elanous 0.2.40 → 0.2.41

package/src/harness/harness-incidents.ts

@@ -1,10 +1,12 @@
 import { Database } from 'bun:sqlite';
+import { createHash } from 'node:crypto';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { redactSecretText } from '../debug/log.js';
 import { refuseProductionLedgerWriteInTest } from './ledger-write-guard.js';
 import type { PodChildEvidence } from '../task-orchestrator/surfaces/self-implement.js';
 import { parsePodTermination, type PodTermination } from '../task-orchestrator/surfaces/pod-failure-reason.js';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 
 export interface RunExit {
   runId: string;
@@ -21,6 +23,21 @@ export interface RunExit {
   childEvidence?: PodChildEvidence;
   /** JOB-FAILURE-TERMINATION-CAPTURE — the current attempt's Job/Pod termination facts, captured before GC. */
   podTermination?: PodTermination;
+  /** Current Pod attempt + bounded child output + container exit + parent verdict, joined under this runId. */
+  terminalEvidence?: {
+    job: string;
+    childRunId: string;
+    attempt: number | 'unknown';
+    childOutputTail: string[] | 'unknown';
+    containerExitCode: number | 'unknown';
+    parentVerdict: string;
+    failureClassification: string | 'unknown';
+    terminationReason: string | 'unknown';
+    childFailureStage: string | 'unknown';
+    childRunStatus: { stage: string | 'unknown'; status: string | 'unknown'; failureKind: string | 'unknown' };
+    shardIdentityReadFailure: string | 'none' | 'unknown';
+    providerFailure: 'credential-not-configured' | 'provider-failed' | 'none' | 'unknown';
+  };
   /** INCIDENT-REASON-FROM-LASTLINES — 기록된 reason 이 unknown 이라 lastLines 로 다시 분류했으면 원래 값. */
   recordedReason?: string;
   /** reason 을 어디서 얻었나 — 'lastLines' 면 위 분류 규칙으로 정했다(기록 원문은 recordedReason). */
@@ -40,12 +57,132 @@ export interface IncidentBurst {
   hostname?: string;
 }
 
+export type TcellHealthClass = 'healthy' | 'slow' | 'stalled' | 'infected' | 'zombie';
+
+/** A read-only health-card snapshot supplied to the guardian tick. Times are epoch milliseconds. */
+export interface TcellHealthCard {
+  runId: string;
+  stage: string;
+  startedAt: number;
+  progressAt: number | null;
+  stageBudgetMs: number;
+  heartbeatAt: number | null;
+  parentPresent: boolean;
+  leaseExpiresAt: number | null;
+  riskSignal: boolean;
+  stopClass?: string;
+  site?: string;
+  /** Stable signature tail, already bounded by the producer. Raw log tails are not accepted here. */
+  signatureTail?: string;
+  /** Deliberately excluded from cause grouping. */
+  hostname?: string;
+}
+
+export interface TcellHealthDecision {
+  runId: string;
+  stage: string;
+  classification: TcellHealthClass;
+  reason: 'heartbeat-missing' | 'parent-missing' | 'lease-expired' | 'risk-signal' | 'cause-quorum' | 'no-progress-30m' | 'over-stage-budget' | 'within-stage-budget';
+  causeGroupId?: string;
+  causeGroupSize?: number;
+}
+
+export interface TcellHealthClassification {
+  total: number;
+  measured: number;
+  unmeasuredRunIds: string[];
+  counts: Record<TcellHealthClass, number>;
+  decisions: TcellHealthDecision[];
+}
+
+const TCELL_STALLED_AFTER_MS = 30 * 60_000;
+const TCELL_CAUSE_QUORUM = 3;
+
+function tcellCauseGroupId(card: TcellHealthCard): string | undefined {
+  const stopClass = card.stopClass?.trim();
+  const site = card.site?.trim();
+  const signatureTail = card.signatureTail?.trim();
+  if (!stopClass || !site || !signatureTail) return undefined;
+  // Hash the exact stop.class + site + signature-tail tuple. Host is deliberately absent.
+  return createHash('sha256').update(JSON.stringify([stopClass, site, signatureTail])).digest('hex').slice(0, 16);
+}
+
+/** Pure shadow classification. Invalid/incomplete cards are reported as unmeasured, never as healthy or zombie. */
+export function classifyTcellHealthCards(cards: readonly TcellHealthCard[], now: number): TcellHealthClassification {
+  if (!Number.isFinite(now)) throw new RangeError('invalid T-cell patrol time');
+  const valid: TcellHealthCard[] = [];
+  const unmeasuredRunIds: string[] = [];
+  const seen = new Set<string>();
+  for (const card of cards) {
+    const measured = typeof card.runId === 'string' && !!card.runId.trim() && !seen.has(card.runId)
+      && typeof card.stage === 'string' && !!card.stage.trim()
+      && Number.isFinite(card.startedAt) && card.startedAt <= now
+      && (card.progressAt === null || (Number.isFinite(card.progressAt) && card.progressAt <= now))
+      && Number.isFinite(card.stageBudgetMs) && card.stageBudgetMs > 0
+      && (card.heartbeatAt === null || (Number.isFinite(card.heartbeatAt) && card.heartbeatAt <= now))
+      && typeof card.parentPresent === 'boolean'
+      && (card.leaseExpiresAt === null || Number.isFinite(card.leaseExpiresAt))
+      && typeof card.riskSignal === 'boolean';
+    if (!measured) {
+      if (typeof card.runId === 'string' && card.runId.trim()) unmeasuredRunIds.push(card.runId);
+      continue;
+    }
+    seen.add(card.runId);
+    valid.push(card);
+  }
+
+  const groups = new Map<string, Set<string>>();
+  for (const card of valid) {
+    const groupId = tcellCauseGroupId(card);
+    if (!groupId) continue;
+    const members = groups.get(groupId) ?? new Set<string>();
+    members.add(card.runId);
+    groups.set(groupId, members);
+  }
+
+  const counts: Record<TcellHealthClass, number> = { healthy: 0, slow: 0, stalled: 0, infected: 0, zombie: 0 };
+  const decisions = valid.map((card): TcellHealthDecision => {
+    const causeGroupId = tcellCauseGroupId(card);
+    const causeGroupSize = causeGroupId ? groups.get(causeGroupId)?.size : undefined;
+    const progressAge = now - (card.progressAt ?? card.startedAt);
+    let classification: TcellHealthClass;
+    let reason: TcellHealthDecision['reason'];
+    if (card.heartbeatAt === null) { classification = 'zombie'; reason = 'heartbeat-missing'; }
+    else if (!card.parentPresent) { classification = 'zombie'; reason = 'parent-missing'; }
+    else if (card.leaseExpiresAt === null || card.leaseExpiresAt <= now) { classification = 'zombie'; reason = 'lease-expired'; }
+    else if (card.riskSignal) { classification = 'infected'; reason = 'risk-signal'; }
+    else if ((causeGroupSize ?? 0) >= TCELL_CAUSE_QUORUM) { classification = 'infected'; reason = 'cause-quorum'; }
+    else if (progressAge >= TCELL_STALLED_AFTER_MS) { classification = 'stalled'; reason = 'no-progress-30m'; }
+    else if (progressAge > card.stageBudgetMs * 2) { classification = 'slow'; reason = 'over-stage-budget'; }
+    else { classification = 'healthy'; reason = 'within-stage-budget'; }
+    counts[classification] += 1;
+    return { runId: card.runId, stage: card.stage, classification, reason,
+      ...(causeGroupId ? { causeGroupId, causeGroupSize } : {}) };
+  });
+  return { total: cards.length, measured: valid.length, unmeasuredRunIds, counts, decisions };
+}
+
 /** Scrub before bounding: a token crossing the 200-character boundary must not leak. */
 export function incidentLastLines(output: string): string[] {
   return output.split(/\r?\n/).filter((line) => line.trim().length > 0).slice(-3)
     .map((line) => redactSecretText(line).slice(0, 200));
 }
 
