elanous 0.2.38 → 0.2.41

package/src/harness/harness-incidents.ts

@@ -1,10 +1,12 @@
 import { Database } from 'bun:sqlite';
+import { createHash } from 'node:crypto';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { redactSecretText } from '../debug/log.js';
 import { refuseProductionLedgerWriteInTest } from './ledger-write-guard.js';
 import type { PodChildEvidence } from '../task-orchestrator/surfaces/self-implement.js';
 import { parsePodTermination, type PodTermination } from '../task-orchestrator/surfaces/pod-failure-reason.js';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 
 export interface RunExit {
   runId: string;
@@ -21,6 +23,21 @@ export interface RunExit {
   childEvidence?: PodChildEvidence;
   /** JOB-FAILURE-TERMINATION-CAPTURE — the current attempt's Job/Pod termination facts, captured before GC. */
   podTermination?: PodTermination;
+  /** Current Pod attempt + bounded child output + container exit + parent verdict, joined under this runId. */
+  terminalEvidence?: {
+    job: string;
+    childRunId: string;
+    attempt: number | 'unknown';
+    childOutputTail: string[] | 'unknown';
+    containerExitCode: number | 'unknown';
+    parentVerdict: string;
+    failureClassification: string | 'unknown';
+    terminationReason: string | 'unknown';
+    childFailureStage: string | 'unknown';
+    childRunStatus: { stage: string | 'unknown'; status: string | 'unknown'; failureKind: string | 'unknown' };
+    shardIdentityReadFailure: string | 'none' | 'unknown';
+    providerFailure: 'credential-not-configured' | 'provider-failed' | 'none' | 'unknown';
+  };
   /** INCIDENT-REASON-FROM-LASTLINES — 기록된 reason 이 unknown 이라 lastLines 로 다시 분류했으면 원래 값. */
   recordedReason?: string;
   /** reason 을 어디서 얻었나 — 'lastLines' 면 위 분류 규칙으로 정했다(기록 원문은 recordedReason). */
@@ -40,12 +57,132 @@ export interface IncidentBurst {
   hostname?: string;
 }
 
+export type TcellHealthClass = 'healthy' | 'slow' | 'stalled' | 'infected' | 'zombie';
+
+/** A read-only health-card snapshot supplied to the guardian tick. Times are epoch milliseconds. */
+export interface TcellHealthCard {
+  runId: string;
+  stage: string;
+  startedAt: number;
+  progressAt: number | null;
+  stageBudgetMs: number;
+  heartbeatAt: number | null;
+  parentPresent: boolean;
+  leaseExpiresAt: number | null;
+  riskSignal: boolean;
+  stopClass?: string;
+  site?: string;
+  /** Stable signature tail, already bounded by the producer. Raw log tails are not accepted here. */
+  signatureTail?: string;
+  /** Deliberately excluded from cause grouping. */
+  hostname?: string;
+}
+
+export interface TcellHealthDecision {
+  runId: string;
+  stage: string;
+  classification: TcellHealthClass;
+  reason: 'heartbeat-missing' | 'parent-missing' | 'lease-expired' | 'risk-signal' | 'cause-quorum' | 'no-progress-30m' | 'over-stage-budget' | 'within-stage-budget';
+  causeGroupId?: string;
+  causeGroupSize?: number;
+}
+
+export interface TcellHealthClassification {
+  total: number;
+  measured: number;
+  unmeasuredRunIds: string[];
+  counts: Record<TcellHealthClass, number>;
+  decisions: TcellHealthDecision[];
+}
+
+const TCELL_STALLED_AFTER_MS = 30 * 60_000;
+const TCELL_CAUSE_QUORUM = 3;
+
+function tcellCauseGroupId(card: TcellHealthCard): string | undefined {
+  const stopClass = card.stopClass?.trim();
+  const site = card.site?.trim();
+  const signatureTail = card.signatureTail?.trim();
+  if (!stopClass || !site || !signatureTail) return undefined;
+  // Hash the exact stop.class + site + signature-tail tuple. Host is deliberately absent.
+  return createHash('sha256').update(JSON.stringify([stopClass, site, signatureTail])).digest('hex').slice(0, 16);
+}
+
+/** Pure shadow classification. Invalid/incomplete cards are reported as unmeasured, never as healthy or zombie. */
+export function classifyTcellHealthCards(cards: readonly TcellHealthCard[], now: number): TcellHealthClassification {
+  if (!Number.isFinite(now)) throw new RangeError('invalid T-cell patrol time');
+  const valid: TcellHealthCard[] = [];
+  const unmeasuredRunIds: string[] = [];
+  const seen = new Set<string>();
+  for (const card of cards) {
+    const measured = typeof card.runId === 'string' && !!card.runId.trim() && !seen.has(card.runId)
+      && typeof card.stage === 'string' && !!card.stage.trim()
+      && Number.isFinite(card.startedAt) && card.startedAt <= now
+      && (card.progressAt === null || (Number.isFinite(card.progressAt) && card.progressAt <= now))
+      && Number.isFinite(card.stageBudgetMs) && card.stageBudgetMs > 0
+      && (card.heartbeatAt === null || (Number.isFinite(card.heartbeatAt) && card.heartbeatAt <= now))
+      && typeof card.parentPresent === 'boolean'
+      && (card.leaseExpiresAt === null || Number.isFinite(card.leaseExpiresAt))
+      && typeof card.riskSignal === 'boolean';
+    if (!measured) {
+      if (typeof card.runId === 'string' && card.runId.trim()) unmeasuredRunIds.push(card.runId);
+      continue;
+    }
+    seen.add(card.runId);
+    valid.push(card);
+  }
+
+  const groups = new Map<string, Set<string>>();
+  for (const card of valid) {
+    const groupId = tcellCauseGroupId(card);
+    if (!groupId) continue;
+    const members = groups.get(groupId) ?? new Set<string>();
+    members.add(card.runId);
+    groups.set(groupId, members);
+  }
+
+  const counts: Record<TcellHealthClass, number> = { healthy: 0, slow: 0, stalled: 0, infected: 0, zombie: 0 };
+  const decisions = valid.map((card): TcellHealthDecision => {
+    const causeGroupId = tcellCauseGroupId(card);
+    const causeGroupSize = causeGroupId ? groups.get(causeGroupId)?.size : undefined;
+    const progressAge = now - (card.progressAt ?? card.startedAt);
+    let classification: TcellHealthClass;
+    let reason: TcellHealthDecision['reason'];
+    if (card.heartbeatAt === null) { classification = 'zombie'; reason = 'heartbeat-missing'; }
+    else if (!card.parentPresent) { classification = 'zombie'; reason = 'parent-missing'; }
+    else if (card.leaseExpiresAt === null || card.leaseExpiresAt <= now) { classification = 'zombie'; reason = 'lease-expired'; }
+    else if (card.riskSignal) { classification = 'infected'; reason = 'risk-signal'; }
+    else if ((causeGroupSize ?? 0) >= TCELL_CAUSE_QUORUM) { classification = 'infected'; reason = 'cause-quorum'; }
+    else if (progressAge >= TCELL_STALLED_AFTER_MS) { classification = 'stalled'; reason = 'no-progress-30m'; }
+    else if (progressAge > card.stageBudgetMs * 2) { classification = 'slow'; reason = 'over-stage-budget'; }
+    else { classification = 'healthy'; reason = 'within-stage-budget'; }
+    counts[classification] += 1;
+    return { runId: card.runId, stage: card.stage, classification, reason,
+      ...(causeGroupId ? { causeGroupId, causeGroupSize } : {}) };
+  });
+  return { total: cards.length, measured: valid.length, unmeasuredRunIds, counts, decisions };
+}
+
 /** Scrub before bounding: a token crossing the 200-character boundary must not leak. */
 export function incidentLastLines(output: string): string[] {
   return output.split(/\r?\n/).filter((line) => line.trim().length > 0).slice(-3)
     .map((line) => redactSecretText(line).slice(0, 200));
 }
 
