elanous 0.2.38 → 0.2.40

package/scripts/release-loop/gate-shard-dispatch.ts

@@ -0,0 +1,128 @@
+/** Pure, fail-closed planning for a release gate measured across hosts. No host command runs here. */
+export interface GateShardIdentity {
+  id: string;
+  files: string[];
+  /** Execution requirement, never a concrete host identity. */
+  requiredOs?: 'darwin' | 'linux';
+}
+
+export interface GateShardReceipt extends GateShardIdentity {
+  head40: string;
+  base40: string;
+  host: string;
+  envKey: string;
+  status: 'complete' | 'unmeasured';
+  /** A complete measurement can contain existing or introduced failures. */
+  failureIds: string[];
+  errorIds: string[];
+  /** Relative path to the measurement artifact, checked by the caller before reuse. */
+  evidencePath: string;
+  evidenceSha256: string;
+  measuredAt: string;
+  attempt: number;
+}
+
+export interface GateShardHost {
+  id: string;
+  platform: 'darwin' | 'linux' | 'other';
+  available: boolean;
+  reserved: boolean;
+}
+
+export interface GateShardDispatchInput {
+  head40: string;
+  base40: string;
+  shards: readonly GateShardIdentity[];
+  receipts: readonly GateShardReceipt[];
+  hosts: readonly GateShardHost[];
+  rerouteShard?: string | 'auto';
+  shardHost?: string;
+  /** IDs known to pass on macOS, supplied by the caller's env-known policy. */
+  macPassShardIds?: readonly string[];
+}
+
+export type GateShardAction =
+  | { shardId: string; files: string[]; kind: 'reuse'; receipt: GateShardReceipt }
+  | { shardId: string; files: string[]; kind: 'run'; host: string; replacing?: GateShardReceipt }
+  | { shardId: string; files: string[]; kind: 'unmeasured'; reason: string };
+
+const SHA40 = /^[a-f0-9]{40}$/i;
+const safeId = (id: string) => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(id);
+const sameFiles = (a: readonly string[], b: readonly string[]) => a.length === b.length && a.every((file, i) => file === b[i]);
+
+export function validGateShardIdentity(head40: string, base40: string, shards: readonly GateShardIdentity[]): boolean {
+  if (!SHA40.test(head40) || !SHA40.test(base40) || shards.length === 0) return false;
+  const ids = new Set<string>();
+  const files = new Set<string>();
+  for (const shard of shards) {
+    if (!safeId(shard.id) || ids.has(shard.id) || shard.files.length === 0
+      || (shard.requiredOs !== undefined && shard.requiredOs !== 'darwin' && shard.requiredOs !== 'linux')) return false;
+    ids.add(shard.id);
+    for (const file of shard.files) {
+      if (!/^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file) || file.split('/').includes('..') || files.has(file)) return false;
+      files.add(file);
+    }
+  }
+  return true;
+}
+
+export function eligibleGateShardReceipt(
+  receipt: GateShardReceipt,
+  shard: GateShardIdentity,
+  head40: string,
+  base40: string,
+): boolean {
+  return receipt.status === 'complete' && receipt.id === shard.id
+      && receipt.head40 === head40 && receipt.base40 === base40 && sameFiles(receipt.files, shard.files)
+      && receipt.envKey.trim().length > 0 && receipt.host.trim().length > 0
+      && receipt.evidencePath.trim().length > 0 && /^[a-f0-9]{64}$/i.test(receipt.evidenceSha256)
+      && Number.isSafeInteger(receipt.attempt) && receipt.attempt > 0
+      && Array.isArray(receipt.failureIds) && receipt.failureIds.every((id) => typeof id === 'string')
+      && Array.isArray(receipt.errorIds) && receipt.errorIds.every((id) => typeof id === 'string');
+}
+
+/** Reuse only exact complete measurements. A requested remeasure replaces one shard, not the whole sweep. */
+export function planGateShardDispatch(input: GateShardDispatchInput): GateShardAction[] {
+  if (!validGateShardIdentity(input.head40, input.base40, input.shards)) throw new Error('invalid gate shard identity');
+  if (input.rerouteShard && input.rerouteShard !== 'auto' && !input.shards.some((s) => s.id === input.rerouteShard))
+    throw new Error(`unknown reroute shard: ${input.rerouteShard}`);
+  if (input.shardHost && !input.hosts.some((host) => host.id === input.shardHost)) throw new Error(`unknown shard host: ${input.shardHost}`);
+  const hosts = input.hosts.filter((host) => host.available && !host.reserved);
+  const macPass = new Set(input.macPassShardIds ?? []);
+  let nextHost = 0;
+  return input.shards.map((shard) => {
+    const receipt = [...input.receipts].reverse().find((r) => eligibleGateShardReceipt(r, shard, input.head40, input.base40));
+    const prior = [...input.receipts].reverse().find((r) => r.id === shard.id && r.head40 === input.head40 && r.base40 === input.base40 && sameFiles(r.files, shard.files));
+    const forced = input.rerouteShard === shard.id;
+    const auto = input.rerouteShard === 'auto' && (prior?.status === 'unmeasured'
+      || (macPass.has(shard.id) && !!prior && (prior.failureIds.length > 0 || prior.errorIds.length > 0)));
+    const receiptHost = hosts.find((host) => host.id === receipt?.host);
+    if (receipt && !forced && !auto && (!shard.requiredOs || receiptHost?.platform === shard.requiredOs))
+      return { shardId: shard.id, files: [...shard.files], kind: 'reuse', receipt };
+    let candidates = hosts.filter((host) => !shard.requiredOs || host.platform === shard.requiredOs);
+    if (input.shardHost && (forced || auto)) candidates = candidates.filter((host) => host.id === input.shardHost);
+    else if (auto && macPass.has(shard.id)) candidates = candidates.filter((host) => host.platform === 'darwin');
+    if ((forced || auto) && prior && candidates.some((host) => host.id !== prior.host)) candidates = candidates.filter((host) => host.id !== prior.host);
+    if (!candidates.length) return { shardId: shard.id, files: [...shard.files], kind: 'unmeasured', reason: 'no eligible host' };
+    const host = candidates[nextHost++ % candidates.length]!;
+    return { shardId: shard.id, files: [...shard.files], kind: 'run', host: host.id, ...(prior ? { replacing: prior } : {}) };
+  });
+}
+
+export type GateShardReduction =
+  | { status: 'complete'; failureIds: string[]; errorIds: string[]; receipts: GateShardReceipt[] }
+  | { status: 'unmeasured'; reason: string };
+
+/** Require exactly one exact, complete receipt per expected shard; classification remains with judgeGate. */
+export function reduceGateShardReceipts(input: { head40: string; base40: string; shards: readonly GateShardIdentity[]; receipts: readonly GateShardReceipt[] }): GateShardReduction {
+  if (!validGateShardIdentity(input.head40, input.base40, input.shards)) return { status: 'unmeasured', reason: 'invalid gate shard identity' };
+  const selected: GateShardReceipt[] = [];
+  for (const shard of input.shards) {
+    const matched = input.receipts.filter((r) => eligibleGateShardReceipt(r, shard, input.head40, input.base40));
+    if (matched.length !== 1) return { status: 'unmeasured', reason: `${shard.id}: expected one complete receipt, found ${matched.length}` };
+    selected.push(matched[0]!);
+  }
+  return { status: 'complete', receipts: selected,
+    failureIds: [...new Set(selected.flatMap((r) => r.failureIds))].sort(),
+    errorIds: [...new Set(selected.flatMap((r) => r.errorIds))].sort() };
+}

