRecipe;
+  recipeSha: string;
+  snapshotTime: string;
+  snapshotRef: string;
+  /** Exact origin/main captured with the inventory, independent of the image or recipe commit. */
+  mainSha: string;
+  /** The checklist snapshot artifact used by green-close; draft-close records null. */
+  checklistSnapshotPath: string | null;
+  inventoryComplete: boolean;
+  /** Stable identities from the complete inventory; item display titles are never keys. */
+  itemIds: string[];
+  requestedPool: string;
+  selectedPool: string | null;
+  imageCommit: string | null;
+  dryRun: boolean;
+}
+
+export interface MapRunRow {
+  event: 'row';
+  mapRunId: string;
+  itemId: string | null;
+  recipe: MapRecipe;
+  kind: MapRowKind;
+  verdict: MapRowKind;
+  reason: string;
+  evidence: string[];
+  e1?: { verdict: MapEvidenceVerdict; mergeSha?: string; mainAncestor?: boolean };
+  e2?: { verdict: MapEvidenceVerdict; command?: string; exitCode?: number };
+  e2Source?: 'completion-boundary' | 'prior-evidence' | 'missing';
+  e3?: { verdict: MapEvidenceVerdict; reason: string };
+  /** Only an inventory-wide failure uses this form; it suppresses all item rows and requires pr:null. */
+  rowsSuppressed?: boolean;
+  pr?: number | null;
+  prUrl?: string | null;
+  headOid?: string | null;
+  podJob?: string | null;
+  podUid?: string | null;
+  startedAt?: string | null;
+  endedAt?: string | null;
+  rc?: number | null;
+  result?: Record<string, unknown>;
+}
+
+export interface MapRunRead {
+  start: MapRunStart;
+  rows: MapRunRow[];
+}
+
+export interface MapRunReduce {
+  mapRunId: string;
+  verdict: 'complete' | 'hold';
+  reason: string;
+  expected: number;
+  observed: number;
+  counts: Record<MapRowKind, number>;
+  /** A dry-run has no write authority, even when every item is a candidate. */
+  writes: 0;
+}
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/;
+const SHA = /^[0-9a-f]{40}$/;
+const KINDS = new Set<MapRowKind>(['green-candidate', 'mock-pr', 'implementation-remains', 'harvest', 'close-candidate', 'hold']);
+const RECIPE_KINDS: Record<MapRecipe, ReadonlySet<MapRowKind>> = {
+  'green-close': new Set(['green-candidate', 'mock-pr', 'implementation-remains', 'hold']),
+  'draft-close': new Set(['harvest', 'close-candidate', 'hold']),
+};
+
+function checkId(value: string, label: string): void {
+  if (!ID.test(value)) throw new Error(`map-run invalid ${label}: ${value}`);
+}
+
+export function mapRunLedgerPath(mapRunId: string, root = effectiveInstanceRoot()): string {
+  checkId(mapRunId, 'id');
+  return join(root, 'map-runs', `${mapRunId}.jsonl`);
+}
+
+function validateStart(start: MapRunStart): void {
+  checkId(start.mapRunId, 'id');
+  if (start.recipe !== 'green-close' && start.recipe !== 'draft-close') throw new Error('map-run unknown recipe');
+  if (!SHA.test(start.recipeSha)) throw new Error('map-run recipe SHA missing');
+  if (!start.snapshotTime || !start.snapshotRef) throw new Error('map-run snapshot identity missing');
+  if (!SHA.test(start.mainSha) || !('checklistSnapshotPath' in start)
+    || (start.recipe === 'green-close' && (!start.checklistSnapshotPath || !isAbsolute(start.checklistSnapshotPath)))
+    || (start.recipe === 'draft-close' && start.checklistSnapshotPath !== null)) {
+    throw new Error('map-run main or checklist snapshot provenance missing');
+  }
+  if (!Array.isArray(start.itemIds) || start.itemIds.some((id) => typeof id !== 'string' || !ID.test(id))