+function safeChildEvidence(value: PodChildEvidence | undefined): PodChildEvidence | undefined {
+  if (!value) return undefined;
+  const safeText = (text: string): string => redactSecretText(text).slice(0, 200);
+  return {
+    ...value,
+    ...(typeof value.error === 'string' ? { error: safeText(value.error) } : {}),
+    ...(typeof value.detail === 'string' ? { detail: safeText(value.detail) } : {}),
+    ...(typeof value.stderr === 'string' ? { stderr: safeText(value.stderr) } : {}),
+    ...(typeof value.podLogUnavailable === 'string' ? { podLogUnavailable: safeText(value.podLogUnavailable) } : {}),
+    ...(Array.isArray(value.podLogTail) ? { podLogTail: value.podLogTail.slice(-3).map(safeText) } : {}),
+    ...(value.prFailure && typeof value.prFailure.errorTail === 'string'
+      ? { prFailure: { ...value.prFailure, errorTail: safeText(value.prFailure.errorTail) } } : {}),
+  };
+}
+
 const KST_OFFSET_MS = 9 * 60 * 60_000;
 const INCIDENT_FILE = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
 
@@ -55,9 +192,9 @@ function kstDate(at: number): string {
 
 // ── INCIDENT-REASON-FROM-LASTLINES (0.2.36 · 10-22 · OP 대응 피처) ───────────────────────────────
 // 기록된 reason 이 «unknown» 인데 마지막 출력 줄에 사유가 그대로 있는 사고가 다수(10-22 경보) — 읽는 쪽에서
-// 결정론으로 다시 분류한다. 우선순위 = 더 구체적인 종료 사유 먼저. 아무것도 안 맞으면 unknown 그대로(추측 0).
+// 결정론으로 다시 분류한다. 꼬리 전체에서 서로 다른 사유가 «정확히 하나» 일 때만 그 사유를 쓰고,
+// 0개(무증거)나 2개 이상(충돌)이면 unknown 그대로 둔다(추측 0). 표 순서는 «첫 매치 우선순위»가 아니다.
 const LAST_LINE_REASONS: ReadonlyArray<[RegExp, string]> = [
-  // 근본 원인 먼저 — 뒤 조각의 DEPENDENCY_NEEDS_HUMAN 은 앞 조각 실패의 «증상»이라 맨 뒤 쪽.
   [/goal-elaboration needs-human:\s*goal-elaboration-ungrounded-path\b/, 'goal-elaboration-ungrounded-path'],
   [/goal-elaboration needs-human:\s*goal-elaboration-protected-path\b/, 'goal-elaboration-protected-path'],
   [/goal-elaboration needs-human:\s*goal-elaboration-scope-conflict\b/, 'goal-elaboration-scope-conflict'],
@@ -72,12 +209,28 @@ const LAST_LINE_REASONS: ReadonlyArray<[RegExp, string]> = [
 ];
 const DEVICE_SLICE_PATH = /src\/ux-sim\/[\w.-]*-device(?:\.test)?\.ts|DEVICE-FIRST/;
 
