elanous 0.2.41 → 0.2.42

package/scripts/release-loop/gate-pod-image-sticky-plan.ts

@@ -0,0 +1,99 @@
+interface StickyGatePool { id?: string | null; available: boolean; imageDigest: string | null }
+interface StickyGateShard { id?: string | null; files?: string[] | null }
+interface StickyGateReceipt { shardId: string; status: 'complete' | 'stalled'; pool?: string | null; imageDigest: string }
+interface StickyGateShardAction {
+  shardId: string; files: string[]; kind: 'reuse' | 'run' | 'unmeasured'; pool?: string; imageDigest?: string;
+}
+interface StickyGatePlan {
+  mode: 'full' | 'partial' | 'HOLD'; pinnedDigest: string | null; excludedPools: string[];
+  shards: StickyGateShardAction[]; reason?: string;
+}
+interface StickyGatePlanInput {
+  phase: 'start' | 'resume'; pools: readonly StickyGatePool[]; shards: readonly StickyGateShard[];
+  pinnedDigest?: string | null; receipts?: readonly StickyGateReceipt[];
+}
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/i;
+const validDigest = (value: string | null | undefined): value is string => typeof value === 'string' && DIGEST.test(value);
+const normalizeDigest = (value: string | null | undefined): string | null => validDigest(value) ? value.toLowerCase() : null;
+const validPoolIdentity = (value: string | null | undefined): value is string => typeof value === 'string' && value.trim().length > 0;
+
+function hold(input: StickyGatePlanInput, pinnedDigest: string | null, reason: string, excludedPools: string[] = []): StickyGatePlan {
+  return { mode: 'HOLD', pinnedDigest, excludedPools, reason,
+    shards: input.shards.map((shard, index) => ({
+      shardId: validPoolIdentity(shard?.id) ? shard.id : `unmeasured-${index}`,
+      files: Array.isArray(shard?.files) ? [...shard.files] : [], kind: 'unmeasured',
+    })) };
+}
+
+function isValidPool(pool: StickyGatePool | null | undefined): pool is StickyGatePool & { id: string } {
+  return !!pool && validPoolIdentity(pool.id);
+}
+
+function isValidShard(shard: StickyGateShard | null | undefined): shard is StickyGateShard & { id: string; files: string[] } {
+  return !!shard && validPoolIdentity(shard.id) && Array.isArray(shard.files) && shard.files.length > 0
+    && shard.files.every((file) => typeof file === 'string') && new Set(shard.files).size === shard.files.length;
+}
+
+/**
+ * Deterministic E4 planning simulation. A production caller must persist the chosen digest at run start
+ * and pass it unchanged on resume; this module itself never runs a host command or pulls an image.
+ */
+export function planStickyGateImages(input: StickyGatePlanInput): StickyGatePlan {
+  if (!input.shards.length || !input.pools.length) return hold(input, null, 'empty pool or shard inventory');
+  const pools = input.pools.filter(isValidPool);
+  const validShards = input.shards.filter(isValidShard);
+  if (pools.length !== input.pools.length || new Set(pools.map((pool) => pool.id)).size !== pools.length
+    || validShards.length !== input.shards.length || new Set(validShards.map((shard) => shard.id)).size !== validShards.length)
+    return hold(input, null, 'invalid pool or shard identity');
+
+  let pinnedDigest: string | null = null;
+  if (input.phase === 'resume') {
+    pinnedDigest = normalizeDigest(input.pinnedDigest);
+    if (!pinnedDigest) return hold(input, null, 'run image digest missing');
+  } else if (input.pinnedDigest !== undefined && input.pinnedDigest !== null) {
+    pinnedDigest = normalizeDigest(input.pinnedDigest);
+    if (!pinnedDigest) return hold(input, null, 'invalid pinned image digest');
+  } else {
+    pinnedDigest = pools.map((pool) => pool.available ? normalizeDigest(pool.imageDigest) : null)
+      .find((digest): digest is string => digest !== null) ?? null;
+    if (!pinnedDigest) return hold(input, null, 'no available pool has a valid image digest');
+  }
+
+  const excludedPools = pools.filter((pool) => !pool.available || normalizeDigest(pool.imageDigest) !== pinnedDigest)
+    .map((pool) => pool.id);
+  const eligiblePools = pools.filter((pool) => pool.available && normalizeDigest(pool.imageDigest) === pinnedDigest);
+  if (!eligiblePools.length) return hold(input, pinnedDigest, 'no available pool has the pinned digest', excludedPools);
+
+  const receipts = input.receipts ?? [];
+  const shardIds = new Set(validShards.map((shard) => shard.id));
+  if (receipts.some((receipt) => !shardIds.has(receipt.shardId))
+    || new Set(receipts.map((receipt) => receipt.shardId)).size !== receipts.length)
+    return hold(input, pinnedDigest, 'receipt inventory does not match the shard plan', excludedPools);
+
+  const receiptByShard = new Map(receipts.map((receipt) => [receipt.shardId, receipt]));
+  const completedReceipts = input.phase === 'resume' ? receipts.filter((receipt) => receipt.status === 'complete') : [];
+  const mismatchedCompleteDigest = completedReceipts.some((receipt) => normalizeDigest(receipt.imageDigest) !== pinnedDigest);
+  const missingCompletePool = completedReceipts.some((receipt) => !validPoolIdentity(receipt.pool));
+  const mixedCompleteReceipt = mismatchedCompleteDigest || missingCompletePool;
+  const fullSweep = input.phase === 'start' || mixedCompleteReceipt
+    || !validShards.some((shard) => receiptByShard.get(shard.id)?.status === 'complete');
+  const mode: StickyGatePlan['mode'] = fullSweep ? 'full' : 'partial';
+  const shards: StickyGateShardAction[] = [];
+  let nextPool = 0;
+  for (const shard of validShards) {
+    const receipt = receiptByShard.get(shard.id);
+    const canReuse = input.phase === 'resume' && !fullSweep && receipt?.status === 'complete'
+      && normalizeDigest(receipt.imageDigest) === pinnedDigest && validPoolIdentity(receipt.pool);
+    if (canReuse) {
+      shards.push({ shardId: shard.id, files: [...shard.files], kind: 'reuse', pool: receipt.pool ?? undefined, imageDigest: pinnedDigest });
+      continue;
+    }
+    const pool = eligiblePools[nextPool++ % eligiblePools.length]!;
+    shards.push({ shardId: shard.id, files: [...shard.files], kind: 'run', pool: pool.id, imageDigest: pinnedDigest });
+  }
+
+  return { mode, pinnedDigest, excludedPools, shards,
+    ...(mixedCompleteReceipt ? { reason: mismatchedCompleteDigest
+      ? 'completed receipts contain a different image digest' : 'completed receipt is missing pool identity' } : {}) };
+}