+    || new Set(start.itemIds).size !== start.itemIds.length) throw new Error('map-run item identities missing or duplicate');
+  if (typeof start.inventoryComplete !== 'boolean' || typeof start.dryRun !== 'boolean') throw new Error('map-run completeness or dry-run missing');
+  if (!start.inventoryComplete && start.itemIds.length) throw new Error('map-run partial inventory cannot name items');
+  if (!start.requestedPool || !('selectedPool' in start) || !('imageCommit' in start)) throw new Error('map-run pool or image provenance missing');
+}
+
+function validateRow(row: MapRunRow, start: MapRunStart): void {
+  if (row.mapRunId !== start.mapRunId || row.recipe !== start.recipe || !KINDS.has(row.kind) || row.verdict !== row.kind
+    || !Array.isArray(row.evidence)
+    || row.evidence.some((value) => typeof value !== 'string') || typeof row.reason !== 'string') {
+    throw new Error('map-run row contract mismatch');
+  }
+  if (!RECIPE_KINDS[start.recipe].has(row.kind)) throw new Error('map-run kind outside recipe');
+  if (row.rowsSuppressed) {
+    if (start.inventoryComplete || row.itemId !== null || row.pr !== null || row.kind !== 'hold') {
+      throw new Error('map-run suppressed row must hold an incomplete inventory without a PR');
+    }
+  } else if (!start.inventoryComplete) {
+    throw new Error('map-run incomplete inventory suppresses item rows');
+  } else if (!row.itemId || !start.itemIds.includes(row.itemId)) {
+    throw new Error(`map-run unknown item: ${row.itemId}`);
+  }
+  if (row.kind === 'hold' && !row.reason.trim()) throw new Error('map-run hold needs a reason');
+  if (row.kind !== 'hold' && row.evidence.length === 0) throw new Error('map-run candidate needs evidence');
+  if (row.kind === 'green-candidate'
+    && (row.e1?.verdict !== 'pass' || row.e2?.verdict !== 'pass' || row.e3?.verdict !== 'pass'
+      || !SHA.test(row.e1.mergeSha ?? '') || row.e1.mainAncestor !== true
+      || !row.e3.reason.trim()
+      || typeof row.pr !== 'number' || !Number.isSafeInteger(row.pr) || row.pr <= 0
+      || !row.prUrl || !row.e2Source || row.e2Source === 'missing'
+      || !row.e2.command?.trim() || row.e2.exitCode !== 0)) {
+    throw new Error('map-run green candidate needs E1/E2/E3 and PR proof');
+  }
+  if ((row.kind === 'harvest' || row.kind === 'close-candidate')
+    && (typeof row.pr !== 'number' || !Number.isSafeInteger(row.pr) || row.pr <= 0 || !SHA.test(row.headOid ?? ''))) {
+    throw new Error('map-run draft decision needs exact PR head');
+  }
+  if (row.rc != null && row.rc !== 0 && row.kind !== 'hold') throw new Error('map-run failed Pod cannot yield a candidate');
+  for (const field of ['podJob', 'podUid', 'startedAt', 'endedAt'] as const) {
+    const value = row[field];
+    if (value != null && (typeof value !== 'string' || !value.trim())) throw new Error(`map-run invalid ${field}`);
+  }
+  if (row.result != null && (typeof row.result !== 'object' || Array.isArray(row.result))) {
+    throw new Error('map-run invalid result');
+  }
+}
+
+/** Exclusive create prevents a retry from silently replacing the original inventory. */
+export function createMapRun(start: MapRunStart, root?: string): string {
+  validateStart(start);
+  const path = mapRunLedgerPath(start.mapRunId, root);
+  mkdirSync(dirname(path), { recursive: true });
+  const fd = openSync(path, 'wx', 0o600);
+  try { writeSync(fd, `${JSON.stringify(start)}\n`); }
+  finally { closeSync(fd); }
+  return path;
+}
+