-/** lastLines 에서 종료 사유를 꺼낸다 — 안 맞으면 null(unknown 유지). */
+// 한 사건을 두 이름으로 서술한 꼬리(상세 표지 ⊕ 일반 표지)는 충돌이 아니다 — 상세 표지가 일반 표지를 흡수한다.
+// 서로 다른 사건을 말하는 표지끼리만 충돌이다(예: GOAL_DONE_BOUNDARY_MISSING ⊕ DEPENDENCY_NEEDS_HUMAN).
+const REASON_ABSORBS: ReadonlyArray<readonly [string, readonly string[]]> = [
+  ['goal-elaboration-ungrounded-path', ['needs-human']],
+  ['goal-elaboration-protected-path', ['needs-human']],
+  ['goal-elaboration-scope-conflict', ['needs-human']],
+  ['goal-elaboration-fixed-layer-conflict', ['needs-human']],
+  ['goal-done-boundary-missing', ['needs-human']],
+  ['pod-backoff-limit', ['pod-job-failed']],
+  ['pod-child-no-result', ['pod-job-failed']],
+  ['dependency-needs-human', ['needs-human']],
+];
+
+/** lastLines 에서 종료 사유를 꺼낸다 — 무증거·충돌이면 null(unknown 유지). */
 export function classifyIncidentReasonFromLastLines(lines: readonly string[] | undefined): string | null {
   if (!lines?.length) return null;
   const text = lines.join('\n');
-  for (const [pattern, reason] of LAST_LINE_REASONS) if (pattern.test(text)) return reason;
-  return null;
+  const matched = LAST_LINE_REASONS.filter(([pattern]) => pattern.test(text)).map(([, reason]) => reason);
+  const distinct = [...new Set(matched)].filter(
+    (reason) => !REASON_ABSORBS.some(([specific, absorbed]) => specific !== reason && matched.includes(specific) && absorbed.includes(reason)),
+  );
+  return distinct.length === 1 ? (distinct[0] ?? null) : null;
 }
 
 function refinedReasonFields(reason: string, lines: readonly string[] | undefined): Pick<RunExit, 'reason' | 'recordedReason' | 'reasonSource' | 'slice'> {
@@ -126,12 +279,54 @@ export function readRunExits(root: string): RunExit[] {
         ...(row.childEvidence && typeof row.childEvidence === 'object' && !Array.isArray(row.childEvidence)
           ? { childEvidence: row.childEvidence } : {}),
         ...podTerminationField(row.podTermination),
+        ...terminalEvidenceField(row.terminalEvidence),
       });
     }
   }
   return rows.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
 }
 
+function terminalEvidenceField(value: unknown): { terminalEvidence?: RunExit['terminalEvidence'] } {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  const row = value as Record<string, unknown>;
+  const attempt = row.attempt;
+  const tail = row.childOutputTail;
+  const exitCode = row.containerExitCode;
+  if (typeof row.job !== 'string' || !row.job.trim() || typeof row.childRunId !== 'string' || !row.childRunId.trim()
+    || !(attempt === 'unknown' || (typeof attempt === 'number' && Number.isSafeInteger(attempt) && attempt > 0))
+    || !(tail === 'unknown' || (Array.isArray(tail) && tail.every((line) => typeof line === 'string')))
+    || !(exitCode === 'unknown' || (typeof exitCode === 'number' && Number.isSafeInteger(exitCode) && exitCode >= 0))
+    || typeof row.parentVerdict !== 'string'
+    || !(row.failureClassification === undefined || row.failureClassification === null || row.failureClassification === 'unknown' || typeof row.failureClassification === 'string')
+    || !(row.terminationReason === undefined || row.terminationReason === null || row.terminationReason === 'unknown' || typeof row.terminationReason === 'string')) return {};
+  const childOutputTail = tail === 'unknown' ? tail
+    : tail.slice(-3).map((line) => redactSecretText(line).slice(0, 200));
+  const failureClassification = row.failureClassification === undefined || row.failureClassification === null
+    ? 'unknown' : row.failureClassification === 'unknown' ? 'unknown' : redactSecretText(row.failureClassification).slice(0, 120);
+  const terminationReason = row.terminationReason === undefined || row.terminationReason === null
+    ? 'unknown' : row.terminationReason === 'unknown' ? 'unknown' : redactSecretText(row.terminationReason).slice(0, 200);
+  const childFailureStage = typeof row.childFailureStage === 'string' && row.childFailureStage.trim()
+    ? redactSecretText(row.childFailureStage).slice(0, 120) : 'unknown';
+  const childRunStatus = readChildRunStatus(row.childRunStatus);
+  const shardIdentityReadFailure = row.shardIdentityReadFailure === 'none' || row.shardIdentityReadFailure === 'unknown'
+    ? row.shardIdentityReadFailure
+    : typeof row.shardIdentityReadFailure === 'string' && row.shardIdentityReadFailure.trim()
+      ? redactSecretText(row.shardIdentityReadFailure).slice(0, 120) : 'unknown';
+  const providerFailure = row.providerFailure === 'credential-not-configured' || row.providerFailure === 'provider-failed'
+    || row.providerFailure === 'none' || row.providerFailure === 'unknown' ? row.providerFailure : 'unknown';
+  return { terminalEvidence: { job: row.job, childRunId: row.childRunId, attempt, childOutputTail,
+    containerExitCode: exitCode, parentVerdict: row.parentVerdict, failureClassification, terminationReason,
+    childFailureStage, childRunStatus, shardIdentityReadFailure, providerFailure } };
+}
+
+function readChildRunStatus(value: unknown): NonNullable<RunExit['terminalEvidence']>['childRunStatus'] {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return { stage: 'unknown', status: 'unknown', failureKind: 'unknown' };
+  const row = value as Record<string, unknown>;
+  const safe = (field: unknown): string | 'unknown' => typeof field === 'string' && field.trim()
+    ? redactSecretText(field).slice(0, 120) : 'unknown';
+  return { stage: safe(row.stage), status: safe(row.status), failureKind: safe(row.failureKind) };
+}
+
 function podTerminationField(value: unknown): { podTermination?: PodTermination } {
   const job = value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>).job : undefined;
   const parsed = typeof job === 'string' ? parsePodTermination(value, job) : undefined;
@@ -152,8 +347,12 @@ export function recordRunExit(row: RunExit, root: string): void {
     lock.exec('BEGIN IMMEDIATE');
     try {
       if (!readRunExits(root).some((record) => record.runId === row.runId)) {
-        const safeRow = row.lastLines === undefined ? row : {
-          ...row, lastLines: row.lastLines.slice(-3).map((line) => redactSecretText(line).slice(0, 200)),
+        const terminalEvidence = deriveTerminalEvidence(row, root);
+        const safeRow: RunExit = {
+          ...row,
+          ...(row.lastLines === undefined ? {} : { lastLines: row.lastLines.slice(-3).map((line) => redactSecretText(line).slice(0, 200)) }),
+          ...(row.childEvidence === undefined ? {} : { childEvidence: safeChildEvidence(row.childEvidence) }),
+          ...(terminalEvidence ? { terminalEvidence } : {}),
         };
         appendFileSync(join(dir, `${kstDate(at)}.jsonl`), `${JSON.stringify(safeRow)}\n`);
       }
@@ -167,6 +366,112 @@ export function recordRunExit(row: RunExit, root: string): void {
   }
 }
 