package/scripts/release-loop/gate-radius-live.ts

@@ -5,9 +5,10 @@ import { join } from 'node:path';
 import { changedFilesBetween, planPartialRegate, testFileOfId, type PartialPlan } from './gate-partial.js';
 import { CODE_FILE, gitClosureTree, testsReachingChanged } from './gate-closure.js';
 import { versionOnlyBumps } from './gate-radius-shadow.js';
-import { gateAssignableTestsAtCommit, gateBaselineReceipt, type GateBaselineReceipt } from './gate-baseline-receipt.js';
-import { parsePodPool, remoteImageId } from '../../src/task-orchestrator/surfaces/pod-pool.js';
+import { gateAssignableTestsAtCommit, gateBaselineReceipt, gateEnvFingerprint, type GateBaselineReceipt, type GatePodRuntimeIdentity } from './gate-baseline-receipt.js';
+import { defaultRemoteRun, NODE_REGISTRY, parsePodPool } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { podCommandImageFor } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
+import { gateTestBaseline } from '../lib/gate-test-env.js';
 import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
@@ -27,18 +28,91 @@ export function hardRehearsalGateArgs(version: string, runId: string, commit: st
 
 export interface LiveRadiusDecision { plan: PartialPlan | null; reason: string; rehearsalRunId?: string }
 