+export function readMapRun(mapRunId: string, root?: string): MapRunRead {
+  const path = mapRunLedgerPath(mapRunId, root);
+  if (!existsSync(path)) throw new Error(`map-run missing: ${mapRunId}`);
+  const raw = readFileSync(path, 'utf8');
+  if (!raw.endsWith('\n')) throw new Error('map-run truncated JSONL tail');
+  const lines = raw.trimEnd().split('\n');
+  let start: MapRunStart;
+  try { start = JSON.parse(lines[0]!) as MapRunStart; }
+  catch { throw new Error('map-run invalid start JSON'); }
+  if (start.event !== 'start' || start.mapRunId !== mapRunId) throw new Error('map-run invalid start');
+  validateStart(start);
+  const rows: MapRunRow[] = [];
+  const seen = new Set<string>();
+  for (const line of lines.slice(1)) {
+    let row: MapRunRow;
+    try { row = JSON.parse(line) as MapRunRow; }
+    catch { throw new Error('map-run invalid row JSON'); }
+    if (row.event !== 'row') throw new Error('map-run unexpected event');
+    validateRow(row, start);
+    const key = row.rowsSuppressed ? '__inventory_hold__' : row.itemId!;
+    if (seen.has(key)) throw new Error(`map-run duplicate row: ${key}`);
+    seen.add(key);
+    rows.push(row);
+  }
+  if (rows.some((row) => row.rowsSuppressed) && rows.length !== 1) throw new Error('map-run suppressed inventory has item rows');
+  return { start, rows };
+}
+
+/** The lock protects the read-before-append duplicate check across concurrent Pod completions. */
+export function appendMapRunRow(row: MapRunRow, root?: string): void {
+  const path = mapRunLedgerPath(row.mapRunId, root);
+  withFileLockSync(`${path}.lock`, () => {
+    const current = readMapRun(row.mapRunId, root);
+    validateRow(row, current.start);
+    const key = row.rowsSuppressed ? '__inventory_hold__' : row.itemId!;
+    if (current.rows.some((existing) => (existing.rowsSuppressed ? '__inventory_hold__' : existing.itemId) === key)) {
+      throw new Error(`map-run duplicate row: ${key}`);
+    }
+    if (row.rowsSuppressed && current.rows.length) throw new Error('map-run inventory hold cannot follow item rows');
+    if (current.rows.some((existing) => existing.rowsSuppressed)) throw new Error('map-run inventory hold suppresses item rows');
+    appendFileSync(path, `${JSON.stringify(row)}\n`);
+  });
+}
+
+/** No consumer of this result can write: incomplete evidence remains an explicit hold. */
+export function reduceMapRun(mapRunId: string, root?: string): MapRunReduce {
+  const { start, rows } = readMapRun(mapRunId, root);
+  const counts: Record<MapRowKind, number> = {
+    'green-candidate': 0, 'mock-pr': 0, 'implementation-remains': 0,
+    harvest: 0, 'close-candidate': 0, hold: 0,
+  };
+  for (const row of rows) counts[row.kind]++;
+  const accounted = start.inventoryComplete && rows.length === start.itemIds.length
+    && rows.every((row) => !row.rowsSuppressed);
+  const complete = accounted && start.itemIds.length > 0 && counts.hold === 0;
+  return {
+    mapRunId, verdict: complete ? 'complete' : 'hold',
+    reason: !start.inventoryComplete ? 'inventory-incomplete' : start.itemIds.length === 0 ? 'empty-inventory'
+      : !accounted ? 'results-missing'
+      : counts.hold ? 'item-hold' : 'all-items-accounted',
+    expected: start.itemIds.length, observed: rows.length, counts, writes: 0,
+  };
+}

package/src/task-agent/parent-host.ts

@@ -44,6 +44,8 @@ export const PARENT_HOST_ENV = 'ELANOUS_TA_PARENT_HOST';
 const DEFAULT_REMOTE_ELANOUS = '$HOME/.local/share/elanous/bin/elanous';