+function safeChildEvidence(value: PodChildEvidence | undefined): PodChildEvidence | undefined {
+  if (!value) return undefined;
+  const safeText = (text: string): string => redactSecretText(text).slice(0, 200);
+  return {
+    ...value,
+    ...(typeof value.error === 'string' ? { error: safeText(value.error) } : {}),
+    ...(typeof value.detail === 'string' ? { detail: safeText(value.detail) } : {}),
+    ...(typeof value.stderr === 'string' ? { stderr: safeText(value.stderr) } : {}),
+    ...(typeof value.podLogUnavailable === 'string' ? { podLogUnavailable: safeText(value.podLogUnavailable) } : {}),
+    ...(Array.isArray(value.podLogTail) ? { podLogTail: value.podLogTail.slice(-3).map(safeText) } : {}),
+    ...(value.prFailure && typeof value.prFailure.errorTail === 'string'
+      ? { prFailure: { ...value.prFailure, errorTail: safeText(value.prFailure.errorTail) } } : {}),
+  };
+}
+
 const KST_OFFSET_MS = 9 * 60 * 60_000;
 const INCIDENT_FILE = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
 
@@ -55,9 +192,9 @@ function kstDate(at: number): string {
 
 // ── INCIDENT-REASON-FROM-LASTLINES (0.2.36 · 10-22 · OP 대응 피처) ───────────────────────────────
 // 기록된 reason 이 «unknown» 인데 마지막 출력 줄에 사유가 그대로 있는 사고가 다수(10-22 경보) — 읽는 쪽에서
-// 결정론으로 다시 분류한다. 우선순위 = 더 구체적인 종료 사유 먼저. 아무것도 안 맞으면 unknown 그대로(추측 0).
+// 결정론으로 다시 분류한다. 꼬리 전체에서 서로 다른 사유가 «정확히 하나» 일 때만 그 사유를 쓰고,
+// 0개(무증거)나 2개 이상(충돌)이면 unknown 그대로 둔다(추측 0). 표 순서는 «첫 매치 우선순위»가 아니다.
 const LAST_LINE_REASONS: ReadonlyArray<[RegExp, string]> = [
-  // 근본 원인 먼저 — 뒤 조각의 DEPENDENCY_NEEDS_HUMAN 은 앞 조각 실패의 «증상»이라 맨 뒤 쪽.
   [/goal-elaboration needs-human:\s*goal-elaboration-ungrounded-path\b/, 'goal-elaboration-ungrounded-path'],
   [/goal-elaboration needs-human:\s*goal-elaboration-protected-path\b/, 'goal-elaboration-protected-path'],
   [/goal-elaboration needs-human:\s*goal-elaboration-scope-conflict\b/, 'goal-elaboration-scope-conflict'],
@@ -72,12 +209,28 @@ const LAST_LINE_REASONS: ReadonlyArray<[RegExp, string]> = [
 ];
 const DEVICE_SLICE_PATH = /src\/ux-sim\/[\w.-]*-device(?:\.test)?\.ts|DEVICE-FIRST/;
 