-/** Read the image ID on every candidate host before deciding. A later Job must still prove its actual image. */
-export function preflightGateImageDigest(pool: string): string | null {
+export interface GatePodExecutionIdentity extends GatePodRuntimeIdentity { imageDigest: string }
+
+const shellQuote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+
+/** Registry v2 manifest digest is the identity Kubernetes reports in containerStatuses.imageID. */
+export function parseGateRepoDigestResponse(headers: string): string | null {
+  const match = /^docker-content-digest:\s*(sha256:[0-9a-f]{64})\s*$/im.exec(headers);
+  return match?.[1]?.toLowerCase() ?? null;
+}
+
+export interface GateRepoDigestProbeRequest { url: string; acceptHeader: string; command: string }
+
+export function gateRepoDigestProbeRequest(registry: string, image: string, commit: string): GateRepoDigestProbeRequest | null {
+  const port = /:(\d+)$/.exec(registry)?.[1];
+  if (!port || !SHA.test(commit)) return null;
+  const imageName = image.startsWith('elanous-harness-lite:') ? 'elanous-harness-lite' : 'elanous-harness';
+  const tag = commit.slice(0, 12);
+  const url = `http://localhost:${port}/v2/${imageName}/manifests/${tag}`;
+  const accept = 'application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json';
+  const acceptHeader = `Accept: ${accept}`;
+  return { url, acceptHeader, command: `curl -fsS --max-time 8 -D - -o /dev/null -H ${shellQuote(acceptHeader)} ${shellQuote(url)}` };
+}
+
+function probeGateRepoDigest(member: ReturnType<typeof parsePodPool>[number], image: string, commit: string): string | null {
+  const registry = member.registry ?? NODE_REGISTRY;
+  const request = gateRepoDigestProbeRequest(registry, image, commit);
+  if (!request) return null;
+  const result = member.sshHost
+    ? defaultRemoteRun(member.sshHost, request.command)
+    : spawnSync('curl', ['-fsS', '--max-time', '8', '-D', '-', '-o', '/dev/null', '-H', request.acceptHeader, request.url],
+      { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  return result.status === 0 ? parseGateRepoDigestResponse(result.stdout) : null;
+}
+
+function gateRegistryHostImage(member: ReturnType<typeof parsePodPool>[number], image: string, commit: string): string | null {
+  const registry = member.registry ?? NODE_REGISTRY;
+  const port = /:(\d+)$/.exec(registry)?.[1];
+  if (!port) return null;
+  const imageName = image.startsWith('elanous-harness-lite:') ? 'elanous-harness-lite' : 'elanous-harness';
+  return `localhost:${port}/${imageName}:${commit.slice(0, 12)}`;
+}
+
+/** Read the immutable pushed image manifest on every candidate host. Local Docker Image IDs are diagnostic only. */
+export function preflightGateImageDigest(pool: string, commit?: string): string | null {
+  try {
+    if (!commit || !SHA.test(commit)) return null;
+    const image = podCommandImageFor([], true);
+    const members = parsePodPool(pool);
+    if (!members.length) return null;
+    const digests = members.map((member) => probeGateRepoDigest(member, image, commit));
+    return digests.every((digest) => digest && DIGEST.test(digest) && digest === digests[0]) ? digests[0]! : null;
+  } catch { return null; }
+}
+
+/** Probe each candidate's exact gate image/runtime and deterministic environment without a Kubernetes Job. */
+export function preflightGateExecutionIdentity(pool: string, env: NodeJS.ProcessEnv, commit?: string): GatePodExecutionIdentity | null {
   try {
+    if (!commit || !SHA.test(commit)) return null;
     const image = podCommandImageFor([], true);
     const members = parsePodPool(pool);
     if (!members.length) return null;
-    const ids = members.map((member) => {
-      if (member.sshHost) return remoteImageId(member, image);
-      const result = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
-      return result.status === 0 ? result.stdout.trim() : null;
+    const baseline = gateTestBaseline(env);
+    const expectedEnvFingerprint = gateEnvFingerprint(env);
+    const script = "const {createHash}=require('node:crypto');const keys=['ELANOUS_TEST_FAKE_LLM','LANG','LC_ALL','TZ'];const e=Object.fromEntries(keys.sort().map(k=>[k,process.env[k]??'']));const envFingerprint=createHash('sha256').update(JSON.stringify(e)).digest('hex');console.log(JSON.stringify({bunVersion:Bun.version,platform:process.platform,architecture:process.arch,envFingerprint}));";
+    const rows = members.map((member): GatePodExecutionIdentity | null => {
+      const imageDigest = probeGateRepoDigest(member, image, commit);
+      if (!imageDigest || !DIGEST.test(imageDigest)) return null;
+      const hostImage = gateRegistryHostImage(member, image, commit);
+      if (!hostImage) return null;
+      const args = ['run', '--rm', '--pull=never', '--network=none', ...Object.entries(baseline).flatMap(([key, value]) => ['-e', `${key}=${value}`]), '--entrypoint', 'bun', hostImage, '-e', script];
+      const result = member.sshHost
+        ? defaultRemoteRun(member.sshHost, `docker ${args.map(shellQuote).join(' ')}`)
+        : spawnSync('docker', args, { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (result.status !== 0) return null;
+      try {
+        const row = JSON.parse(result.stdout.trim()) as Partial<GatePodRuntimeIdentity>;
+        if (typeof row.bunVersion !== 'string' || typeof row.platform !== 'string' || typeof row.architecture !== 'string'
+          || row.envFingerprint !== expectedEnvFingerprint) return null;
+        return { imageDigest, bunVersion: row.bunVersion, platform: row.platform, architecture: row.architecture,
+          envFingerprint: row.envFingerprint };
+      } catch { return null; }
     });
-    return ids.every((id) => id && DIGEST.test(id) && id === ids[0]) ? ids[0]! : null;
+    if (rows.some((row) => row === null)) return null;
+    const first = rows[0]!;
+    return rows.every((row) => JSON.stringify(row) === JSON.stringify(first)) ? first : null;
   } catch { return null; }
 }
 