 const DEFAULT_REMOTE_CONFIG_DIR = '$HOME/.elanous';
 const HOST_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,127}$/;
+/** A parent can wait for a child for tens of minutes; the two-minute HTTP refresh floor is too short here. */
+export const PARENT_CHILD_CREDENTIAL_MIN_REMAINING_MS = 60 * 60_000;
 
 /** Missing child-provider metadata keeps the established Pod default: the HQ Codex mirror is needed. */
 export function shouldInstallRemoteCodexAccess(effectiveChildProvider: string | undefined): boolean {
@@ -81,7 +83,7 @@ export function resolveParentHosts(config: ParentHostSetting | undefined, env: N
 }
 
 /** Capacity sample is read on the host before launch. Unknown or saturated capacity is not a positive weight. */
-export interface ParentHostCapacity { approvalHeadroom: number; load: number }
+export interface ParentHostCapacity { active: number; waiting: number; limit: number; headroom: number; approvalHeadroom: number; load: number }
 
 export interface ParentHostPodFit {
   state: 'fits' | 'never-fits' | 'unmeasured';
@@ -127,26 +129,36 @@ export function readParentHostPodFit(target: ParentHostConfig, memoryLimit: stri
 }
 
 const CAPACITY_MARKER = '__ELANOUS_PARENT_CAPACITY__';
+const CAPACITY_ERROR_MARKER = '__ELANOUS_PARENT_CAPACITY_ERROR__';
 const APPROVAL_MARKER = '__ELANOUS_PARENT_APPROVALS__';
 const LOAD_MARKER = '__ELANOUS_PARENT_LOAD__';
+/** Best-effort macOS `ps` fallback; Linux/WSL uses argv boundaries below. */
+export const PARENT_HOST_ACTIVE_FILTER = String.raw`/^(([^ ]+\/)?(bun|node|nodejs) )?([^ ]+\/)?elanous(\.mjs)?( --config-dir [^ ]+)? harness (say|ask)( |$)/ && / --no-auto-merge( |$)/ && !/ --substrate local( |$)/ && !/^([^ ]+\/)?[^ ]*sh -c/`;
+/** Count exact Linux argv entries so Pod-local commands and goal text cannot masquerade as host parents. */
+export const PARENT_HOST_PROC_COUNT_SCRIPT = "count=0; proc_root=${1:-/proc}; for file in \"$proc_root\"/[0-9]*/cmdline; do [ -r \"$file\" ] || continue; argv=(); while IFS= read -r -d '' arg; do argv+=(\"$arg\"); done < \"$file\" 2>/dev/null || true; [ ${#argv[@]} -ge 3 ] || continue; program=\"${argv[0]##*/}\"; case \"$program\" in elanous|elanous.mjs) ;; bun|node|nodejs) script_match=0; for ((i=1; i<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == */elanous.mjs ]]; then script_match=1; break; fi; [[ \"${argv[i]}\" == harness ]] && break; done; [ \"$script_match\" -eq 1 ] || continue ;; *) continue ;; esac; harness=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == harness && ( \"${argv[i+1]}\" == say || \"${argv[i+1]}\" == ask ) ]]; then harness=1; break; fi; done; [ \"$harness\" -eq 1 ] || continue; has_no_auto_merge=0; for arg in \"${argv[@]}\"; do [[ \"$arg\" == --no-auto-merge ]] && has_no_auto_merge=1; done; [ \"$has_no_auto_merge\" -eq 1 ] || continue; local_substrate=0; for ((i=0; i+1<${#argv[@]}; i++)); do if [[ \"${argv[i]}\" == --substrate && \"${argv[i+1]}\" == local ]]; then local_substrate=1; break; fi; done; [ \"$local_substrate\" -eq 1 ] && continue; cgroup_file=${file%cmdline}cgroup; if [ ! -r $cgroup_file ]; then [ ! -d ${file%/cmdline} ] && continue; printf '__ELANOUS_PARENT_CAPACITY_ERROR__cgroup-unreadable\\n'; exit 1; fi; cgroup=$(cat $cgroup_file 2>/dev/null) || { [ ! -d ${file%/cmdline} ] && continue; printf '__ELANOUS_PARENT_CAPACITY_ERROR__cgroup-unreadable\\n'; exit 1; }; case $cgroup in *docker*|*kubepods*|*containerd*|*libpod*|*lxc*) continue;; esac; count=$((count+1)); done; printf '__ELANOUS_PARENT_CAPACITY__%s\\n' \"$count\""