-/** lastLines 에서 종료 사유를 꺼낸다 — 안 맞으면 null(unknown 유지). */
+// 한 사건을 두 이름으로 서술한 꼬리(상세 표지 ⊕ 일반 표지)는 충돌이 아니다 — 상세 표지가 일반 표지를 흡수한다.
+// 서로 다른 사건을 말하는 표지끼리만 충돌이다(예: GOAL_DONE_BOUNDARY_MISSING ⊕ DEPENDENCY_NEEDS_HUMAN).
+const REASON_ABSORBS: ReadonlyArray<readonly [string, readonly string[]]> = [
+  ['goal-elaboration-ungrounded-path', ['needs-human']],
+  ['goal-elaboration-protected-path', ['needs-human']],
+  ['goal-elaboration-scope-conflict', ['needs-human']],
+  ['goal-elaboration-fixed-layer-conflict', ['needs-human']],
+  ['goal-done-boundary-missing', ['needs-human']],
+  ['pod-backoff-limit', ['pod-job-failed']],
+  ['pod-child-no-result', ['pod-job-failed']],
+  ['dependency-needs-human', ['needs-human']],
+];
+
+/** lastLines 에서 종료 사유를 꺼낸다 — 무증거·충돌이면 null(unknown 유지). */
 export function classifyIncidentReasonFromLastLines(lines: readonly string[] | undefined): string | null {
   if (!lines?.length) return null;
   const text = lines.join('\n');
-  for (const [pattern, reason] of LAST_LINE_REASONS) if (pattern.test(text)) return reason;
-  return null;
+  const matched = LAST_LINE_REASONS.filter(([pattern]) => pattern.test(text)).map(([, reason]) => reason);
+  const distinct = [...new Set(matched)].filter(
+    (reason) => !REASON_ABSORBS.some(([specific, absorbed]) => specific !== reason && matched.includes(specific) && absorbed.includes(reason)),
+  );
+  return distinct.length === 1 ? (distinct[0] ?? null) : null;
 }
 
 function refinedReasonFields(reason: string, lines: readonly string[] | undefined): Pick<RunExit, 'reason' | 'recordedReason' | 'reasonSource' | 'slice'> {
@@ -126,12 +279,54 @@ export function readRunExits(root: string): RunExit[] {
         ...(row.childEvidence && typeof row.childEvidence === 'object' && !Array.isArray(row.childEvidence)
           ? { childEvidence: row.childEvidence } : {}),
         ...podTerminationField(row.podTermination),
+        ...terminalEvidenceField(row.terminalEvidence),
       });
     }
   }
   return rows.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
 }
 