@@ -82,10 +156,15 @@ export function partialGateImagesMatch(root: string, version: string, digest: st
 /** Every missing or mismatched proof returns a full gate. The caller uses this only when no explicit resume plan exists. */
 export function planHardRehearsalRadius(input: { root: string; repo: string; version: string; forCommit: string;
   graphPins: { graphSha: string; recipeSha: string } | null; envFingerprint: string;
-  imageDigest: string | null }): LiveRadiusDecision {
+  imageDigest: string | null; executionIdentity: GatePodExecutionIdentity | null }): LiveRadiusDecision {
   const full = (reason: string): LiveRadiusDecision => ({ plan: null, reason });
   if (!/^\d+\.\d+\.\d+$/.test(input.version) || !SHA.test(input.forCommit)) return full('invalid release identity');
-  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest))
+  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest)
+    || !input.executionIdentity || input.executionIdentity.imageDigest !== input.imageDigest.toLowerCase()
+    || input.executionIdentity.envFingerprint !== input.envFingerprint
+    || !/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/.test(input.executionIdentity.bunVersion)
+    || !/^[a-z0-9_-]{1,32}$/.test(input.executionIdentity.platform)
+    || !/^[a-z0-9_-]{1,32}$/.test(input.executionIdentity.architecture))
     return full('current graph, environment or Pod image identity unmeasured');
   try {
     const stamps = ['hard-5h', 'hard-mid'].map((step) => {
@@ -118,14 +197,19 @@ export function planHardRehearsalRadius(input: { root: string; repo: string; ver
       if (verdict.commit !== stamp.sha || verdict.outcome !== 'ok' || failures.commit !== stamp.sha
         || !Array.isArray(failures.failures) || failures.failures.length !== 0
         || !Array.isArray(failures.errors) || failures.errors.length !== 0
-        || !receipt || receipt.schema !== 1 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
+        || !receipt || receipt.schema !== 2 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
         || receipt.graphSha !== input.graphPins.graphSha || receipt.recipeSha !== input.graphPins.recipeSha
         || receipt.envFingerprint !== input.envFingerprint || receipt.imageDigest !== input.imageDigest.toLowerCase()
+        || !receipt.executionIdentity
+        || JSON.stringify(receipt.executionIdentity) !== JSON.stringify({ bunVersion: input.executionIdentity.bunVersion,
+          platform: input.executionIdentity.platform, architecture: input.executionIdentity.architecture,
+          envFingerprint: input.executionIdentity.envFingerprint })
         || !Number.isSafeInteger(receipt.files) || receipt.files < 1 || !Number.isSafeInteger(receipt.shards) || receipt.shards < 1)
         return full('hard rehearsal receipt or current execution identity differs');
       const recomputed = gateBaselineReceipt({ root: input.root, version: gateVersion, commit: stamp.sha,
         fullSweep: true, graphPins: input.graphPins, envFingerprint: input.envFingerprint });
-      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest || recomputed.files !== receipt.files
+      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest
+        || JSON.stringify(recomputed.executionIdentity) !== JSON.stringify(receipt.executionIdentity) || recomputed.files !== receipt.files
         || recomputed.shards !== receipt.shards) return full(`hard rehearsal Pod proof differs: ${recomputed.reason}`);
       const ancestor = spawnSync('git', ['merge-base', '--is-ancestor', stamp.sha, input.forCommit], { cwd: input.repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
       if (ancestor.status !== 0 || ancestor.error) return full('hard rehearsal commit is not an ancestor');

package/scripts/release-loop/gate-shard-dispatch.ts

@@ -29,6 +29,49 @@ export interface GateShardHost {
   reserved: boolean;
 }
 
+export type GateProgressState = 'pending' | 'running' | 'done' | 'failed' | 'timeout' | 'unmeasured';
+
+/** A host group or planned Pod shard as seen by the release gate's live progress observer. */
+export interface GateProgressGroup {
+  id: string;
+  state: GateProgressState;
+  host?: string;
+  startedAtMs?: number;
+  endedAtMs?: number;
+}
+
+export interface GateProgressSummary {
+  executor: 'host' | 'pod';
+  host: string | null;
+  completed: number;
+  total: number;
+  failed: number;
+  groups: Array<{ id: string; state: GateProgressState; host: string | null; elapsedMs: number | null }>;
+}
+
+/** Keep the progress event shape identical for serial host groups and parallel Pod shards. */
+export function summarizeGateProgress(input: {
+  executor: 'host' | 'pod';
+  groups: readonly GateProgressGroup[];
+  nowMs: number;
+}): GateProgressSummary {
+  const terminal = new Set<GateProgressState>(['done', 'failed', 'timeout', 'unmeasured']);
+  const hosts = [...new Set(input.groups.flatMap((group) => group.host?.trim() ? [group.host.trim()] : []))].sort();
+  return {
+    executor: input.executor,
+    host: hosts.length ? hosts.join(',') : null,
+    completed: input.groups.filter((group) => terminal.has(group.state)).length,
+    total: input.groups.length,
+    failed: input.groups.filter((group) => group.state === 'failed' || group.state === 'timeout').length,
+    groups: input.groups.map((group) => {
+      const end = group.endedAtMs ?? input.nowMs;
+      const elapsedMs = Number.isFinite(group.startedAtMs) && Number.isFinite(end)
+        ? Math.max(0, end - group.startedAtMs!) : null;
+      return { id: group.id, state: group.state, host: group.host?.trim() || null, elapsedMs };
+    }),
+  };
+}
+
 export interface GateShardDispatchInput {
   head40: string;
   base40: string;