+/** Join exit facts through the last pod-child-run fence; never borrow a previous Pod attempt. */
+function deriveTerminalEvidence(row: RunExit, root: string): RunExit['terminalEvidence'] | undefined {
+  let entries: RunLedgerEntry[] | null;
+  try { entries = loadRunLedger(row.runId, runLedgerDir(root)); }
+  catch { return undefined; /* observing the child ledger cannot block the parent incident record */ }
+  if (!entries) return undefined;
+  let startIndex = -1;
+  entries.forEach((entry, index) => { if (entry.event === 'pod-child-run') startIndex = index; });
+  const startEntry = startIndex >= 0 ? entries[startIndex] : undefined;
+  const start = startEntry?.data;
+  if (!start || typeof start.job !== 'string' || !start.job.trim()
+    || typeof start.childRunId !== 'string' || !start.childRunId.trim()) return undefined;
+  const currentRows = entries.slice(startIndex + 1).filter((entry) => entry.event === 'pod-child-evidence'
+    && entry.data.job === start.job && entry.data.childRunId === start.childRunId).map((entry) => entry.data);
+  const evidenceRow = currentRows.slice().reverse().find((data) => Object.hasOwn(data, 'childEvidence'));
+  const childEvidence = evidenceRow?.childEvidence && typeof evidenceRow.childEvidence === 'object' && !Array.isArray(evidenceRow.childEvidence)
+    ? evidenceRow.childEvidence as Record<string, unknown> : undefined;
+  const tailSource = Array.isArray(childEvidence?.podLogTail) && childEvidence.podLogTail.every((line) => typeof line === 'string')
+    ? childEvidence.podLogTail
+    : typeof childEvidence?.stderr === 'string' ? childEvidence.stderr.split(/\r?\n/) : undefined;
+  const childOutputTail = tailSource?.length
+    ? tailSource.slice(-3).map((line) => redactSecretText(line).slice(0, 200))
+    : 'unknown';
+  let termination: PodTermination | undefined;
+  for (const data of currentRows.slice().reverse()) {
+    termination = parsePodTermination(data.podTermination, start.job);
+    if (termination) break;
+  }
+  const finished = entries.slice(startIndex + 1).slice().reverse().find((entry) => {
+    if (entry.event !== 'pod-launch-finished' || entry.data.job !== start.job) return false;
+    const childRunId = typeof entry.data.childRun === 'string' ? entry.data.childRun : entry.data.run;
+    if (childRunId !== start.childRunId) return false;
+    const startAttempt = Number.isSafeInteger(start.attempt) && Number(start.attempt) > 0 ? Number(start.attempt) : undefined;
+    const finishAttempt = Number.isSafeInteger(entry.data.attempt) && Number(entry.data.attempt) > 0 ? Number(entry.data.attempt) : undefined;
+    return startAttempt === undefined || finishAttempt === startAttempt;
+  });
+  const classification = finished?.data.failureClassification;
+  const terminationReason = finished?.data.terminationReason;
+  const childRunDiagnosis = childRunDiagnosisFields(start.childRunId, root, {
+    job: start.job,
+    attempt: Number.isSafeInteger(start.attempt) && Number(start.attempt) > 0 ? Number(start.attempt) : undefined,
+    startedAt: startEntry?.timestamp,
+    finishedAt: finished?.timestamp,
+  });
+  return {
+    job: start.job,
+    childRunId: start.childRunId,
+    attempt: Number.isSafeInteger(start.attempt) && Number(start.attempt) > 0 ? Number(start.attempt) : 'unknown',
+    childOutputTail,
+    containerExitCode: typeof termination?.exitCode === 'number' ? termination.exitCode : 'unknown',
+    parentVerdict: row.reason,
+    failureClassification: typeof finished?.data.podExitClass === 'string' && finished.data.podExitClass
+      ? redactSecretText(finished.data.podExitClass).slice(0, 120)
+      : typeof classification === 'string' && classification ? redactSecretText(classification).slice(0, 120) : 'unknown',
+    terminationReason: typeof terminationReason === 'string' && terminationReason ? redactSecretText(terminationReason).slice(0, 200) : 'unknown',
+    childFailureStage: typeof finished?.data.childFailureStage === 'string' && finished.data.childFailureStage.trim()
+      ? redactSecretText(finished.data.childFailureStage).slice(0, 120) : 'unknown',
+    ...childRunDiagnosis,
+  };
+}
+
+function childRunDiagnosisFields(childRunId: string, root: string, current: {
+  job: string; attempt?: number; startedAt?: string; finishedAt?: string;
+}): Pick<NonNullable<RunExit['terminalEvidence']>, 'childRunStatus' | 'shardIdentityReadFailure' | 'providerFailure'> {
+  let entries: RunLedgerEntry[] | null;
+  try { entries = loadRunLedger(childRunId, runLedgerDir(root)); }
+  catch { entries = null; }
+  const startedAt = typeof current.startedAt === 'string' ? Date.parse(current.startedAt) : NaN;
+  const finishedAt = typeof current.finishedAt === 'string' ? Date.parse(current.finishedAt) : NaN;
+  if (!entries || !current.job.trim() || current.attempt === undefined
+    || !Number.isFinite(startedAt) || !Number.isFinite(finishedAt) || finishedAt < startedAt) return {
+    childRunStatus: { stage: 'unknown', status: 'unknown', failureKind: 'unknown' },
+    shardIdentityReadFailure: 'unknown', providerFailure: 'unknown',
+  };
+
+  // Child ledgers can outlive a Pod retry that reuses childRunId. Only trust events
+  // timestamped inside this parent's exact Job/attempt interval; otherwise report unknown.
+  const attemptEntries = entries.filter((entry) => {
+    const timestamp = typeof entry.timestamp === 'string' ? Date.parse(entry.timestamp) : NaN;
+    return Number.isFinite(timestamp) && timestamp >= startedAt && timestamp <= finishedAt;
+  });
+  const status = attemptEntries.slice().reverse().find((entry) => entry.event === 'run-status')?.data;
+  const shardObservation = attemptEntries.slice().reverse().find((entry) => Object.hasOwn(entry, 'shardIdentityReadFailure')
+    || entry.event === 'shard-sibling-query');
+  // RunLedgerEntry's canonical shard identity is top-level (makeRunObserver writes it there).
+  // Accept data.* too for older/imported child rows that nested the field.
+  const shardValue = shardObservation?.shardIdentityReadFailure ?? shardObservation?.data.shardIdentityReadFailure;
+  const shardFailure = typeof shardValue === 'string' && shardValue !== 'none' && shardValue !== 'unknown' && shardValue.trim()
+    ? shardValue : undefined;
+  const providerSkip = attemptEntries.slice().reverse().find((entry) => entry.event === 'goal-elaboration-skipped'
+    && entry.data.outcome === 'skipped' && entry.data.reason === 'provider-failed');
+  const providerError = typeof providerSkip?.data.error === 'string' ? providerSkip.data.error : '';
+  const providerFailure: NonNullable<RunExit['terminalEvidence']>['providerFailure'] = providerSkip
+    ? /unavailable:\s*configure apiKey/iu.test(providerError) ? 'credential-not-configured' : 'provider-failed'
+    : 'unknown';
+  const safe = (value: unknown): string | 'unknown' => typeof value === 'string' && value.trim()
+    ? redactSecretText(value).slice(0, 120) : 'unknown';
+  return {
+    childRunStatus: { stage: safe(status?.stage), status: safe(status?.runStatus), failureKind: safe(status?.failureKind) },
+    shardIdentityReadFailure: shardFailure ? redactSecretText(shardFailure).slice(0, 120)
+      : shardValue === 'unknown' ? 'unknown'
+        : shardObservation?.event === 'shard-sibling-query' && shardObservation.data.reason === 'not-sharded' ? 'none' : 'unknown',
+    providerFailure,
+  };
+}
+
 const HOSTNAME_BURST_WINDOW_MS = 60 * 60_000;
 