+function terminalEvidenceField(value: unknown): { terminalEvidence?: RunExit['terminalEvidence'] } {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  const row = value as Record<string, unknown>;
+  const attempt = row.attempt;
+  const tail = row.childOutputTail;
+  const exitCode = row.containerExitCode;
+  if (typeof row.job !== 'string' || !row.job.trim() || typeof row.childRunId !== 'string' || !row.childRunId.trim()
+    || !(attempt === 'unknown' || (typeof attempt === 'number' && Number.isSafeInteger(attempt) && attempt > 0))
+    || !(tail === 'unknown' || (Array.isArray(tail) && tail.every((line) => typeof line === 'string')))
+    || !(exitCode === 'unknown' || (typeof exitCode === 'number' && Number.isSafeInteger(exitCode) && exitCode >= 0))
+    || typeof row.parentVerdict !== 'string'
+    || !(row.failureClassification === undefined || row.failureClassification === null || row.failureClassification === 'unknown' || typeof row.failureClassification === 'string')
+    || !(row.terminationReason === undefined || row.terminationReason === null || row.terminationReason === 'unknown' || typeof row.terminationReason === 'string')) return {};
+  const childOutputTail = tail === 'unknown' ? tail
+    : tail.slice(-3).map((line) => redactSecretText(line).slice(0, 200));
+  const failureClassification = row.failureClassification === undefined || row.failureClassification === null
+    ? 'unknown' : row.failureClassification === 'unknown' ? 'unknown' : redactSecretText(row.failureClassification).slice(0, 120);
+  const terminationReason = row.terminationReason === undefined || row.terminationReason === null
+    ? 'unknown' : row.terminationReason === 'unknown' ? 'unknown' : redactSecretText(row.terminationReason).slice(0, 200);
+  const childFailureStage = typeof row.childFailureStage === 'string' && row.childFailureStage.trim()
+    ? redactSecretText(row.childFailureStage).slice(0, 120) : 'unknown';
+  const childRunStatus = readChildRunStatus(row.childRunStatus);
+  const shardIdentityReadFailure = row.shardIdentityReadFailure === 'none' || row.shardIdentityReadFailure === 'unknown'
+    ? row.shardIdentityReadFailure
+    : typeof row.shardIdentityReadFailure === 'string' && row.shardIdentityReadFailure.trim()
+      ? redactSecretText(row.shardIdentityReadFailure).slice(0, 120) : 'unknown';
+  const providerFailure = row.providerFailure === 'credential-not-configured' || row.providerFailure === 'provider-failed'
+    || row.providerFailure === 'none' || row.providerFailure === 'unknown' ? row.providerFailure : 'unknown';
+  return { terminalEvidence: { job: row.job, childRunId: row.childRunId, attempt, childOutputTail,
+    containerExitCode: exitCode, parentVerdict: row.parentVerdict, failureClassification, terminationReason,
+    childFailureStage, childRunStatus, shardIdentityReadFailure, providerFailure } };
+}
+
+function readChildRunStatus(value: unknown): NonNullable<RunExit['terminalEvidence']>['childRunStatus'] {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return { stage: 'unknown', status: 'unknown', failureKind: 'unknown' };
+  const row = value as Record<string, unknown>;
+  const safe = (field: unknown): string | 'unknown' => typeof field === 'string' && field.trim()
+    ? redactSecretText(field).slice(0, 120) : 'unknown';
+  return { stage: safe(row.stage), status: safe(row.status), failureKind: safe(row.failureKind) };
+}
+
 function podTerminationField(value: unknown): { podTermination?: PodTermination } {
   const job = value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>).job : undefined;
   const parsed = typeof job === 'string' ? parsePodTermination(value, job) : undefined;
@@ -152,8 +347,12 @@ export function recordRunExit(row: RunExit, root: string): void {
     lock.exec('BEGIN IMMEDIATE');
     try {
       if (!readRunExits(root).some((record) => record.runId === row.runId)) {
-        const safeRow = row.lastLines === undefined ? row : {
-          ...row, lastLines: row.lastLines.slice(-3).map((line) => redactSecretText(line).slice(0, 200)),
+        const terminalEvidence = deriveTerminalEvidence(row, root);
+        const safeRow: RunExit = {
+          ...row,
+          ...(row.lastLines === undefined ? {} : { lastLines: row.lastLines.slice(-3).map((line) => redactSecretText(line).slice(0, 200)) }),
+          ...(row.childEvidence === undefined ? {} : { childEvidence: safeChildEvidence(row.childEvidence) }),
+          ...(terminalEvidence ? { terminalEvidence } : {}),
         };
         appendFileSync(join(dir, `${kstDate(at)}.jsonl`), `${JSON.stringify(safeRow)}\n`);
       }
@@ -167,6 +366,112 @@ export function recordRunExit(row: RunExit, root: string): void {
   }
 }
 