package/scripts/release-loop/gate-train-receipts.ts

@@ -0,0 +1,122 @@
+/** Safe test carry from passed host-regate receipts into a release cut. */
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { gateAssignableTestsAtCommit } from './gate-baseline-receipt.js';
+import { gitClosureTree, testsReachingChanged } from './gate-closure.js';
+import { changedFilesBetween } from './gate-partial.js';
+import { gateReceiptSelfKey, loadGateReceipts, type GateReceipt } from '../../src/self-implement/gate-receipt-registry.js';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const TEST = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
+const INERT = /\.(?:md|mdx|txt)$/i;
+
+function git(repo: string, args: string[]): string | null {
+  const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+  return result.status === 0 && !result.error ? result.stdout.trim() : null;
+}
+
+function ancestor(repo: string, base: string, head: string): boolean {
+  const result = spawnSync('git', ['merge-base', '--is-ancestor', base, head], { cwd: repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  return result.status === 0 && !result.error;
+}
+
+function blob(repo: string, commit: string, file: string): string | null {
+  return git(repo, ['rev-parse', `${commit}:${file}`]);
+}
+
+function candidateTests(tree: ReturnType<typeof gitClosureTree>, receipt: GateReceipt): string[] {
+  // The registry stores the changed-file radius, not the expanded importer/neighbor list that the
+  // host gate selected. Only changed test files are certainly in that measurement; never infer
+  // pass evidence for siblings or importers that the receipt did not persist explicitly.
+  return [...new Set(receipt.radiusFiles.filter((file) => TEST.test(file) && tree.files.includes(file)))].sort();
+}
+
+export interface GateTrainReceiptPlan {
+  priorCommit: string;
+  files: string[];
+  carriedFiles: string[];
+  totalFiles: number;
+  reasons: string[];
+  receipts: string[];
+}
+
+/** Missing/invalid evidence only reduces carry; it never makes a gate pass. */
+export function planGateTrainReceiptCarry(input: {
+  repo: string;
+  commit: string;
+  receiptPath: string;
+  bunVersion: string;
+  lockfileHash: string;
+  envFingerprint: string;
+}): GateTrainReceiptPlan | null {
+  if (!SHA.test(input.commit) || !input.bunVersion || !input.lockfileHash || !/^[0-9a-f]{64}$/i.test(input.envFingerprint)) return null;
+  const tests = gateAssignableTestsAtCommit(input.repo, input.commit);
+  if (!tests?.length) return null;
+  const receipts = Object.values(loadGateReceipts(input.receiptPath));
+  const currentTree = gitClosureTree(input.repo, input.commit);
+  const carried = new Set<string>();
+  const accepted: GateReceipt[] = [];
+  const reasons = new Set<string>();
+  const changedByBase = new Map<string, string[]>();
+
+  for (const receipt of receipts) {
+    if (receipt.verdict !== 'passed' || gateReceiptSelfKey(receipt) !== receipt.key) { reasons.add('invalid-or-non-passing receipt'); continue; }
+    if (!receipt.checks.some((check) => check === 'test-interference:with-neighbours' || check === 'test-interference:changed-only')) {
+      reasons.add('receipt lacks passing test-interference check'); continue;
+    }
+    if (receipt.bunVersion !== input.bunVersion || receipt.lockfileHash !== input.lockfileHash
+      || receipt.envFingerprint !== input.envFingerprint) { reasons.add('bun/lockfile/environment differs'); continue; }
+    if (!ancestor(input.repo, receipt.baseCommit, input.commit)) { reasons.add('receipt base is not an ancestor of cut'); continue; }
+    if (receipt.radiusFiles.some((file) => !currentTree.files.includes(file)
+      || blob(input.repo, receipt.headCommit, file) !== blob(input.repo, input.commit, file))) {
+      reasons.add('receipt radius changed or missing at cut'); continue;
+    }
+    let measuredChanges: string[];
+    try { measuredChanges = changedFilesBetween(input.repo, receipt.baseCommit, receipt.headCommit); }
+    catch { reasons.add('receipt base-to-head diff unavailable'); continue; }
+    if (measuredChanges.some((file) => !receipt.radiusFiles.includes(file))) {
+      reasons.add('receipt radius does not cover base-to-head changes'); continue;
+    }
+    const candidates = candidateTests(currentTree, receipt);
+    if (!candidates?.length) { reasons.add('receipt test radius is empty or opaque'); continue; }
+
+    let changed: string[];
+    try {
+      changed = changedByBase.get(receipt.baseCommit) ?? changedFilesBetween(input.repo, receipt.baseCommit, input.commit);
+      changedByBase.set(receipt.baseCommit, changed);
+    } catch { reasons.add('cut diff from receipt base unavailable'); continue; }
+    const outside = changed.filter((file) => !receipt.radiusFiles.includes(file) && !INERT.test(file));
+    const nonCodeOutside = outside.find((file) => !/\.(?:[cm]?[jt]sx?)$/.test(file));
+    if (nonCodeOutside) {
+      reasons.add(`non-code release input changed outside receipt radius: ${nonCodeOutside}`); continue;
+    }
+    let safeCandidates = candidates;
+    if (outside.length) {
+      const affected = testsReachingChanged(currentTree, outside, candidates);
+      if (!affected.ok) { reasons.add('cut import closure opaque'); continue; }
+      const affectedSet = new Set(affected.tests);
+      safeCandidates = candidates.filter((test) => !affectedSet.has(test));
+      if (!safeCandidates.length) { reasons.add('merge-skew changes reach every receipt test'); continue; }
+    }
+    for (const test of safeCandidates) carried.add(test);
+    accepted.push(receipt);
+  }
+
+  const noCarry = (reason: string): GateTrainReceiptPlan => ({ priorCommit: accepted[0]?.baseCommit ?? input.commit,
+    files: [...tests], carriedFiles: [], totalFiles: tests.length,
+    reasons: [...new Set([...reasons, ...(reason === 'no safe receipt coverage' && reasons.size ? [] : [reason])])].sort(),
+    receipts: accepted.map((receipt) => receipt.key).sort() });
+  if (!carried.size || !accepted.length) return noCarry(receipts.length ? 'no safe receipt coverage' : 'gate receipt registry empty');
+  const selected = tests.filter((file) => !carried.has(file));
+  // The caller falls back to a full sweep rather than skipping all test Pods.
+  if (!selected.length) return noCarry('all tests carried; keep at least one measured sweep');
+  const latest = [...accepted].sort((a, b) => b.savedAt.localeCompare(a.savedAt))[0]!;
+  return { priorCommit: latest.baseCommit, files: selected, carriedFiles: [...carried].sort(), totalFiles: tests.length,
+    reasons: [...reasons].sort(), receipts: accepted.map((receipt) => receipt.key).sort() };
+}
+
+export function gateReceiptRegistryPath(repo: string): string | null {
+  const common = git(repo, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+  return common ? join(common, 'elanous-host-regate', 'gate-receipts.json') : null;
+}