 function uniqueRunExits(rows: readonly RunExit[]): RunExit[] {

package/src/harness/harness-pod-dispatch.ts

@@ -27,6 +27,7 @@ import { podMemoryLimitFor, type PodMemoryTier } from '../task-orchestrator/surf
 import { oldDoorInternalEnv } from '../self-dev/old-door.js';
 import { selectPodMemoryTier } from './pod-memory-policy.js';
 import { preflightGoalDoneBoundary } from '../self-dev/dev-pipeline.js';
+import { forwardChildStderr } from '../surface/child-process.js';
 
 export interface HarnessPodDispatchInput {
   readonly entrance: 'cli-harness-ask' | 'cli-harness-say';
@@ -294,9 +295,14 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     goalChars, ...(input.entrance === 'cli-harness-ask' ? { goalPath: input.input } : {}),
   });
   const run = deps.run ?? ((cmd: string, a: readonly string[], childEnv: NodeJS.ProcessEnv) => new Promise<number>((resolveStatus) => {
-    const child = (deps.spawnChild ?? spawn)(cmd, [...a], { stdio: deps.onOutput ? ['inherit', 'pipe', 'inherit'] : 'inherit', env: childEnv });
+    const ownsOutput = Boolean(deps.onOutput);
+    const child = (deps.spawnChild ?? spawn)(cmd, [...a], {
+      stdio: ownsOutput ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+      env: childEnv,
+    });
     child.stdout?.setEncoding('utf8');
     child.stdout?.on('data', (chunk: string) => { process.stdout.write(chunk); deps.onOutput?.(chunk); });
+    if (ownsOutput) forwardChildStderr(child.stderr);
     let forwarded: NodeJS.Signals | undefined;
     const forward = (signal: NodeJS.Signals) => {
       forwarded = signal;

package/src/harness/harness-space.ts

@@ -25,7 +25,7 @@
 //    spaceId 선례와 동형. 계약 = [[DESIGN-executor-pty-ref-contract-2026-07-25]] ExecutorPtyRef.runId.
 