+/** Join exit facts through the last pod-child-run fence; never borrow a previous Pod attempt. */
+function deriveTerminalEvidence(row: RunExit, root: string): RunExit['terminalEvidence'] | undefined {
+  let entries: RunLedgerEntry[] | null;
+  try { entries = loadRunLedger(row.runId, runLedgerDir(root)); }
+  catch { return undefined; /* observing the child ledger cannot block the parent incident record */ }
+  if (!entries) return undefined;
+  let startIndex = -1;
+  entries.forEach((entry, index) => { if (entry.event === 'pod-child-run') startIndex = index; });
+  const startEntry = startIndex >= 0 ? entries[startIndex] : undefined;
+  const start = startEntry?.data;
+  if (!start || typeof start.job !== 'string' || !start.job.trim()
+    || typeof start.childRunId !== 'string' || !start.childRunId.trim()) return undefined;
+  const currentRows = entries.slice(startIndex + 1).filter((entry) => entry.event === 'pod-child-evidence'
+    && entry.data.job === start.job && entry.data.childRunId === start.childRunId).map((entry) => entry.data);
+  const evidenceRow = currentRows.slice().reverse().find((data) => Object.hasOwn(data, 'childEvidence'));
+  const childEvidence = evidenceRow?.childEvidence && typeof evidenceRow.childEvidence === 'object' && !Array.isArray(evidenceRow.childEvidence)
+    ? evidenceRow.childEvidence as Record<string, unknown> : undefined;
+  const tailSource = Array.isArray(childEvidence?.podLogTail) && childEvidence.podLogTail.every((line) => typeof line === 'string')
+    ? childEvidence.podLogTail
+    : typeof childEvidence?.stderr === 'string' ? childEvidence.stderr.split(/\r?\n/) : undefined;
+  const childOutputTail = tailSource?.length
+    ? tailSource.slice(-3).map((line) => redactSecretText(line).slice(0, 200))
+    : 'unknown';
+  let termination: PodTermination | undefined;
+  for (const data of currentRows.slice().reverse()) {
+    termination = parsePodTermination(data.podTermination, start.job);
+    if (termination) break;
+  }
+  const finished = entries.slice(startIndex + 1).slice().reverse().find((entry) => {
+    if (entry.event !== 'pod-launch-finished' || entry.data.job !== start.job) return false;
+    const childRunId = typeof entry.data.childRun === 'string' ? entry.data.childRun : entry.data.run;
+    if (childRunId !== start.childRunId) return false;
+    const startAttempt = Number.isSafeInteger(start.attempt) && Number(start.attempt) > 0 ? Number(start.attempt) : undefined;
+    const finishAttempt = Number.isSafeInteger(entry.data.attempt) && Number(entry.data.attempt) > 0 ? Number(entry.data.attempt) : undefined;
+    return startAttempt === undefined || finishAttempt === startAttempt;
+  });
+  const classification = finished?.data.failureClassification;
+  const terminationReason = finished?.data.terminationReason;
+  const childRunDiagnosis = childRunDiagnosisFields(start.childRunId, root, {
+    job: start.job,
+    attempt: Number.isSafeInteger(start.attempt) && Number(start.attempt) > 0 ? Number(start.attempt) : undefined,
+    startedAt: startEntry?.timestamp,
+    finishedAt: finished?.timestamp,
+  });
+  return {
+    job: start.job,
+    childRunId: start.childRunId,
+    attempt: Number.isSafeInteger(start.attempt) && Number(start.attempt) > 0 ? Number(start.attempt) : 'unknown',
+    childOutputTail,
+    containerExitCode: typeof termination?.exitCode === 'number' ? termination.exitCode : 'unknown',
+    parentVerdict: row.reason,
+    failureClassification: typeof finished?.data.podExitClass === 'string' && finished.data.podExitClass
+      ? redactSecretText(finished.data.podExitClass).slice(0, 120)
+      : typeof classification === 'string' && classification ? redactSecretText(classification).slice(0, 120) : 'unknown',
+    terminationReason: typeof terminationReason === 'string' && terminationReason ? redactSecretText(terminationReason).slice(0, 200) : 'unknown',
+    childFailureStage: typeof finished?.data.childFailureStage === 'string' && finished.data.childFailureStage.trim()
+      ? redactSecretText(finished.data.childFailureStage).slice(0, 120) : 'unknown',
+    ...childRunDiagnosis,
+  };
+}
+
+function childRunDiagnosisFields(childRunId: string, root: string, current: {
+  job: string; attempt?: number; startedAt?: string; finishedAt?: string;
+}): Pick<NonNullable<RunExit['terminalEvidence']>, 'childRunStatus' | 'shardIdentityReadFailure' | 'providerFailure'> {
+  let entries: RunLedgerEntry[] | null;
+  try { entries = loadRunLedger(childRunId, runLedgerDir(root)); }
+  catch { entries = null; }
+  const startedAt = typeof current.startedAt === 'string' ? Date.parse(current.startedAt) : NaN;
+  const finishedAt = typeof current.finishedAt === 'string' ? Date.parse(current.finishedAt) : NaN;
+  if (!entries || !current.job.trim() || current.attempt === undefined
+    || !Number.isFinite(startedAt) || !Number.isFinite(finishedAt) || finishedAt < startedAt) return {
+    childRunStatus: { stage: 'unknown', status: 'unknown', failureKind: 'unknown' },
+    shardIdentityReadFailure: 'unknown', providerFailure: 'unknown',
+  };
+
+  // Child ledgers can outlive a Pod retry that reuses childRunId. Only trust events
+  // timestamped inside this parent's exact Job/attempt interval; otherwise report unknown.
+  const attemptEntries = entries.filter((entry) => {
+    const timestamp = typeof entry.timestamp === 'string' ? Date.parse(entry.timestamp) : NaN;
+    return Number.isFinite(timestamp) && timestamp >= startedAt && timestamp <= finishedAt;
+  });
+  const status = attemptEntries.slice().reverse().find((entry) => entry.event === 'run-status')?.data;
+  const shardObservation = attemptEntries.slice().reverse().find((entry) => Object.hasOwn(entry, 'shardIdentityReadFailure')
+    || entry.event === 'shard-sibling-query');
+  // RunLedgerEntry's canonical shard identity is top-level (makeRunObserver writes it there).
+  // Accept data.* too for older/imported child rows that nested the field.
+  const shardValue = shardObservation?.shardIdentityReadFailure ?? shardObservation?.data.shardIdentityReadFailure;
+  const shardFailure = typeof shardValue === 'string' && shardValue !== 'none' && shardValue !== 'unknown' && shardValue.trim()
+    ? shardValue : undefined;
+  const providerSkip = attemptEntries.slice().reverse().find((entry) => entry.event === 'goal-elaboration-skipped'
+    && entry.data.outcome === 'skipped' && entry.data.reason === 'provider-failed');
+  const providerError = typeof providerSkip?.data.error === 'string' ? providerSkip.data.error : '';
+  const providerFailure: NonNullable<RunExit['terminalEvidence']>['providerFailure'] = providerSkip
+    ? /unavailable:\s*configure apiKey/iu.test(providerError) ? 'credential-not-configured' : 'provider-failed'
+    : 'unknown';
+  const safe = (value: unknown): string | 'unknown' => typeof value === 'string' && value.trim()
+    ? redactSecretText(value).slice(0, 120) : 'unknown';
+  return {
+    childRunStatus: { stage: safe(status?.stage), status: safe(status?.runStatus), failureKind: safe(status?.failureKind) },
+    shardIdentityReadFailure: shardFailure ? redactSecretText(shardFailure).slice(0, 120)
+      : shardValue === 'unknown' ? 'unknown'
+        : shardObservation?.event === 'shard-sibling-query' && shardObservation.data.reason === 'not-sharded' ? 'none' : 'unknown',
+    providerFailure,
+  };
+}
+
 const HOSTNAME_BURST_WINDOW_MS = 60 * 60_000;
 
 function uniqueRunExits(rows: readonly RunExit[]): RunExit[] {

package/src/harness/harness-space.ts

@@ -25,7 +25,7 @@
 //    spaceId 선례와 동형. 계약 = [[DESIGN-executor-pty-ref-contract-2026-07-25]] ExecutorPtyRef.runId.
 