 /** Recent admission decisions are the host's measured approval backlog, not an inferred process count. */
 export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner = defaultSshRunner): ParentHostCapacity | null {
   const executable = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
   const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
-  const script = `parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '/[e]lanous.*harness (say|ask)/ { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; `
+  const unavailable = (reason: string): null => { try { debug.log('task-agent.parent-host', 'capacity-unavailable', { host: target.host, reason }); } catch { /* fail-soft */ } return null; };
+  const processCount = `if [ -r /proc/self/cmdline ]; then if command -v bash >/dev/null 2>&1; then bash -c ${shellQuote(PARENT_HOST_PROC_COUNT_SCRIPT)} -- /proc || exit 1; else printf "${CAPACITY_ERROR_MARKER}bash-unavailable\\n"; exit 1; fi; else parents=$(ps -Ao command) || exit 1; printf '%s\\n' "$parents" | awk '${PARENT_HOST_ACTIVE_FILTER} { n++ } END { print "${CAPACITY_MARKER}" n+0 }'; fi`;
+  const script = `${processCount}; `
     + `${executable} --config-dir ${configDir} logs --event admit-by-usage --since 5m --json --limit 1000 || exit 1; `
     + `printf '\\n${APPROVAL_MARKER}\\n'; `
     + `cpu=$(ps -Ao %cpu=) || exit 1; printf '%s\\n' "$cpu" | awk '{ total += $1 } END { printf "${LOAD_MARKER}%.3f\\n", total+0 }'; `
     + `cores=$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null) || exit 1; printf '${LOAD_MARKER}cores=%s\\n' "$cores"`;
   try {
     const result = ssh(target.host, script, 15_000);
-    if (result.status !== 0) return null;
+    if (result.status !== 0) return unavailable(result.stdout.includes(`${CAPACITY_ERROR_MARKER}bash-unavailable`) ? 'bash-unavailable'
+      : result.stdout.includes(`${CAPACITY_ERROR_MARKER}cgroup-unreadable`) ? 'cgroup-unreadable' : 'remote-command-failed');
     const activeMatch = new RegExp(`^${CAPACITY_MARKER}(\\d+)$`, 'm').exec(result.stdout);
     const boundary = result.stdout.indexOf(`\n${APPROVAL_MARKER}\n`);
     const logsStart = result.stdout.indexOf('\n');
     const cpuMatch = new RegExp(`^${LOAD_MARKER}([0-9]+(?:\\.[0-9]+)?)$`, 'm').exec(result.stdout);
     const coresMatch = new RegExp(`^${LOAD_MARKER}cores=(\\d+)$`, 'm').exec(result.stdout);
-    if (!activeMatch || activeMatch.index !== 0 || logsStart < 0 || boundary < logsStart || !cpuMatch || !coresMatch) return null;
+    if (!activeMatch || activeMatch.index !== 0) return unavailable('active-count-marker-missing');
+    if (logsStart < 0 || boundary < logsStart) return unavailable('approval-boundary-missing');
+    if (!cpuMatch || !coresMatch) return unavailable('load-marker-missing');
     const active = Number(activeMatch[1]);
     const cores = Number(coresMatch[1]);
     const cpu = Number(cpuMatch[1]);
@@ -172,23 +184,25 @@ export function readParentHostCapacity(target: ParentHostConfig, ssh: SshRunner
       decisions.set(data.runId, data.recommended as number);
     }
     const waiting = [...decisions.values()].filter((n) => n === 0).length;
-    return { approvalHeadroom: Math.max(0, capacity - active - waiting), load: Math.max(0, cpu / (cores * 100)) };
-  } catch { return null; }
+    const headroom = Math.max(0, capacity - active - waiting);
+    return { active, waiting, limit: capacity, headroom, approvalHeadroom: headroom, load: Math.max(0, cpu / (cores * 100)) };