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdirSync } from 'node:fs';
+import { appendFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { ensureHostId } from '../platform/host-id.js';
@@ -101,6 +101,20 @@ export function getHarnessBoundaryPath(env: NodeJS.ProcessEnv = process.env): st
   return env[HARNESS_BOUNDARY_ENV]?.trim() ?? '';
 }
 
+/** TENANT-BOUNDARY (0.2.41): 경계 회신 mailbox(HARNESS_BOUNDARY_RESPONSES_ENV)에 payload 한 줄(JSONL)을
+ *  남긴다 — 익명 내보내기 전용 출구. env 가 비거나 절대경로가 아니면 fail-open(빈 문자열 반환, 파일 안 만듦). */
+export function appendBoundaryResponseLine(env: NodeJS.ProcessEnv, payload: object): string {
+  const path = env[HARNESS_BOUNDARY_RESPONSES_ENV]?.trim() ?? '';
+  if (!path || !isAbsolute(path)) return '';
+  try {
+    mkdirSync(resolve(path, '..'), { recursive: true });
+    appendFileSync(path, `${JSON.stringify(payload)}\n`);
+    return path;
+  } catch {
+    return '';
+  }
+}
+
 /** 전 공간 종류(SSOT) — logs `--space` 필터·검증 등이 공유. */
 export const HARNESS_SPACE_KINDS: readonly HarnessSpaceKind[] = ['self-implement', 'dev-harness', 'solve-mission', 'dev-hold'];
 

package/src/harness/progress-worker-entry.ts

@@ -0,0 +1,59 @@
+import { parentPort } from 'node:worker_threads';
+import { queryRunningRuns, type RunningRunsResult } from '../self-implement/running-runs.js';
+
+/**
+ * HARNESS-PROGRESS-HANG — `harness progress` 하위 조회의 «전용 워커 엔트리».
+ * 이 모듈은 CLI 디스패치(`src/index.ts`·`bin/elanous.mjs`)를 거치지 않고 워커에 직접 적재되므로,
+ * 번들·컴파일 산출물에서도 `parentPort` 핸들러가 반드시 이 스레드에 등록된다.
+ * 그 전에는 워커가 `import.meta.url` 로 배포 엔트리를 재진입해 핸들러가 아예 안 올랐다.
+ */
+export interface ProgressQueryWorkerRequest {
+  readonly kind?: 'query';
+  readonly caller: string;
+  readonly runIds?: readonly string[];
+  readonly timeBudgetMs?: number;
+}
+
+/** 상한 도달 뒤 부모가 보내는 정지 요청 — 워커는 «현재 행» 을 회신하고 정상 종료한다. */
+export interface ProgressQueryWorkerAbortRequest {
+  readonly kind: 'abort';
+}
+
+export type ProgressQueryWorkerMessage = ProgressQueryWorkerRequest | ProgressQueryWorkerAbortRequest;
+
+export interface ProgressQueryWorkerReply {
+  readonly ok: boolean;
+  readonly result?: RunningRunsResult;
+  readonly error?: string;
+  readonly stopped?: 'aborted';
+}
+
+/**
+ * 워커의 `parentPort` 핸들러를 등록한다.
+ * - `query`: 하위 조회를 실행해 결과를 회신한다.
+ * - `abort`: 이 스레드가 마지막으로 계산한 행(`lastResult`)을 «보존 행» 으로 회신한다 —
+ *   부모의 상한 뒤 유예 창 안에 도착하면 `progress-command-late` 관측으로 그대로 보존된다.
+ */
+export function installProgressWorkerEntry(port: NonNullable<typeof parentPort> | null | undefined = parentPort): void {
+  if (!port) return;
+  let lastResult: RunningRunsResult | undefined;
+  port.on('message', (message: ProgressQueryWorkerMessage) => {
+    if (message.kind === 'abort') {
+      port.postMessage({ ok: true, result: lastResult, stopped: 'aborted' } satisfies ProgressQueryWorkerReply);
+      return;
+    }
+    try {
+      const result = queryRunningRuns({
+        caller: message.caller,
+        ...(message.timeBudgetMs === undefined ? {} : { timeBudgetMs: message.timeBudgetMs }),
+        ...(message.runIds === undefined ? {} : { runIds: message.runIds }),
+      });
+      lastResult = result;
+      port.postMessage({ ok: true, result } satisfies ProgressQueryWorkerReply);
+    } catch (error) {
+      port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) } satisfies ProgressQueryWorkerReply);
+    }
+  });
+}
+
+installProgressWorkerEntry();

package/src/harness/progress-worker-runtime.ts

@@ -0,0 +1,11 @@
+import { isMainThread } from 'node:worker_threads';
+
+/**
+ * HARNESS-PROGRESS-HANG — `harness progress` 하위 조회는 «전용 워커 엔트리»(`./progress-worker-entry.ts`)
+ * 를 직접 적재한다. 그 엔트리는 CLI 디스패치를 거치지 않으므로 번들·컴파일 산출물에서도 `parentPort`
+ * 핸들러가 워커 스레드에 오른다. 이 판정은 배포 엔트리(`bin/elanous.mjs`)가 워커 문맥에서 재진입됐을 때
+ * 대시보드·provider 선택·명령 디스패치를 다시 걸지 않게 가드한다.
+ */
+export function shouldRunCliEntry(): boolean {
+  return isMainThread;
+}