package/scripts/release-loop/gate-shard-receipts.ts

@@ -0,0 +1,89 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { eligibleGateShardReceipt, type GateShardIdentity, type GateShardReceipt } from './gate-shard-dispatch.js';
+
+export interface GateShardSavedRun {
+  output: string;
+  rc: number;
+  pass: number;
+  fail: number;
+  errors: number;
+  ran: number;
+  files: number;
+  passedIds: string[];
+}
+
+export interface GateShardSavedResult {
+  receipt: GateShardReceipt;
+  runs: GateShardSavedRun[];
+}
+
+export function gateShardReceiptPath(root: string, shardId: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(shardId)) throw new Error('invalid shard id');
+  return join(root, `${shardId}.receipt.json`);
+}
+
+export function nextGateShardAttempt(root: string, shardId: string): number {
+  try {
+    const previous = JSON.parse(readFileSync(gateShardReceiptPath(root, shardId), 'utf8')) as { attempt?: unknown };
+    return Number.isSafeInteger(previous.attempt) && (previous.attempt as number) > 0 ? (previous.attempt as number) + 1 : 1;
+  } catch { return 1; }
+}
+
+/** Planning may inspect an unmeasured predecessor; only readGateShardResult authorizes reuse. */
+export function readGateShardManifest(root: string, shardId: string): GateShardReceipt | null {
+  try {
+    const value = JSON.parse(readFileSync(gateShardReceiptPath(root, shardId), 'utf8')) as GateShardReceipt;
+    return value && value.id === shardId && Array.isArray(value.files)
+      && Array.isArray(value.failureIds) && value.failureIds.every((id) => typeof id === 'string')
+      && Array.isArray(value.errorIds) && value.errorIds.every((id) => typeof id === 'string')
+      && (value.status === 'complete' || value.status === 'unmeasured') ? value : null;
+  } catch { return null; }
+}
+
+function atomicJson(path: string, value: unknown): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = join(dirname(path), `.${basename(path)}-${process.pid}-${randomUUID()}.tmp`);
+  try { writeFileSync(temp, JSON.stringify(value) + '\n', { mode: 0o600 }); renameSync(temp, path); }
+  finally { if (existsSync(temp)) rmSync(temp); }
+}
+
+/** A new attempt invalidates an old success before host execution starts. */
+export function markGateShardUnmeasured(root: string, receipt: GateShardReceipt): void {
+  atomicJson(gateShardReceiptPath(root, receipt.id), { ...receipt, status: 'unmeasured' });
+}
+
+/** Save the actual measured bytes and bind their digest to the manifest. */
+export function saveGateShardResult(root: string, result: GateShardSavedResult): GateShardReceipt {
+  const { receipt, runs } = result;
+  if (!eligibleGateShardReceipt(receipt, receipt, receipt.head40, receipt.base40) || !runs.length
+    || runs.some((run) => !Number.isSafeInteger(run.ran) || run.ran < 0 || !Number.isSafeInteger(run.files) || run.files < 1))
+    throw new Error('incomplete gate shard result');
+  const payloadName = `${receipt.id}.attempt-${receipt.attempt}-${randomUUID()}.result.json`;
+  const payloadBody = { runs, failureIds: receipt.failureIds, errorIds: receipt.errorIds };
+  const payload = JSON.stringify(payloadBody) + '\n';
+  const digest = createHash('sha256').update(payload).digest('hex');
+  atomicJson(join(root, payloadName), payloadBody);
+  const saved = { ...receipt, evidencePath: payloadName, evidenceSha256: digest };
+  atomicJson(gateShardReceiptPath(root, receipt.id), saved);
+  return saved;
+}
+
+/** No manifest, stale identity, missing bytes or digest mismatch can become a reused pass. */
+export function readGateShardResult(root: string, expected: { shard: GateShardIdentity; head40: string; base40: string; envKey: string }): GateShardSavedResult | null {
+  try {
+    const receipt = JSON.parse(readFileSync(gateShardReceiptPath(root, expected.shard.id), 'utf8')) as GateShardReceipt;
+    if (!eligibleGateShardReceipt(receipt, expected.shard, expected.head40, expected.base40) || receipt.envKey !== expected.envKey
+      || !/^[A-Za-z0-9][A-Za-z0-9._-]*\.result\.json$/.test(receipt.evidencePath)) return null;
+    const payload = readFileSync(join(root, receipt.evidencePath), 'utf8');
+    if (createHash('sha256').update(payload).digest('hex') !== receipt.evidenceSha256) return null;
+    const parsed = JSON.parse(payload) as { runs?: GateShardSavedRun[]; failureIds?: string[]; errorIds?: string[] };
+    if (!Array.isArray(parsed.runs) || parsed.runs.length === 0 || parsed.runs.some((run) =>
+      typeof run.output !== 'string' || !Number.isSafeInteger(run.rc) || !Number.isSafeInteger(run.ran)
+      || !Number.isSafeInteger(run.files) || !Array.isArray(run.passedIds))
+      || JSON.stringify(parsed.failureIds) !== JSON.stringify(receipt.failureIds)
+      || JSON.stringify(parsed.errorIds) !== JSON.stringify(receipt.errorIds)) return null;
+    return { receipt, runs: parsed.runs };
+  } catch { return null; }
+}