+  } catch { return unavailable('capacity-parse-failed'); }
 }
 
-/** Weighted rendezvous: stable per run, no shared counter or dependence on dispatch order. */
-export function orderParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, ParentHostCapacity | null>>): ParentHostConfig[] {
+/** Weighted rendezvous rank with evidence fields for launch-time observation. */
+export function rankParentHosts(targets: readonly ParentHostConfig[], runId: string, capacities: Readonly<Record<string, Pick<ParentHostCapacity, 'approvalHeadroom' | 'load'> | null>>): Array<{ target: ParentHostConfig; weight: number; score: number }> {
   return targets.map((target, index) => {
     const sample = capacities[target.host];
     const weight = sample && Number.isSafeInteger(sample.approvalHeadroom) && sample.approvalHeadroom > 0 && Number.isFinite(sample.load) && sample.load >= 0
       ? sample.approvalHeadroom / (1 + sample.load) : 0;
     const hash = createHash('sha256').update(`${runId}\0${target.host}`).digest();
     const fraction = (hash.readUIntBE(0, 6) + 1) / (2 ** 48 + 1);
-    return { target, index, score: weight > 0 ? -Math.log(fraction) / weight : Infinity };
-  }).sort((a, b) => a.score - b.score || a.index - b.index).map(({ target }) => target);
+    return { target, index, weight, score: weight > 0 ? -Math.log(fraction) / weight : Infinity };
+  }).sort((a, b) => a.score - b.score || a.index - b.index).map(({ target, weight, score }) => ({ target, weight, score }));
 }
 
-/** `$HOME/…` 은 원격 셸이 풀도록 따옴표 밖에 둔다 — 나머지는 shellQuote. */
+
+/** Keep `$HOME/...` outside quotes so the remote shell expands it; quote every other path. */
 function remotePath(path: string): string {
   return path.startsWith('$HOME/') ? `"$HOME"/${shellQuote(path.slice('$HOME/'.length))}` : shellQuote(path);
 }
@@ -254,14 +268,22 @@ export interface ParentHostPreflight { ok: boolean; gaps: string[]; warnings: st
 export function preflightScript(target: ParentHostConfig): string {
   const elanous = remotePath(target.elanous ?? DEFAULT_REMOTE_ELANOUS);
   const configDir = remotePath(target.configDir ?? DEFAULT_REMOTE_CONFIG_DIR);
+  const grokCredentialFloorSeconds = Math.ceil(PARENT_CHILD_CREDENTIAL_MIN_REMAINING_MS / 1_000);
   return [
     `echo "version=$(${elanous} --version 2>/dev/null | tail -1 | cut -d' ' -f1)"`,
     `test -f ${configDir}/config.json && echo config=1`,
     `grep -Eq '"podPool"[[:space:]]*:[[:space:]]*"[^"[:space:]]+' ${configDir}/config.json 2>/dev/null && echo podPool=1`,
     `(cd ${shellQuote(target.cwd)} 2>/dev/null && git rev-parse --is-inside-work-tree >/dev/null 2>&1) && echo repo=1`,
     `command -v kubectl >/dev/null 2>&1 && echo kubectl=1`,
+    `{ command -v grok >/dev/null 2>&1 || [ -x "$HOME/.grok/bin/grok" ]; } && echo grokCli=1`,
+    `{ command -v codex >/dev/null 2>&1 || [ -x "$HOME/.local/bin/codex" ]; } && echo codexCli=1`,
     `n=$(grep -Ec '^[[:space:]]*"openai-codex(:[^"]*)?"[[:space:]]*:[[:space:]]*\\{' ${configDir}/auth.json 2>/dev/null); echo "codexAccounts=\${n:-0}"`,
     `{ grep -Eq '"key"[[:space:]]*:[[:space:]]*"[^"]+"' "$HOME/.grok/auth.json" 2>/dev/null || [ -n "\${XAI_API_KEY:-}\${GROK_API_KEY:-}\${GROK_CODE_XAI_API_KEY:-}" ]; } && echo grok=1`,
+    // The remote host owns its device-auth session. Ignore the legacy HQ mirror entry; it can outlive and mask the host credential.
+    // Read only expiry metadata, never credential values, and compare against the shared minimum lifetime.