package/src/index.ts

@@ -4739,6 +4739,7 @@ selfCmd
   .option('--shard-concurrency <number>', '동시에 실행할 조각 묶음 수 (1–4, 기본 3)')
   .option('--fixed-shard-distribution', '--shards N 과 함께만: RSS 사전 측정 없이 정렬된 파일을 N 조각에 라운드로빈 고정 배정한다(opt-in · 메모리 보증 아님 · 조각 타임아웃/OOM = unmeasured)')
   .option('--include-importers', '변경 모듈을 가져오는 importer 시험도 실행한다 (기본 caller 한도 밖까지)')
+  .option('--no-inherit', '이전 게이트 시험 영수증의 통과 시험을 상속하지 않고 전체 범위를 실행한다')
   .option('--remote [host]', 'GATE-REMOTE — 같은 커밋을 원격 호스트(기본 config gateRemote.host=node-b)에서 돌리고 결과만 가져온다(깨끗한 트리 · --pr 은 로컬)')
   .option('--local', '원격 실행을 끄고 명시적으로 로컬에서 돌린다')
   .option('--artifact-dir <dir>', '조각별 지금/기준 JUnit ⊕ summary.json 을 이 디렉토리에 남긴다(판정 불변 · JUnit 은 --shards 경로만 · 원격 실행이면 그 호스트에서 가져온다)')
@@ -4746,7 +4747,21 @@ selfCmd
   .option('--shard-id <id>', 'GATE-REMOTE-SHARD-PLAN — 조각 id(예: <orchestration-id>/shard-2). 원격 명령줄에 그대로 실린다')
   .option('--shard-position <n>', 'GATE-REMOTE-SHARD-PLAN — 조각 위치(1부터 정수). 원격 명령줄에 그대로 실린다')
   .option('--shard-plan <path>', 'GATE-REMOTE-SHARD-PLAN — 조각 계획 파일 경로. 주면 원격 명령줄에 --shard-plan 으로 실린다')
-  .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; shardConcurrency?: string; fixedShardDistribution?: boolean; includeImporters?: boolean; remote?: string | boolean; local?: boolean; artifactDir?: string; orchestrationId?: string; shardId?: string; shardPosition?: string; shardPlan?: string }) => {
+  .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; shardConcurrency?: string; fixedShardDistribution?: boolean; includeImporters?: boolean; inherit?: boolean; remote?: string | boolean; local?: boolean; artifactDir?: string; orchestrationId?: string; shardId?: string; shardPosition?: string; shardPlan?: string }) => {
+    const { observeSelfGateTrainMarker, refuseSeatSelfGateWithoutTrainMarker, writeSeatSelfGateRefusalArtifact } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
+    const trainMarker = observeSelfGateTrainMarker();
+    if (process.env.ELANOUS_TRACK) {
+      const seatRefusal = refuseSeatSelfGateWithoutTrainMarker(trainMarker);
+      if (seatRefusal) {
+        if (opts.artifactDir !== undefined) {
+          try { writeSeatSelfGateRefusalArtifact(process.cwd(), opts.artifactDir, trainMarker); }
+          catch (error) { ui.error(`self gate artifact: ${error instanceof Error ? error.message : String(error)}`); }
+        }
+        ui.error(seatRefusal.message);
+        process.exitCode = 2;
+        return;
+      }
+    }
     if (!opts.changed && opts.shards === undefined) { ui.error('self gate requires --changed or --shards'); process.exitCode = 2; return; }
     if (opts.fixedShardDistribution && opts.shards === undefined) { ui.error('self gate: --fixed-shard-distribution requires --shards <n>'); process.exitCode = 2; return; }
     if (opts.shardConcurrency !== undefined && (!/^[1-4]$/.test(opts.shardConcurrency))) { ui.error('self gate: --shard-concurrency must be 1–4'); process.exitCode = 2; return; }
@@ -4769,7 +4784,7 @@ selfCmd
       ranLocal = true;
       try {
         const { runSelfGateCliAsync } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
-        const result = await runSelfGateCliAsync(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.shardConcurrency !== undefined ? { shardConcurrency: Number(opts.shardConcurrency) } : {}), ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
+        const result = await runSelfGateCliAsync(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.shardConcurrency !== undefined ? { shardConcurrency: Number(opts.shardConcurrency) } : {}), ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, noInherit: opts.inherit === false, trainGate: trainMarker.received, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
         console.log(result.lines.join('\n'));
         return result.exitCode;
       } catch (error) {
@@ -4802,6 +4817,7 @@ selfCmd
         const argv = remoteSelfGateArgv({
           changed: opts.changed, base: opts.base, shards, shardConcurrency: opts.shardConcurrency === undefined ? undefined : Number(opts.shardConcurrency), fixedShardDistribution: opts.fixedShardDistribution,
           includeImporters: opts.includeImporters,
+          noInherit: opts.inherit === false,
           // A measured commit without this option rejects it (exit ≠ 0) — read as not passed, never as a silent measured run.
           artifactDir: remoteArtifacts && 'dir' in remoteArtifacts ? remoteArtifacts.dir : undefined,
         }, sha);
@@ -4852,6 +4868,8 @@ selfCmd
       const fetched = remoteArtifacts && 'dir' in remoteArtifacts ? remoteArtifacts.fetch : undefined;
       try {
         if (fetched?.ok) {