package/scripts/release-loop/gate-wall.ts

@@ -79,12 +79,12 @@ function attempt(dir: string, commit: string, pods: TimedPod[]): GateWallAttempt
 const SHARDS_WINDOW_SLACK_MS = 5 * 60_000;
 /**
  * shards.json is a snapshot of the latest attempt, not an archive of every commit, and has no attempt identity.
- * A row is attributed to the attempt only when its root id is one of the attempt's roots AND
+ * A row is attributed to the attempt only when its id is one of the attempt's pod records AND
  * a row starts inside the attempt's pod-record window (from 5 min before its first start to its last end) — a
  * previous attempt's snapshot reusing `pod-0` started earlier and is rejected. The end is free: a longer
  * snapshot is exactly the disagreement this report keeps.
  */
-function shardsSpan(dir: string, rootNames: Set<string>, window: { start: number; end: number }): number | 'outside-attempt-window' | null {
+function shardsSpan(dir: string, podNames: Set<string>, window: { start: number; end: number }): number | 'outside-attempt-window' | null {
   try {
     const file: unknown = JSON.parse(readFileSync(join(dir, 'shards.json'), 'utf8'));
     if (!file || typeof file !== 'object' || !('shards' in file) || !Array.isArray(file.shards)) return null;
@@ -94,7 +94,7 @@ function shardsSpan(dir: string, rootNames: Set<string>, window: { start: number
     const ends: number[] = [];
     for (const row of rows) {
       if (!row || typeof row !== 'object' || !('id' in row) || typeof row.id !== 'string'
-        || !rootNames.has(`${row.id}.json`)) return null;
+        || !podNames.has(`${row.id}.json`)) return null;
       const start = 'startedAt' in row && typeof row.startedAt === 'string' ? Date.parse(row.startedAt) : NaN;
       const end = 'endedAt' in row && typeof row.endedAt === 'string' ? Date.parse(row.endedAt) : NaN;
       if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return null;
@@ -134,10 +134,10 @@ export function gateWall(dir: string, opts: { commit?: string; targetMin?: numbe
   const chosen = matching.find(([, pods]) => pods.some((p) => p.root));
   const attempts = ordered.map(([commit, pods]) => attempt(dir, commit, pods));
   const selected = chosen && attempts.find((a) => a.commit === chosen[0]);
-  // The snapshot has no commit field. Only the latest recorded attempt can own it; require its root row IDs too.
+  // The snapshot has no commit field. Only the latest recorded attempt can own it; require every row's pod record.
   const latest = chosen !== undefined && ordered[0]?.[0] === chosen[0];
   const span = chosen && latest
-    ? shardsSpan(dir, new Set(chosen[1].filter((p) => p.root).map((p) => p.name)),
+    ? shardsSpan(dir, new Set(chosen[1].map((p) => p.name)),
       { start: Math.min(...chosen[1].map((p) => p.start)), end: Math.max(...chosen[1].map((p) => p.end)) }) : null;
   const snapshot = typeof span === 'number' ? span : null;
   const shardsWallMin = snapshot;