+    `grokProbe=$(if [ ! -f "$HOME/.grok/auth.json" ]; then printf '0|'; else bun -e 'const fs=require("node:fs");try{const auth=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));const entries=Object.entries(auth).filter(([id])=>id!=="https://auth.x.ai::hq-mirror");const hasKey=entries.some(([,entry])=>typeof entry?.key==="string"&&entry.key.length>0);const expiries=entries.filter(([,entry])=>typeof entry?.expires_at==="string").map(([,entry])=>entry.expires_at).sort();process.stdout.write((hasKey?"1":"0")+"|"+(expiries.length?expiries[expiries.length-1]:""))}catch{}' "$HOME/.grok/auth.json" 2>/dev/null; fi); grokOtherKey=\${grokProbe%%|*}; grokExp=\${grokProbe#*|}`,
+    `grokFloor=$(date -u -d "@$(( $(date +%s) + ${grokCredentialFloorSeconds} ))" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -r "$(( $(date +%s) + ${grokCredentialFloorSeconds} ))" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true); grokNow=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || true)`,
+    `grokHost=$(if [ -n "$XAI_API_KEY$GROK_API_KEY$GROK_CODE_XAI_API_KEY" ]; then echo valid; elif [ -z "$grokProbe" ]; then echo unknown; elif [ -z "$grokExp" ]; then [ "$grokOtherKey" = 1 ] && echo unknown || echo missing; elif [ -z "$grokFloor" ] || [ -z "$grokNow" ]; then echo unknown; else printf '%s\n%s\n%s\n' "$grokExp" "$grokFloor" "$grokNow" | awk 'NR==1{e=$0} NR==2{f=$0} NR==3{n=$0} END{if (e >= f) print "valid"; else if (e >= n) print "expiring"; else print "expired"}'; fi); echo "grokHost=$grokHost"`,
     `{ [ -s "\${ELANOUS_KEY_CACHE_DIR:-$HOME/.cache}/openrouter_api_key" ] || [ -n "\${OPENROUTER_API_KEY:-}" ]; } && echo openrouter=1`,
     `true`,
   ].join('; ');
@@ -273,6 +295,8 @@ export interface PreflightInput {
   localVersion: string;
   /** HQ 착지 동결이 «발사도 막는» 상태인가 — 원격 부모는 그 동결을 못 본다. */
   launchHoldActive: boolean;
+  /** Provider that the detached parent will use for its child. */
+  childProvider?: string;
   ssh?: SshRunner;
 }
 
@@ -296,11 +320,34 @@ export function judgeParentHostFacts(facts: Record<string, string>, input: Omit<
     if (facts.podPool !== '1' && !input.podPoolOverride) gaps.push('remote-pod-pool-unset');
     if (facts.repo !== '1') gaps.push('remote-repo-missing');
     if (facts.kubectl !== '1') gaps.push('remote-kubectl-missing');
+    if (input.childProvider === 'grok' && facts.grokCli !== '1') gaps.push('grok-cli-missing');
+    if ((input.childProvider === 'openai-codex' || input.childProvider === 'codex') && facts.codexCli !== '1') gaps.push('codex-cli-missing');
   }
   if (input.launchHoldActive) gaps.push('hq-launch-freeze-active');
   return gaps;
 }
 
+/** Host-side Grok credential states the preflight probe reports; HQ never sees the token itself. */
+export type ParentHostGrokCredentialState = 'valid' | 'expiring' | 'expired' | 'missing' | 'unknown';
+
+/**
+ * 순수 판정 — 원격 호스트가 스스로 보고한 grok 자격 상태 → **막는** gap 목록(GROK-MIRROR-REAL-SCOPE · 10-20 방향 전환).
+ *
+ * 왜 경고가 아니라 gap 인가: access-only 미러(4필드)는 원격 grok CLI 1.0.41 에서 `session/new` -32000 으로
+ * 거부됐고, HQ refresh_token 복사는 단일 주인 원칙 위반이다. ⇒ 호스트가 각자 device-auth 세션을 스스로
+ * 갱신하고, HQ 는 「쓸 수 있나」만 재서 **무효면 Grok 자식 발사 전에** 막는다(발사 뒤 -32000 반복 금지).
+ *
+ * ⛔ 상태를 «안 보고한» 호스트(구 판)는 막지 않는다 — 모름을 「죽었다」로 읽으면 멀쩡한 호스트가 조용히 빠진다.