package/scripts/release-loop/resume-release.ts

@@ -22,6 +22,7 @@ import { reserveReleaseResumeAttempt } from './resume-cap.js';
 import { cutReleaseBranch } from './cut-branch.js';
 import { releaseLoopConfig } from './unattended-release.js';
 import { trafficOptionsFromConfig } from './traffic-transition.js';
+import type { GateAutohealDecision } from './gate-autoheal.js';
 
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
@@ -67,9 +68,36 @@ export interface ResumeReleaseOptions {
 export interface ResumeReleasePlan {
   runId: string; version: string; fromNode: string; commandRoot: string; tip: TipRefresh;
   partial: PartialOutcome; gatePlan: { mode: 'not-run' | 'partial' | 'full'; reason?: string };
+  /** Most recent failed gate's autoheal recommendation, carried into the resume plan for the caller. */
+  autoheal?: GateAutohealDecision;
+  autohealReroute?: string;
   nextAttempt: number; priorCountKnown: boolean; preflight: 'passed';
 }
 
+function priorGateAutoheal(run: GraphRunState): GateAutohealDecision | undefined {
+  const gate = lastJsonObject(run.nodes.find((node) => node.nodeId === 'gate')?.output);
+  const value = gate?.autoheal;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const candidate = value as Partial<GateAutohealDecision>;
+  if (!['reroute-shard', 'retry-shard', 'partial-resume', 'host-switch', 'hitl'].includes(String(candidate.action))) return undefined;
+  if (!['shard-pod-death', 'timeout', 'host-down', 'interference', 'true-regression', 'environment'].includes(String(candidate.cause))) return undefined;
+  if (typeof candidate.signature !== 'string' || typeof candidate.reason !== 'string'
+    || typeof candidate.shardElapsedMs !== 'number' || typeof candidate.overallElapsedMs !== 'number') return undefined;
+  return candidate as GateAutohealDecision;
+}
+
+function automaticReroute(run: GraphRunState, autoheal: GateAutohealDecision | undefined, tipChanged: boolean, from: string): string | undefined {
+  if (!autoheal || tipChanged || from !== 'gate' || typeof (run.input as Record<string, unknown> | undefined)?.gatePodPool !== 'string'
+    || (autoheal.action !== 'retry-shard' && autoheal.action !== 'reroute-shard' && autoheal.action !== 'host-switch')) return undefined;
+  const key = autoheal.shardKey;
+  if (autoheal?.action === 'host-switch') return 'auto';
+  if (typeof key === 'string' && /^pod-\d+$/.test(key)) return key;
+  if (typeof key === 'string' && /^\d+$/.test(key)) return `pod-${key}`;
+  const gate = lastJsonObject(run.nodes.find((node) => node.nodeId === 'gate')?.output);
+  const stalled = gate?.stalledShards;
+  return Array.isArray(stalled) && stalled.length > 0 ? 'auto' : undefined;
+}
+
 /** CLI entry files: a production file that only names one (help text, a goal's command line) does not run it. */
 const CLI_ENTRIES = ['bin/elanous.mjs', 'src/index.ts'] as const;
 /** The gate's own test-file set (gate-node sweep: `git ls-files '*.test.*'` filtered by this). */
@@ -428,6 +456,42 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     const saved = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
     const gateRecord = saved.nodes.find((node) => node.nodeId === 'gate');
     const previousGate = gateRecord ? lastJsonObject(gateRecord.output) as Record<string, unknown> | undefined : undefined;
+    // `loadFlaky` is also a partial-resume cause, but it is emitted separately from
+    // shard-only interference. Carry both sets into the same affected-file recheck.
+    const interference = [...new Set([
+      ...(Array.isArray(previousGate?.interferenceErrors) ? previousGate.interferenceErrors : []),
+      ...(Array.isArray(previousGate?.loadFlaky) ? previousGate.loadFlaky : []),
+    ])];
+    if (previousGate?.outcome === 'error' && previousGate.commit === tip.to && previousGate.autoheal
+      && typeof previousGate.autoheal === 'object' && (previousGate.autoheal as { action?: unknown }).action === 'partial-resume') {
+      if (!Array.isArray(interference) || !interference.length || !interference.every((id) => typeof id === 'string'))
+        return fallback('partial-resume has no complete interference error record');
+      let closure: ClosureTree;
+      try { closure = (deps.closureTree ?? ((commit: string) => gitClosureTree(deps.repo ?? process.cwd(), commit)))(tip.to); }
+      catch (error) { return fallback(`tip tree unreadable: ${String(error instanceof Error ? error.message : error).slice(0, 200)}`); }
+      const tracked = new Set(closure.files);
+      const planned = planSameCommitRecheck({ version: tip.version, measuredCommit: tip.to, forCommit: tip.to,