package/scripts/release-loop/preflight.ts

@@ -106,10 +106,14 @@ export async function scanOriginMainExport(): Promise<{ mainSha: string; files:
     try { code = runPublicExport(['--leak-check', '--json'], snapshot); }
     finally { console.log = originalLog; console.error = originalError; }
     const report = JSON.parse(output.trim()) as {
-      files?: number; leaks?: number; hits?: Array<{ marker: string }>; codeLiterals?: { hits?: number };
+      files?: number; leaks?: number; hits?: Array<{ marker: string; file?: string; line?: number }>; codeLiterals?: { hits?: number };
       privateRedactions?: { loaded?: boolean };
     };
-    if (report.privateRedactions?.loaded !== true) throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    if (report.privateRedactions?.loaded !== true) {
+      const failure = report.hits?.find((hit) => hit.marker.startsWith('private-redaction-'));
+      if (failure) throw new Error(`공개 export 개인 치환 실패: ${failure.marker} ${failure.file ?? ''}:${failure.line ?? 0}`);
+      throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    }
     if (typeof report.files !== 'number' || typeof report.leaks !== 'number') throw new Error('public-export 검사 결과가 완전하지 않다');
     if (code !== (report.leaks > 0 ? 1 : 0)) throw new Error(`public-export 종료 코드와 누수 결과 불일치: rc=${code} leaks=${report.leaks}`);
     return { mainSha, files: report.files, leaks: report.leaks, codeLiterals: report.codeLiterals?.hits ?? 0 };

package/scripts/release-loop/resume-release.ts

@@ -14,7 +14,7 @@ import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, collectExecutedPodShardImages, planPartialRegate, planStalledShardRecheck, writePartialPlan, writeRecheckPlan } from './gate-partial.js';
 import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
-import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { assertReleaseResumeApprovalBoundary, releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeGateShardReroute, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
 import { reserveReleaseResumeAttempt } from './resume-cap.js';
 import { cutReleaseBranch } from './cut-branch.js';
 import { releaseLoopConfig } from './unattended-release.js';
@@ -55,6 +55,7 @@ export interface ResumeReleaseDeps {
 export interface ResumeReleaseOptions {
   runId: string; from: string; partial?: boolean; waive?: string; reason?: string;
   acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string; gatePodPool?: string;
+  rerouteShard?: string; shardHost?: string; shardOs?: 'darwin' | 'linux';
   commandRoot?: string;
 }
 
@@ -456,12 +457,16 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
   const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
   if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  assertReleaseResumeApprovalBoundary({ ...savedRun, statePath }, opts.from);
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  if ((opts.shardHost !== undefined || opts.shardOs !== undefined) && opts.rerouteShard === undefined)
+    throw new Error('--shard-host/--shard-os require --reroute-shard');
   const hasOverrides = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined
-    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined;
+    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined || opts.rerouteShard !== undefined;
   const original = hasOverrides ? savedRun : undefined;
   if (original && opts.gateExecutor !== undefined) releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost });
   if (original && opts.gatePodPool !== undefined) releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool });
+  if (original && opts.rerouteShard !== undefined) releaseResumeGateShardReroute(original, { from: opts.from, shard: opts.rerouteShard, host: opts.shardHost, os: opts.shardOs });
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined) ? releaseResumeWaiver(original, opts) : undefined;
   if (original && opts.acceptedRegressions !== undefined && !waiver)
     releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from);
@@ -478,10 +483,11 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
     waiverCommit = recorded;
   }
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  if (opts.rerouteShard !== undefined && tip.changed) throw new Error('shard reroute requires the original cut head; moved tip needs a full re-gate');
   verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, tip.version);
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   verifyResumePreflight(savedRun, opts, deps, tip.version, tip.from, tip.to, commandRoot);
-  const partial = preparePartial(tip, opts, deps, true);
+  const partial = preparePartial(tip, opts.rerouteShard !== undefined ? { ...opts, partial: false } : opts, deps, true);
   const fromIndex = savedRun.path.indexOf(opts.from);
   const gateIndex = savedRun.path.indexOf('gate');
   const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
@@ -498,15 +504,20 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
   const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  assertReleaseResumeApprovalBoundary({ ...savedRun, statePath }, opts.from);
   let waiverCommit: string | undefined;
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
-  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined
+  if ((opts.shardHost !== undefined || opts.shardOs !== undefined) && opts.rerouteShard === undefined)
+    throw new Error('--shard-host/--shard-os require --reroute-shard');
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined || opts.rerouteShard !== undefined
     ? savedRun : undefined;
   // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
   const gateExecutor = original && opts.gateExecutor !== undefined
     ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
   const gatePodPool = original && opts.gatePodPool !== undefined
     ? releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool }) : undefined;
+  const shardReroute = original && opts.rerouteShard !== undefined
+    ? releaseResumeGateShardReroute(original, { from: opts.from, shard: opts.rerouteShard, host: opts.shardHost, os: opts.shardOs }) : undefined;
   if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
   if (gatePodPool) debug.log('release-loop.resume', 'gate-pod-pool', {
     runId: opts.runId, from: opts.from, pool: gatePodPool.set.gatePodPool, previous: gatePodPool.previous,
@@ -534,11 +545,12 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
   }
   // The read-only tip and recipe pin preflight must pass before fetch or a saved-run rewrite.
   const previewTip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  if (shardReroute && previewTip.changed) throw new Error('shard reroute requires the original cut head; moved tip needs a full re-gate');
   verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, previewTip.version);
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), previewTip.to, deps.git);
   verifyResumePreflight(savedRun, opts, deps, previewTip.version, previewTip.from, previewTip.to, commandRoot);
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, false, previewTip.to);
-  const partial = preparePartial(tip, opts, deps);
+  const partial = preparePartial(tip, shardReroute ? { ...opts, partial: false } : opts, deps);
   // A failed preflight does not consume an observed release resume attempt.
   const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
   debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt,
@@ -553,6 +565,9 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
     ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
     ...(gatePodPool ? { releaseGatePodPool: gatePodPool.set.gatePodPool } : {}),
+    ...(shardReroute ? { releaseGateShardReroute: { shard: shardReroute.set.gateRerouteShard,
+      ...(shardReroute.set.gateShardHost ? { host: shardReroute.set.gateShardHost } : {}),
+      ...(opts.shardOs ? { os: opts.shardOs } : {}) } } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }

package/scripts/release-loop/resume.ts

@@ -1,9 +1,31 @@
+import { readFileSync } from 'node:fs';
 import { lastJsonObject, STOPPED_NODE_ERROR, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { publicWaiverReason } from './known-issues-node.js';
 import { checkGateExecutorChoice, type GateExecutor } from './gate-executor.js';
 
 export interface AcceptedRegression { id: string; note: string }
 
+/** Match the graph runner's approval boundary before release resume performs tip refresh or writes an attempt. */
+export function assertReleaseResumeApprovalBoundary(state: GraphRunState, from: string): void {
+  if (!Array.isArray(state.path)) return;
+  const start = state.path.indexOf(from);
+  if (start < 0 || state.path.lastIndexOf(from) !== start) {
+    return;
+  }
+  for (let index = 0; index < state.nodes.length; index++) {
+    const record = state.nodes[index]!;
+    if (typeof record.decidedAt !== 'string') continue;
+    if (index >= start) throw new Error('cannot restart across an approval decision — start a new release run with the full gate');
+    if (!record.ok) throw new Error('cannot preserve a failed predecessor when resuming');
+    let decision: { nodeId?: unknown; decision?: unknown; decidedAt?: unknown };
+    try { decision = JSON.parse(readFileSync(`${state.statePath}.${index + 1}.decision.json`, 'utf8')); }
+    catch { throw new Error(`missing approval decision for ${record.nodeId}`); }
+    if (decision.nodeId !== record.nodeId || decision.decision !== 'approved' || decision.decidedAt !== record.decidedAt) {
+      throw new Error(`invalid approval decision for ${record.nodeId}`);
+    }
+  }
+}
+
 /** Merge explicit public issues with the saved release input without changing the ledger shape. */
 export function releaseResumeAcceptedRegressions(state: GraphRunState, additions: AcceptedRegression[], from?: string): AcceptedRegression[] {
   if (!Array.isArray(additions) || additions.some((issue) => !issue || typeof issue.id !== 'string' || !issue.id.trim() || typeof issue.note !== 'string' || !issue.note.trim())) {
@@ -154,6 +176,32 @@ export interface GatePodPoolOverride {
   previous: { gatePodPool: unknown };
 }
 
+/** One shard keeps its component identity while the run-time scheduler chooses a compatible member. */
+export interface GateShardRerouteOverride {
+  kind: 'gate-shard-reroute'; at: string; from: string;
+  set: { gateRerouteShard: string; gateShardHost?: string; gateShardCapabilities?: Record<string, { os: 'darwin' | 'linux' }> };
+  previous: { gateRerouteShard: unknown; gateShardHost: unknown; gateShardCapabilities: unknown };
+}
+
+export function releaseResumeGateShardReroute(state: GraphRunState, opts: {
+  from: string; shard: unknown; host?: unknown; os?: unknown; at?: string;
+}): GateShardRerouteOverride {
+  const input = state.input as Record<string, unknown> | undefined;
+  if (!input || typeof input.gatePodPool !== 'string' || !input.gatePodPool.trim())
+    throw new Error('shard reroute requires the saved Pod gate pool');
+  if (opts.from !== 'gate' || !state.path.includes('gate')) throw new Error('shard reroute requires --from gate');
+  if (typeof opts.shard !== 'string' || !/^(?:auto|pod-\d+)$/.test(opts.shard))
+    throw new Error('--reroute-shard requires auto or pod-N');
+  if (opts.host !== undefined && (typeof opts.host !== 'string' || !opts.host.trim())) throw new Error('--shard-host requires a pool context');
+  if (opts.os !== undefined && (opts.shard === 'auto' || opts.os !== 'darwin' && opts.os !== 'linux'))
+    throw new Error('--shard-os requires pod-N and darwin or linux');
+  return { kind: 'gate-shard-reroute', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gateRerouteShard: opts.shard, ...(opts.host ? { gateShardHost: opts.host.trim() } : {}),
+      ...(opts.os ? { gateShardCapabilities: { [opts.shard]: { os: opts.os } } } : {}) },
+    previous: { gateRerouteShard: input.gateRerouteShard ?? null, gateShardHost: input.gateShardHost ?? null,
+      gateShardCapabilities: input.gateShardCapabilities ?? null } };
+}
+
 export function releaseResumeGatePodPool(state: GraphRunState, opts: { from: string; pool: unknown; at?: string }): GatePodPoolOverride {
   const input = state.input;
   if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');