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdirSync } from 'node:fs';
+import { appendFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { isAbsolute, relative, resolve } from 'node:path';
 import { ensureHostId } from '../platform/host-id.js';
@@ -101,6 +101,20 @@ export function getHarnessBoundaryPath(env: NodeJS.ProcessEnv = process.env): st
   return env[HARNESS_BOUNDARY_ENV]?.trim() ?? '';
 }
 
+/** TENANT-BOUNDARY (0.2.41): 경계 회신 mailbox(HARNESS_BOUNDARY_RESPONSES_ENV)에 payload 한 줄(JSONL)을
+ *  남긴다 — 익명 내보내기 전용 출구. env 가 비거나 절대경로가 아니면 fail-open(빈 문자열 반환, 파일 안 만듦). */
+export function appendBoundaryResponseLine(env: NodeJS.ProcessEnv, payload: object): string {
+  const path = env[HARNESS_BOUNDARY_RESPONSES_ENV]?.trim() ?? '';
+  if (!path || !isAbsolute(path)) return '';
+  try {
+    mkdirSync(resolve(path, '..'), { recursive: true });
+    appendFileSync(path, `${JSON.stringify(payload)}\n`);
+    return path;
+  } catch {
+    return '';
+  }
+}
+
 /** 전 공간 종류(SSOT) — logs `--space` 필터·검증 등이 공유. */
 export const HARNESS_SPACE_KINDS: readonly HarnessSpaceKind[] = ['self-implement', 'dev-harness', 'solve-mission', 'dev-hold'];
 

package/src/harness/progress-worker-entry.ts

@@ -0,0 +1,59 @@
+import { parentPort } from 'node:worker_threads';
+import { queryRunningRuns, type RunningRunsResult } from '../self-implement/running-runs.js';
+
+/**
+ * HARNESS-PROGRESS-HANG — `harness progress` 하위 조회의 «전용 워커 엔트리».
+ * 이 모듈은 CLI 디스패치(`src/index.ts`·`bin/elanous.mjs`)를 거치지 않고 워커에 직접 적재되므로,
+ * 번들·컴파일 산출물에서도 `parentPort` 핸들러가 반드시 이 스레드에 등록된다.
+ * 그 전에는 워커가 `import.meta.url` 로 배포 엔트리를 재진입해 핸들러가 아예 안 올랐다.
+ */
+export interface ProgressQueryWorkerRequest {
+  readonly kind?: 'query';
+  readonly caller: string;
+  readonly runIds?: readonly string[];
+  readonly timeBudgetMs?: number;
+}
+
+/** 상한 도달 뒤 부모가 보내는 정지 요청 — 워커는 «현재 행» 을 회신하고 정상 종료한다. */
+export interface ProgressQueryWorkerAbortRequest {
+  readonly kind: 'abort';
+}
+
+export type ProgressQueryWorkerMessage = ProgressQueryWorkerRequest | ProgressQueryWorkerAbortRequest;
+
+export interface ProgressQueryWorkerReply {
+  readonly ok: boolean;
+  readonly result?: RunningRunsResult;
+  readonly error?: string;
+  readonly stopped?: 'aborted';
+}
+
+/**
+ * 워커의 `parentPort` 핸들러를 등록한다.
+ * - `query`: 하위 조회를 실행해 결과를 회신한다.
+ * - `abort`: 이 스레드가 마지막으로 계산한 행(`lastResult`)을 «보존 행» 으로 회신한다 —
+ *   부모의 상한 뒤 유예 창 안에 도착하면 `progress-command-late` 관측으로 그대로 보존된다.
+ */
+export function installProgressWorkerEntry(port: NonNullable<typeof parentPort> | null | undefined = parentPort): void {
+  if (!port) return;
+  let lastResult: RunningRunsResult | undefined;
+  port.on('message', (message: ProgressQueryWorkerMessage) => {
+    if (message.kind === 'abort') {
+      port.postMessage({ ok: true, result: lastResult, stopped: 'aborted' } satisfies ProgressQueryWorkerReply);
+      return;
+    }
+    try {
+      const result = queryRunningRuns({
+        caller: message.caller,
+        ...(message.timeBudgetMs === undefined ? {} : { timeBudgetMs: message.timeBudgetMs }),
+        ...(message.runIds === undefined ? {} : { runIds: message.runIds }),
+      });
+      lastResult = result;
+      port.postMessage({ ok: true, result } satisfies ProgressQueryWorkerReply);
+    } catch (error) {
+      port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) } satisfies ProgressQueryWorkerReply);
+    }
+  });
+}
+
+installProgressWorkerEntry();