+        failures: [], errors: interference as string[], existsAtCommit: (file) => tracked.has(file) });
+      if (!planned.ok) return fallback(planned.reason);
+      // The gate consumer only executes same-cut partial work for the stalled-only recheck shape.
+      // Interference files are likewise unmeasured, so mark exactly this set as the recheck boundary.
+      const partialFailures = previousGate.partialFailures as { failures?: unknown; errors?: unknown } | undefined;
+      if (!Array.isArray(partialFailures?.failures) || !partialFailures.failures.every((id) => typeof id === 'string')
+        || !Array.isArray(partialFailures.errors) || !partialFailures.errors.every((id) => typeof id === 'string'))
+        return fallback('partial-resume has no complete prior failure record');
+      let priorFailures: string[];
+      let priorErrors: string[];
+      try {
+        const affected = new Set(planned.plan.files);
+        priorFailures = (partialFailures.failures as string[]).filter((id) => !affected.has(testFileOfId(id)));
+        priorErrors = (partialFailures.errors as string[]).filter((id) => !affected.has(testFileOfId(id)));
+      } catch { return fallback('partial-resume prior failure record is malformed'); }
+      const recheckPlan = { ...planned.plan, priorFailures, priorErrors, stalledFiles: planned.plan.files };
+      const path = dryRun ? undefined : writeRecheckPlan(root, recheckPlan);
+      debug.log('release-loop.resume', 'interference-recheck-planned', { version: tip.version, commit: tip.to,
+        remeasureFileCount: recheckPlan.files.length, fallbackReason: null, ...(path ? { path } : {}), dryRun });
+      return { requested: true, applied: true, files: recheckPlan.files.length, priorCommit: tip.to, ...(auto ? { auto: true as const } : {}) };
+    }
     const stalled = previousGate?.stalledShards;
     const summary = previousGate?.partialSummary as { pass?: unknown; fail?: unknown; errors?: unknown; ran?: unknown; files?: unknown } | undefined;
     const measured = previousGate?.partialFailures as { failures?: unknown; errors?: unknown } | undefined;
@@ -600,19 +664,25 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
     waiverCommit = recorded;
   }
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  const fromIndex = savedRun.path.indexOf(opts.from);
+  const gateIndex = savedRun.path.indexOf('gate');
+  const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
   if (opts.rerouteShard !== undefined && tip.changed) throw new Error('shard reroute requires the original cut head; moved tip needs a full re-gate');
   verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, tip.version);
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   verifyResumePreflight(savedRun, opts, deps, tip.version, tip.from, tip.to, commandRoot);
-  const partial = preparePartial(tip, opts.rerouteShard !== undefined ? { ...opts, partial: false } : opts, deps, true);
-  const fromIndex = savedRun.path.indexOf(opts.from);
-  const gateIndex = savedRun.path.indexOf('gate');
-  const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
+  const autoheal = gateWillRun ? priorGateAutoheal(savedRun) : undefined;
+  const autoReroute = opts.rerouteShard === undefined ? automaticReroute(savedRun, autoheal, tip.changed, opts.from) : undefined;
+  const automaticShardReroute = autoReroute ? releaseResumeGateShardReroute(savedRun, { from: opts.from, shard: autoReroute }) : undefined;
+  const effectiveOpts = automaticShardReroute ? { ...opts, rerouteShard: automaticShardReroute.set.gateRerouteShard } : opts;
+  const partial = preparePartial(tip, effectiveOpts.rerouteShard !== undefined ? { ...effectiveOpts, partial: false } : effectiveOpts, deps, true);
   const gatePlan = !gateWillRun ? { mode: 'not-run' as const }
     : partial.requested && partial.applied ? { mode: 'partial' as const }
       : { mode: 'full' as const, reason: partial.requested ? partial.reason : opts.partial === false ? 'partial recheck disabled' : 'no partial plan applies' };
+  if (autoheal) debug.log('release-loop.resume', 'gate-autoheal-plan', { runId: opts.runId, version: tip.version, appliedReroute: automaticShardReroute?.set.gateRerouteShard ?? null, ...autoheal });
   return { runId: opts.runId, version: tip.version, fromNode: opts.from, commandRoot, tip, partial,
-    gatePlan, nextAttempt: attempt.attempt, priorCountKnown: attempt.priorCountKnown, preflight: 'passed' };
+    gatePlan, ...(autoheal ? { autoheal } : {}), ...(automaticShardReroute ? { autohealReroute: automaticShardReroute.set.gateRerouteShard } : {}),
+    nextAttempt: attempt.attempt, priorCountKnown: attempt.priorCountKnown, preflight: 'passed' };
 }
 