package/scripts/release-loop/version-node.ts

@@ -465,14 +465,19 @@ export function main(args: string[] = process.argv.slice(2), repo = process.cwd(
       const location = process.env.ELANOUS_GRAPH_CONTEXT;
       const context = JSON.parse(location.trimStart().startsWith('{') ? location : readFileSync(location, 'utf8')) as {
         runId?: unknown; input?: { version?: unknown; cutCommit?: unknown; forceFreeze?: unknown; branchCut?: unknown };
-        outputs?: Record<string, { commit?: unknown; base?: unknown; branch?: unknown } | undefined> };
+        outputs?: Record<string, { outcome?: unknown; commit?: unknown; base?: unknown; branch?: unknown } | undefined> };
       if (context.runId !== undefined) {
         if (typeof context.runId !== 'string') throw new Error('runId must be a string');
         runId = context.runId;
       }
       if (!version && typeof context.input?.version === 'string') version = context.input.version;
       forceFreeze = context.input?.forceFreeze === true;
-      branchCut = context.input?.branchCut === true;
+      const releasedBranch = context.outputs?.['version-release']?.branch;
+      branchCut = context.input?.branchCut === true
+        || (kind === 'dev-bump'
+          && context.outputs?.['version-release']?.outcome === 'ok'
+          && typeof version === 'string'
+          && releasedBranch === `release/${version}`);
       if (kind === 'release' && cutCommit === undefined && context.input?.cutCommit !== undefined) {
         if (typeof context.input.cutCommit !== 'string') throw new Error('cutCommit must be a commit SHA');
         cutCommit = context.input.cutCommit;

package/scripts/release-story/draft.ts

@@ -46,7 +46,7 @@ function userFacingLines(markdown: string): { lines: string[]; internalDropped:
       if (text) internalDropped++;
       return [];
     }
-    const publicText = text.replace(/\s+["'“]?Target:\s*next\.["'”]?\s*$/i, '')
+    const publicText = text.replace(/\s+["'“]?Target:\s*next\.["'”]?(?=\s*(?:\([^)]*\))?\s*$)/i, '')
       .replace(/\s+["'“]?Documentation:\s*.*\.["'”]?\s*$/i, '').trim()
       .replace(/^(?:feat|fix)\s*—\s*/i, '');
     return publicText ? [publicText] : [];