+          const { recordGateTrainMarker } = await import('./self-implement/gate-artifacts.js');
+          recordGateTrainMarker(fetched.summaryPath, trainMarker.received);
           console.log(`artifacts: ${fetched.summaryPath} (junit ${fetched.junitFiles.length} · fetched from remote)`);
           if (fetched.remoteDirKept) console.log(`⚠ artifacts: 원격 산출 디렉토리를 못 지웠다 — ${(remoteArtifacts as { dir: string }).dir} (판정은 그대로다)`);
         }
@@ -4859,7 +4877,7 @@ selfCmd
           const reason = remoteArtifacts && 'unsupported' in remoteArtifacts ? 'remote-unsupported' as const : 'remote-fetch-failed' as const;
           if (reason === 'remote-fetch-failed') console.log(`⚠ artifacts: 원격 산출을 못 가져왔다 — ${fetched && !fetched.ok ? fetched.reason : 'no remote fetch ran'} (판정은 그대로다)`);
           const { writeRemoteUnavailableGateArtifacts } = await import('./self-implement/gate-artifacts.js');
-          const written = writeRemoteUnavailableGateArtifacts(opts.artifactDir, process.cwd(), opts.base, Number(process.exitCode ?? 0), reason);
+          const written = writeRemoteUnavailableGateArtifacts(opts.artifactDir, process.cwd(), opts.base, Number(process.exitCode ?? 0), reason, undefined, undefined, trainMarker.received);
           console.log(`artifacts: ${written.summaryPath} (junit 0 · unavailable=${reason})`);
         }
       } catch (error) {
@@ -6277,10 +6295,12 @@ selfCmd
   .option('--acp-timeout <sec>', 'ACP 리뷰 1턴 최대 대기 초(초과 시 cancel·기본 claude 600 · 그 외 300)')
   .option('--context <path>', '리뷰어가 함께 판단할 레포 상대 파일 경로(반복 가능)', (value: string, previous: string[] = []) => [...previous, value])
   .option('--context-text <text>', '리뷰어가 함께 판단할 텍스트(반복 가능)', (value: string, previous: string[] = []) => [...previous, value])
+  .option('--no-context-pack', '기본 저장소 리뷰 맥락 팩을 끈다')
   .option('--json', '구조화 출력 {pr, verdict, mustFix, shouldFix, reviewed}')
   .option('--save <name>', '리뷰 결과를 상태 디렉터리의 review-results/<name>-<PR>-<head12>.json에 저장')
+  .option('--since-review <saved review name|head>', '저장된 리뷰의 mustFix와 해당 head 이후 변경만 다시 판정')
   .option('--over-cap-reason <reason>', '저장 리뷰 r5 상한 이후 이번 호출 1회 예외 사유(doctor.review cap-override 기록)')
-  .action(async (prParts: string[], opts: { intent?: string; model?: string; acp?: boolean; acpModel?: string; acpBackend?: string; acpTimeout?: string; context?: string[]; contextText?: string[]; json?: boolean; save?: string; overCapReason?: string }) => {
+  .action(async (prParts: string[], opts: { intent?: string; model?: string; acp?: boolean; acpModel?: string; acpBackend?: string; acpTimeout?: string; context?: string[]; contextText?: string[]; contextPack?: boolean; json?: boolean; save?: string; sinceReview?: string; overCapReason?: string }) => {
     const prArgs = prParts.flatMap((p) => String(p).split(/[,\s]+/).filter(Boolean)); // 번호/#번호/URL·콤마목록.
     if (!prArgs.length) { ui.error('PR 필요: elanous self review <번호|URL> [..]'); process.exit(2); }
     // ⭐ 본문은 seam(`runSelfReviewCliCommand`)에 있다 — 이 액션은 **의존 배선만** 한다.
@@ -6308,6 +6328,7 @@ selfCmd
     const configuredReviewModel = apiReviewModelFromRoleSpec(reviewRoleSpec);
     const { results, failed } = await runSelfReviewCliCommand(prArgs, {
       ...opts,
+      noContextPack: opts.contextPack === false,
       ...(configuredReviewModel ? { configuredReviewModel } : {}),
       ...(configuredReviewModel && reviewRoleSpec?.provider ? { configuredReviewProvider: reviewRoleSpec.provider } : {}),
       ...(configuredAcpBackend ? { configuredAcpBackend } : {}),
@@ -7058,7 +7079,16 @@ agentCmd
     //   runAgentMissionCliCommand(테스트 가능 seam)로 추출. 액션은 I/O(print/exit)만 담당.
     const { resolveBackend } = await import('./agent-mission/driver.js');
     const { runAgentMissionCliCommand } = await import('./agent-mission/mission-cli.js');
-    const outcome = await runAgentMissionCliCommand(textParts, opts as import('./agent-mission/mission-cli.js').MissionCliOpts, { resolveBackend });
+    const controller = new AbortController();
+    const onSigint = (): void => { controller.abort(); };
+    process.once('SIGINT', onSigint);
+    let outcome: Awaited<ReturnType<typeof runAgentMissionCliCommand>>;
+    try {
+      outcome = await runAgentMissionCliCommand(textParts, opts as import('./agent-mission/mission-cli.js').MissionCliOpts,
+        { resolveBackend, signal: controller.signal });
+    } finally {
+      process.removeListener('SIGINT', onSigint);
+    }
     if (!outcome.ok) { console.error(`❌ ${outcome.message}`); process.exit(outcome.exitCode); }
     await writeStdoutJson(JSON.stringify(outcome.result, null, 2) + '\n');
     process.exit(outcome.exitCode);