+ */
+export function judgeParentHostGrokCredential(facts: Record<string, string>, opts: { childProvider?: string } = {}): string[] {
+  if (opts.childProvider !== 'grok' || facts.unreachable) return [];
+  const state = facts.grokHost as ParentHostGrokCredentialState | undefined;
+  if (state === 'missing') return ['grok-credential-missing'];
+  if (state === 'expiring') return ['grok-credential-expiring'];
+  if (state === 'expired') return ['grok-credential-expired'];
+  return [];
+}
+
 /** 순수 판정 — 원격 LLM 자격 사실 → 경고 목록(막지 않는다 · gaps 와 별개). 못 닿은 호스트는 사실이 없으므로 경고도 없다. */
 export function judgeParentHostCredentials(facts: Record<string, string>): string[] {
   if (facts.unreachable) return [];
@@ -320,7 +367,16 @@ export function preflightParentHost(input: PreflightInput): ParentHostPreflight
     const at = line.indexOf('=');
     if (at > 0) facts[line.slice(0, at).trim()] = line.slice(at + 1).trim();
   }
-  const gaps = judgeParentHostFacts(facts, { localVersion: input.localVersion, launchHoldActive: input.launchHoldActive, podPoolOverride: Boolean(input.target.podPool) });
+  const gaps = judgeParentHostFacts(facts, { localVersion: input.localVersion, launchHoldActive: input.launchHoldActive, podPoolOverride: Boolean(input.target.podPool), ...(input.childProvider ? { childProvider: input.childProvider } : {}) });
+  // 호스트 자체 grok 자격은 «경고»가 아니라 발사 전 «차단» 축이다 — 무효면 OP 재로그인 요청 신호를 남긴다.
+  const credentialGaps = judgeParentHostGrokCredential(facts, { ...(input.childProvider ? { childProvider: input.childProvider } : {}) });
+  if (credentialGaps.length) {
+    try {
+      debug.log('task-agent.parent-host', 'grok-relogin-required', {
+        host: input.target.host, state: facts.grokHost ?? 'unknown', gaps: credentialGaps,
+      });
+    } catch { /* fail-soft */ }
+  }
   const warnings = judgeParentHostCredentials(facts);
   if (warnings.length) {
     try {
@@ -332,7 +388,8 @@ export function preflightParentHost(input: PreflightInput): ParentHostPreflight
       });
     } catch { /* fail-soft */ }
   }
-  return { ok: gaps.length === 0, gaps, warnings, facts };
+  const blocking = [...gaps, ...credentialGaps];
+  return { ok: blocking.length === 0, gaps: blocking, warnings, facts };
 }
 
 /** 원격이 «확실히 안 띄웠다»고 답했다 — 호출부가 로컬로 돌아가도 중복 발사가 아니다. */
@@ -350,9 +407,7 @@ export function launchRemoteParent(
   args: readonly string[],
   env: Record<string, string>,
   ssh: SshRunner = defaultSshRunner,
-  grokMirrorResolver: () => OwnerGrokAccessMirror = resolveOwnerGrokAccessMirror,
   effectiveChildProvider?: string,
-  now: () => number = Date.now,
 ): { pid: number; log: string } {
   const argvProvider = childProviderFromArgs(args);
   if (effectiveChildProvider && argvProvider && argvProvider !== effectiveChildProvider) {
@@ -361,9 +416,11 @@ export function launchRemoteParent(
   const launchArgs = effectiveChildProvider && !argvProvider
     ? [...args.slice(0, 2), '--child-llm-provider', effectiveChildProvider, ...args.slice(2)]
     : args;
+  // GROK-MIRROR-REAL-SCOPE: 원격 부모는 HQ access 미러를 «설치하지 않는다»(4필드 미러는 grok 1.0.41 에서
+  // `session/new` -32000 · HQ refresh_token 복사는 단일 주인 원칙 위반). 호스트가 각자 device-auth 로
+  // 자체 갱신 세션을 쓰고, HQ 는 preflight 에서 «유효성»만 재서 무효면 발사 전에 막는다.
   if ((effectiveChildProvider ?? argvProvider) === 'grok') {
-    const mirror = grokMirrorResolver();
-    installRemoteGrokAccess(target, mirror, ssh, now);
+    try { debug.log('task-agent.parent-host', 'grok-host-credential', { host: target.host, runId: env.ELANOUS_RUN_ID ?? 'unknown', source: 'host-device-auth' }); } catch { /* fail-soft */ }
   }
   const result = ssh(target.host, remoteLaunchScript(target, launchArgs, env), 30_000);
   const log = remoteParentLogPath(target, env.ELANOUS_RUN_ID ?? 'unknown');