package/scripts/research-bench/README.md

@@ -0,0 +1,53 @@
+신설: scripts/research-bench/README.md
+# Research harness benchmark
+
+## SCQA
+
+**S** — The 10/31 positioning decision needs evidence about Elanous research quality and its Bloom-native research design.
+
+**C** — A product-default comparison mixes harness and model effects. Bloom stages and graph layouts also need isolated comparisons under one model and fixed questions.
+
+**Q** — How do we compare the products, measure Bloom's contribution, and test the recommended stage layout under either the default API cap or an explicitly approved uncapped run?
+
+**A** — Run the same ten questions across a controlled pair, Bloom ablation, product-default pair, and Elanous layout ablation. Start with three questions, review the measurement, then run all ten. Keep manifests, raw answers, scores, latency, and spend in private evidence.
+
+## Experiment matrix
+
+| Cell | Comparison | Bloom instruction | Layout | Harnesses |
+|---|---|---|---|---|
+| A0 | Controlled baseline and no-Bloom ablation | None | Baseline | Elanous + Claude Code, both Opus 5.5 |
+| A1 | Bloom ablation | Stages 1–3 | Baseline | Elanous + Claude Code, both Opus 5.5 |
+| A2 | Bloom ablation | Stages 1–5 | Baseline | Elanous + Claude Code, both Opus 5.5 |
+| A3 | Bloom ablation | Stages 1–6 | Baseline | Elanous + Claude Code, both Opus 5.5 |
+| B | Product comparison | None | Product defaults | Elanous installed default + Claude Code defaults |
+| P1 | Layout ablation | Stages 1–6 | Linear 1→6 | Elanous, Opus 5.5 |
+| P5 | Layout ablation | Stages 1–6 | Front 6 reverse design; parallel 1/3; 4/5 loop; final 6 | Elanous, Opus 5.5 |
+| P5-no-front6 | Layout ablation | Stages 1–6 | P5 without front 6 | Elanous, Opus 5.5 |
+
+A0 is also the no-Bloom ablation baseline. A1–A3 add cumulative Bloom scaffolding to the same question; the question text stays unchanged. The product cell uses Elanous's installed default configuration (gpt-6-luna) against Claude Code defaults; it is not a controlled model comparison. OP deferred role-routed Elanous best-config measurement to B2 after 0.2.40. Layout cells measure Elanous architecture only. The 10 questions cover finance, technology, and market; at least four require analysis/evaluation.
+
+## Run order and budget
+
+- Pilot: the first-listed question in each of the finance, technology, and market domains across all eight cells, 39 total invocations (24 Elanous API calls, 15 Claude subscription calls).
+- Execution-validation smoke: a configurable number of first-listed questions in A0 only, each as one matched Claude/Elanous pair. This checks runtime, timeout recovery, and cost collection; do not score it.
+- Full: 10 questions in all eight cells, 130 total invocations (80 Elanous API calls, 50 Claude subscription calls).
+- Default runs use the approved Elanous API cap of $200. After each Elanous call, read its `llm-usage` event, calculate token cost at official rates, and append to the private ledger. Do not start the next pair once cumulative Elanous API spend reaches $160 (80%). Finish the current matched pair. Claude Code subscription calls are recorded at $0 API spend and do not consume that cap. Use `--no-cost-cap` only when OP explicitly authorizes an uncapped run; manifests and ledgers mark both cap fields `null`.
+- Opus 5.5 rates are $4/MTok input, $20/MTok output, $5/MTok 5-minute cache writes, and $0.20/MTok cache reads. The official price table is [Anthropic prompt-cache pricing](https://platform.claude.com/docs/en/build-with-claude/prompt-caching) and [Claude Opus pricing](https://www.anthropic.com/claude/opus). Other Elanous models use the price estimate in their `llm-usage` event; an unknown API price stops the run.
+- Pair order alternates for the controlled cells by question and cell. Every invocation starts a fresh session. Never pass one answer to another run.
+- Collect per-cell rubric scores, actual provider spend, elapsed time, source count/quality, resolution level, tool traces, and failure/unknown notes. Report paired deltas and uncertainty; ten questions do not support broad population claims.
+
+## Commands
+
+```bash
+bun scripts/research-bench/run.ts --dry-run
+bun scripts/research-bench/run.ts --live --smoke-pairs 3 --baseline-sha <main-commit-sha> --config <private-config.json> --no-cost-cap --approval-ref OP#42096 --out ~/elanous-hq/seat-state/OP/evidence/20261026/askop-model-vs-harness
+bun scripts/research-bench/run.ts --live --pilot --baseline-sha <main-commit-sha> --config <private-config.json> --max-total-cost-usd 200 --out ~/elanous-hq/seat-state/OP/evidence/20261026/askop-model-vs-harness
+bun scripts/research-bench/run.ts --live --pilot --baseline-sha <main-commit-sha> --config <private-config.json> --no-cost-cap --approval-ref OP#42096 --out ~/elanous-hq/seat-state/OP/evidence/20261026/askop-model-vs-harness
+bun scripts/research-bench/run.ts --live --full --baseline-sha <main-commit-sha> --config <private-config.json> --max-total-cost-usd 200 --out ~/elanous-hq/seat-state/OP/evidence/20261026/askop-model-vs-harness
+```
+
+The private config is version 2 and has adapters for A0, A1, A2, A3, B, P1, P5, and P5-no-front6, plus a baseline version probe. The probe must report the exact `--baseline-sha` requested before any live invocation starts. Smoke validation selects one question each from finance, technology, and market (one to three pairs), and its results are not scored. Adapter arguments are arrays, never shell strings; `{prompt}` is required and the other values may be interpolated when the adapter supports them. Each adapter declares model, tool-policy ID, turn limit, timeout, and a usage source. A0–A3 use Opus 5.5, eight tool turns, a 10-minute timeout, and a common research tool-policy ID; the Elanous config sets the Anthropic turn cap to eight, while Claude Code uses `--max-turns 8`. Elanous adapters query `eln logs --category llm.usage --event llm-usage --json --json-data --session {sessionId}` after each invocation; Claude Code adapters emit `stream-json` usage. Tool names differ slightly between CLI surfaces (Elanous `ListDir`, Claude Code `LS`); each call records the model reported by its usage source and token usage, using `unknown` when the source omits the model. Product defaults may differ by design.
+
+## Scoring and evidence
+
+Use `rubric.md` with blinded harness/model labels. Two raters score independently; a third resolves any two-point disagreement. Report per-question and per-dimension results, latency, and actual API spend. Outputs go only to private `seat-state/OP/evidence/`; never commit provider answers. Keep question and rubric versions fixed for regression comparisons.