 async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
@@ -667,7 +737,12 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), previewTip.to, deps.git);
   verifyResumePreflight(savedRun, opts, deps, previewTip.version, previewTip.from, previewTip.to, commandRoot);
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, false, previewTip.to);
-  const partial = preparePartial(tip, shardReroute ? { ...opts, partial: false } : opts, deps);
+  const autoheal = priorGateAutoheal(savedRun);
+  const autoReroute = !shardReroute ? automaticReroute(savedRun, autoheal, tip.changed, opts.from) : undefined;
+  const automaticShardReroute = autoReroute ? releaseResumeGateShardReroute(savedRun, { from: opts.from, shard: autoReroute }) : undefined;
+  const partial = preparePartial(tip, shardReroute || automaticShardReroute
+    ? { ...opts, rerouteShard: (shardReroute ?? automaticShardReroute)!.set.gateRerouteShard, partial: false } : opts, deps);
+  if (autoheal) debug.log('release-loop.resume', 'gate-autoheal-plan', { runId: opts.runId, version: tip.version, appliedReroute: automaticShardReroute?.set.gateRerouteShard ?? null, ...autoheal });
   // A failed preflight does not consume an observed release resume attempt.
   const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
   debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt,
@@ -682,8 +757,8 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
     ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
     ...(gatePodPool ? { releaseGatePodPool: gatePodPool.set.gatePodPool } : {}),
-    ...(shardReroute ? { releaseGateShardReroute: { shard: shardReroute.set.gateRerouteShard,
-      ...(shardReroute.set.gateShardHost ? { host: shardReroute.set.gateShardHost } : {}),
+    ...(shardReroute || automaticShardReroute ? { releaseGateShardReroute: { shard: (shardReroute ?? automaticShardReroute)!.set.gateRerouteShard,
+      ...((shardReroute ?? automaticShardReroute)!.set.gateShardHost ? { host: (shardReroute ?? automaticShardReroute)!.set.gateShardHost } : {}),
       ...(opts.shardOs ? { os: opts.shardOs } : {}) } } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };

package/scripts/ux-sim.ts

@@ -20,10 +20,11 @@
 //   bun scripts/ux-sim.ts --fault sqlite-busy # 결함 주입: 실제 SQLite 잠금 → 로그 배치 버퍼·복구
 //   bun scripts/ux-sim.ts emit child-error-long --json # 사건 주입(L0): 격리 우주 원장에 주입 줄 → 소비자 목록
 //
-// ⛔ 이 CLI 는 «실제 위젯 render()» 를 부른다 — 흉내 렌더러가 아니다.
+// catalog list/show 는 재사용 장치의 참조를 보여 준다. 선언된 TUI 장면은 실제 위젯 render() 를 부른다 — 흉내 렌더러가 아니다.
 import { simRenderLogFrame } from '../src/ux-sim/render-frame.js';
 import { simTypeaheadState, type TurnPhase, type TurnSimSpec } from '../src/ux-sim/turn-states.js';
 import { renderTurnTypeaheadQueueRow, renderTurnTypeaheadEcho } from '../src/chat/turn-typeahead.js';
+import { loadMockScenarioCatalog, renderMockScenarioDetails, renderMockScenarioList } from '../src/ux-sim/mock-scenario-catalog.js';
 
 const PHASES: TurnPhase[] = [
   'idle', 'thinking', 'streaming', 'streaming-with-subagents', 'harness-child', 'interrupted',
@@ -31,6 +32,22 @@ const PHASES: TurnPhase[] = [
 
 const argv = process.argv.slice(2);
 
+if (argv[0] === 'list') {
+  if (argv.length !== 1) { console.error('usage: bun scripts/ux-sim.ts list'); process.exit(2); }
+  console.log(renderMockScenarioList(loadMockScenarioCatalog()).join('\n'));
+  process.exit(0);
+}
+if (argv[0] === 'show') {
+  if (argv.length !== 2) { console.error('usage: bun scripts/ux-sim.ts show <MS-id>'); process.exit(2); }
+  try {
+    console.log(renderMockScenarioDetails(loadMockScenarioCatalog(), argv[1]!).join('\n'));
+    process.exit(0);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(2);
+  }
+}
+
 // ── 사건 주입 «이벤트 몽키» (SIM-EVENT-MONKEY · L0) — 자기 플래그를 가진 하위 명령 ──
 //   bun scripts/ux-sim.ts emit <kind> [--run <id>] [--variant allowed|refused] [--state-dir <dir>] [--json]
 //   bun scripts/ux-sim.ts emit --list