package/src/harness/progress-worker-runtime.ts

@@ -0,0 +1,11 @@
+import { isMainThread } from 'node:worker_threads';
+
+/**
+ * HARNESS-PROGRESS-HANG — `harness progress` 하위 조회는 «전용 워커 엔트리»(`./progress-worker-entry.ts`)
+ * 를 직접 적재한다. 그 엔트리는 CLI 디스패치를 거치지 않으므로 번들·컴파일 산출물에서도 `parentPort`
+ * 핸들러가 워커 스레드에 오른다. 이 판정은 배포 엔트리(`bin/elanous.mjs`)가 워커 문맥에서 재진입됐을 때
+ * 대시보드·provider 선택·명령 디스패치를 다시 걸지 않게 가드한다.
+ */
+export function shouldRunCliEntry(): boolean {
+  return isMainThread;
+}

package/src/index.ts

@@ -4748,6 +4748,20 @@ selfCmd
   .option('--shard-position <n>', 'GATE-REMOTE-SHARD-PLAN — 조각 위치(1부터 정수). 원격 명령줄에 그대로 실린다')
   .option('--shard-plan <path>', 'GATE-REMOTE-SHARD-PLAN — 조각 계획 파일 경로. 주면 원격 명령줄에 --shard-plan 으로 실린다')
   .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; shardConcurrency?: string; fixedShardDistribution?: boolean; includeImporters?: boolean; inherit?: boolean; remote?: string | boolean; local?: boolean; artifactDir?: string; orchestrationId?: string; shardId?: string; shardPosition?: string; shardPlan?: string }) => {
+    const { observeSelfGateTrainMarker, refuseSeatSelfGateWithoutTrainMarker, writeSeatSelfGateRefusalArtifact } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
+    const trainMarker = observeSelfGateTrainMarker();
+    if (process.env.ELANOUS_TRACK) {
+      const seatRefusal = refuseSeatSelfGateWithoutTrainMarker(trainMarker);
+      if (seatRefusal) {
+        if (opts.artifactDir !== undefined) {
+          try { writeSeatSelfGateRefusalArtifact(process.cwd(), opts.artifactDir, trainMarker); }
+          catch (error) { ui.error(`self gate artifact: ${error instanceof Error ? error.message : String(error)}`); }
+        }
+        ui.error(seatRefusal.message);
+        process.exitCode = 2;
+        return;
+      }
+    }
     if (!opts.changed && opts.shards === undefined) { ui.error('self gate requires --changed or --shards'); process.exitCode = 2; return; }
     if (opts.fixedShardDistribution && opts.shards === undefined) { ui.error('self gate: --fixed-shard-distribution requires --shards <n>'); process.exitCode = 2; return; }
     if (opts.shardConcurrency !== undefined && (!/^[1-4]$/.test(opts.shardConcurrency))) { ui.error('self gate: --shard-concurrency must be 1–4'); process.exitCode = 2; return; }
@@ -4770,7 +4784,7 @@ selfCmd
       ranLocal = true;
       try {
         const { runSelfGateCliAsync } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
-        const result = await runSelfGateCliAsync(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.shardConcurrency !== undefined ? { shardConcurrency: Number(opts.shardConcurrency) } : {}), ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, noInherit: opts.inherit === false, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
+        const result = await runSelfGateCliAsync(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.shardConcurrency !== undefined ? { shardConcurrency: Number(opts.shardConcurrency) } : {}), ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, noInherit: opts.inherit === false, trainGate: trainMarker.received, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
         console.log(result.lines.join('\n'));
         return result.exitCode;
       } catch (error) {
@@ -4854,6 +4868,8 @@ selfCmd
       const fetched = remoteArtifacts && 'dir' in remoteArtifacts ? remoteArtifacts.fetch : undefined;
       try {
         if (fetched?.ok) {
+          const { recordGateTrainMarker } = await import('./self-implement/gate-artifacts.js');
+          recordGateTrainMarker(fetched.summaryPath, trainMarker.received);
           console.log(`artifacts: ${fetched.summaryPath} (junit ${fetched.junitFiles.length} · fetched from remote)`);
           if (fetched.remoteDirKept) console.log(`⚠ artifacts: 원격 산출 디렉토리를 못 지웠다 — ${(remoteArtifacts as { dir: string }).dir} (판정은 그대로다)`);
         }
@@ -4861,7 +4877,7 @@ selfCmd
           const reason = remoteArtifacts && 'unsupported' in remoteArtifacts ? 'remote-unsupported' as const : 'remote-fetch-failed' as const;
           if (reason === 'remote-fetch-failed') console.log(`⚠ artifacts: 원격 산출을 못 가져왔다 — ${fetched && !fetched.ok ? fetched.reason : 'no remote fetch ran'} (판정은 그대로다)`);
           const { writeRemoteUnavailableGateArtifacts } = await import('./self-implement/gate-artifacts.js');
-          const written = writeRemoteUnavailableGateArtifacts(opts.artifactDir, process.cwd(), opts.base, Number(process.exitCode ?? 0), reason);
+          const written = writeRemoteUnavailableGateArtifacts(opts.artifactDir, process.cwd(), opts.base, Number(process.exitCode ?? 0), reason, undefined, undefined, trainMarker.received);
           console.log(`artifacts: ${written.summaryPath} (junit 0 · unavailable=${reason})`);
         }
       } catch (error) {