package/scripts/research-bench/questions.json

@@ -0,0 +1,66 @@
+[
+  {
+    "id": "finance-01-kgb-10y",
+    "domain": "finance",
+    "bloom": ["remember", "understand", "analyze", "evaluate", "create"],
+    "requiresHigherOrder": true,
+    "prompt": "현재 기준으로 한국 국고채 10년물 금리의 최근 30일 변화를 조사하라. 공신력 있는 시계열 값과 날짜를 먼저 제시하고, 움직임을 설명하는 요인을 데이터로 분해하라. 가장 강한 대안 설명과 반대 근거를 포함하고, 향후 3개월의 조건부 시나리오를 제시하되 투자 권유는 하지 마라. 핵심 주장마다 원문 출처 URL과 기준 시각을 붙여라."
+  },
+  {
+    "id": "finance-02-usdkrw",
+    "domain": "finance",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate"],
+    "requiresHigherOrder": true,
+    "prompt": "현재 기준 최근 90일 원/달러 환율 변화를 조사하고, 달러지수·미 국채금리·한국 수출 및 자금 흐름이 각각 설명하는 부분을 구분하라. 인과관계와 동시 움직임을 혼동하지 말고, 각 설명을 지지하는 자료와 반대 사례를 대조하라. 근거가 부족한 요인은 미확인으로 남기고, 출처 URL·값·날짜를 제시하라."
+  },
+  {
+    "id": "finance-03-korean-memory-producers",
+    "domain": "finance",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate", "create"],
+    "requiresHigherOrder": true,
+    "prompt": "현재 공개된 최신 실적 기준으로 삼성전자와 SK하이닉스의 메모리 사업을 비교하라. 매출·수익성·제품 믹스·CAPEX 등 비교 가능한 수치를 같은 기간으로 정렬하고, 차이의 원인을 분해하라. 두 회사 각각에 유리한 반대 근거와 데이터 공백을 포함하고, 다음 두 분기에 관찰할 지표와 조건부 시나리오를 제안하라. 투자 권유는 하지 말고 원문 출처·기간·단위를 표시하라."
+  },
+  {
+    "id": "technology-01-hbm4",
+    "domain": "technology",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate", "create"],
+    "requiresHigherOrder": true,
+    "prompt": "HBM4의 현재 개발·양산·고객 인증 상태와 공급망 병목을 1차 자료 중심으로 조사하라. 발표·샘플·인증·양산을 서로 다른 상태로 구분하고, 메모리 업체·패키징·가속기 공급망의 인과 관계를 설명하라. 일정 지연 또는 채택 축소를 뒷받침하는 반대 근거도 찾고, 2027년까지 확인 가능한 관측 지표와 시나리오를 제시하라."
+  },
+  {
+    "id": "technology-02-coding-agent-adoption",
+    "domain": "technology",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate"],
+    "prompt": "2025년 이후 코딩 에이전트의 실제 조직 도입과 생산성 효과를 조사하라. 벤더 발표·설문·독립 실험을 출처 유형별로 분리하고, 표본·측정 정의·선택 편향을 비교하라. 생산성 향상 주장에 대한 반대 결과와 보안·검토 비용도 포함하고, 근거가 말할 수 있는 범위를 제안하라. 핵심 수치에는 모집단·기간·원문 URL을 붙여라."
+  },
+  {
+    "id": "technology-03-inference-economics",
+    "domain": "technology",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate", "create"],
+    "prompt": "최근 12개월의 frontier 및 open-weight 모델 추론 비용·성능 변화를 비교하라. 공개 가격표와 재현 가능한 독립 평가를 분리하고, 토큰 가격·지연·품질·하드웨어 이용률이 실제 총비용에 미치는 영향을 계산 가능한 단위로 제시하라. '더 싸다'는 주장에 대한 반례와 작업별 차이를 분석하고, 12개월의 조건부 시나리오를 제시하라."
+  },
+  {
+    "id": "market-01-enterprise-research-agents",
+    "domain": "market",
+    "bloom": ["remember", "understand", "analyze", "evaluate", "create"],
+    "prompt": "기업용 조사·리서치 에이전트 시장의 규모와 성장률 주장을 비교하라. 최소 세 출처의 정의·포함 제품·기준 연도·예측 기간을 대조하고, 같은 시장을 측정하는지 판단하라. 도입 사례와 실사용 효과의 독립 근거를 벤더 전망과 분리하고, 가장 큰 불확실성 및 반대 근거를 제시하라."
+  },
+  {
+    "id": "market-02-korean-enterprise-automation",
+    "domain": "market",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate", "create"],
+    "prompt": "한국 기업의 에이전트형 AI 업무 자동화에서 현재 가치가 검증된 부문을 조사하라. 금융·제조·고객지원 등 최소 세 부문에서 실제 배포, 실험, 계획 발표를 구분하고, 도입 전후의 비용·시간·오류 지표를 찾아라. 규제·데이터·통합 비용과 효과가 없었던 사례도 포함하고, 다음 12개월에 검증할 측정 설계를 제안하라."
+  },
+  {
+    "id": "market-03-ai-research-assistants",
+    "domain": "market",
+    "bloom": ["remember", "understand", "apply", "analyze", "evaluate"],
+    "prompt": "AI 조사 보조 제품군의 최근 경쟁 구도를 조사하라. 제품 기능 나열 대신 출처 발견·교차검증·기억·도구 실행·인용 정확도·가격을 축으로 비교하라. 독립 평가와 공식 문서를 구분하고, 강점 주장을 뒤집을 수 있는 반례 및 기능 미지원 증거를 찾으라. 사용 사례별로 승자를 달리 제시하고 근거 수준을 표시하라."
+  },
+  {
+    "id": "market-04-agentic-knowledge-work",
+    "domain": "market",
+    "bloom": ["understand", "apply", "analyze", "evaluate", "create"],
+    "prompt": "지식 노동에서 조사 에이전트가 검색·분석·보고 과정을 바꾸는 방식을 조사하라. 현장 도입 사례와 통제된 연구를 분리하고, 어떤 작업은 자동화되고 어떤 판단은 사람에게 남는지 사례로 분석하라. 생산성 이익과 함께 오류·근거 누락·데이터 유출·검토 비용의 반대 근거를 다루고, 측정 가능한 성공 기준과 실패 시 대안을 설계하라."
+  }
+]