package/src/instance/dev-project.ts

@@ -3,10 +3,14 @@ import { createHash, randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { appendBoundaryResponseLine, HARNESS_BOUNDARY_RESPONSES_ENV } from '../harness/harness-space.js';
+import { anonymousExport, suggestProjectForFolder } from '../project/project-store.js';
 
 export interface DevProjectDeps {
   git?: (dir: string, args: readonly string[]) => string | null;
   stateDir?: string;
+  /** TENANT-BOUNDARY (0.2.41): 회신 mailbox 경계 채널용 env — 생산은 process.env 기본값. */
+  env?: Record<string, string | undefined>;
 }
 
 interface DevProjectRegistry {
@@ -60,9 +64,30 @@ export function resolveDevProject(dir: string, deps: DevProjectDeps = {}): strin
   try {
     writeJsonAtomically(join(root, '.elanous', 'project.json'), { identityKey, devProject: id } satisfies DevProjectCache);
   } catch { /* cache only */ }
+
+  exportTenantBoundaryRecord(root, id, deps.env ?? process.env);
   return id;
 }
 
+/**
+ * TENANT-BOUNDARY (0.2.41 · nfr:security): 고객 원장의 설치 밖 출구는 익명 내보내기 하나다.
+ * 경계 회신 mailbox(HARNESS_BOUNDARY_RESPONSES_ENV)가 열려 있을 때만, 고객 프로젝트 원장을
+ * `anonymousExport`(식별 필드 → 토큰)로 바꿔 한 줄(JSONL)로 남긴다. 원장 식별 원문은 절대
+ * 설치 밖으로 나가지 않는다. 채널이 없으면 아무 일도 일어나지 않고(기본 동작 보존),
+ * 채널 쓰기가 실패해도 id 해소를 막지 않는다(fail-open).
+ */
+function exportTenantBoundaryRecord(root: string, devProject: string, env: Record<string, string | undefined>): void {
+  const mailbox = env[HARNESS_BOUNDARY_RESPONSES_ENV]?.trim();
+  if (!mailbox) return;
+  try {
+    const project = suggestProjectForFolder(root);
+    appendBoundaryResponseLine(env as NodeJS.ProcessEnv, {
+      devProject,
+      ...(project ? { project: anonymousExport(project) } : {}),
+    });
+  } catch { /* boundary export must never block id resolution */ }
+}
+
 function runGit(dir: string, args: readonly string[]): string | null {
   try {
     return execFileSync('git', ['-C', dir, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });

package/src/intelligence-map/model-alias.ts

@@ -49,7 +49,7 @@ const MODEL_ALIASES: Readonly<Record<string, string>> = {
   'pro':             'gemini-3.1-pro-preview',
   'gemini-pro':      'gemini-3.1-pro-preview',
   // OpenAI / Codex
-  'codex':           'gpt-6-sol',   // ⭐ 2026-09-25: 운영 codex 기본(gpt-6-sol)과 맞춘다 — gpt-5.5 는 두 세대 낡았다
+  'codex':           'gpt-6.1-terra',
   'gpt-5':           'gpt-5.5',
   'mini':            'gpt-5-mini',
   'nano':            'gpt-5-nano',
@@ -57,15 +57,16 @@ const MODEL_ALIASES: Readonly<Record<string, string>> = {
   //   🔑 왜 — `sol`·`luna` 라는 «같은 이름»이 두 세대에 걸쳐 있다. 세대를 안 쓰면
   //     «어느 세대인지 말하지 않은 것»이고, 그때 골라야 할 것은 ***최신***이다.
   //     (실제로 이 겹침 때문에 커뮤니티 조사기가 5.6 과 6 을 섞어 답한 일이 있었다.)
-  //   ⛔ `terra` 는 GPT-6 에 «없다» — 중간 등급이 접혔고 GPT-6 Sol 이 그 가격대를 흡수했다.
-  //     그래서 `terra` 는 5.6 을 계속 가리킨다(은퇴가 아니라 «후속이 없는» 것이다).
+  //   GPT-6.1 restores a Terra tier; unsuffixed aliases follow the current 6.1 generation.
   //   📏 세대 확인 = `curl /v1/models` ⊕ `codex debug models` (2026-09-23 둘 다 실측).
   'astra':           'gpt-6-astra',
-  'sol':             'gpt-6-sol',
+  'sol':             'gpt-6.1-sol',
   'luna':            'gpt-6-luna',
-  'terra':           'gpt-5.6-terra',   // ⛔ GPT-6 에 후속 없음
+  'terra':           'gpt-6.1-terra',
   // 세대를 «명시»해 부르는 길 — 겹치는 이름을 또렷하게 가리킬 때.
   '6-sol':           'gpt-6-sol',
+  '6.1-sol':         'gpt-6.1-sol',
+  '6.1-terra':       'gpt-6.1-terra',
   '6-luna':          'gpt-6-luna',
   '5.6-sol':         'gpt-5.6-sol',
   '5.6-terra':       'gpt-5.6-terra',