elanous 0.2.42 → 0.2.43

package/src/task-orchestrator/surfaces/pod-failure-reason.ts

@@ -1,3 +1,5 @@
+import { podChildProviderOf, type PodChildProvider } from './pod-child-providers.js';
+
 /** STOP-RECORD stop_class values used by the card terminal classifier. */
 export const STOP_CLASS_POD_FAILURE = 'pod-failure' as const;
 export const STOP_CLASS_NO_LAUNCH = 'no-launch' as const;
@@ -20,12 +22,19 @@ export function nestedPodResult(row: Record<string, unknown>): {
   const result = row.result as Record<string, unknown>;
   if (typeof result.stage !== 'string' || typeof result.ok !== 'boolean') return null;
   if (result.ok) return { stage: result.stage, ok: true };
+  // The terminal stage/node/outcome often says only `aborted` or `abandoned`.
+  // Keep the child's explicit stop detail (for example a same-cell PR guard
+  // failure) while retaining the established node/outcome/classification text.
+  // Forward only the typed guard failure this path owns. Other aborted children
+  // can carry verbose PTY summaries in `detail`; those are not parent attribution.
+  const explicitDetail = result.detailKind === 'blocked-draft-pr-guard' ? ledgerString(result.detail) : '';
   const classification = result.abandonedClassification;
   const detail = typeof result.supervisorVerdict === 'string' ? result.supervisorVerdict
     : classification && typeof classification === 'object' && !Array.isArray(classification)
       ? (classification as Record<string, unknown>).classification : undefined;
   const reason = [result.node, result.outcome].filter((part): part is string => typeof part === 'string' && part.length > 0).join(' ');
-  const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : ''].filter(Boolean).join(' · ');
+  const error = [reason || (typeof result.error === 'string' ? result.error : ''), typeof detail === 'string' && detail ? detail : '', explicitDetail]
+    .filter(Boolean).join(' · ');
   // PREFLIGHT-RESULT-LINE: a nested preflight rejection carries its blockers under result.blockers — the same ledger fields as the flat row.
   const blockers = result.stage === 'preflight-blocked' ? preflightBlockerText(result.blockers)
     : { error: '', preflightChecks: [] as PreflightCheck[] };
@@ -121,6 +130,15 @@ export function podTerminalRow(row: Record<string, unknown>): {
   return nestedPodResult(row);
 }
 
+/**
+ * OBS-GAP-BATCH-1030 — 자식 LLM 실패의 «누가·어떤 HTTP status 로» 죽었나를 부모 원장에 얹는 두 스칼라.
+ * ⛔ 응답 본문·메시지·자격증명은 담지 않는다 — provider 는 정규 id, status 는 4xx/5xx 숫자뿐이다.
+ */
+export interface PodProviderFailureFact {
+  readonly provider?: PodChildProvider;
+  readonly httpStatusCode?: number;
+}
+
 export const POD_EXIT_CLASSES = ['oom-killed', 'deadline-exceeded', 'gh-login-failed', 'pod-secret', 'ask-reprompt', 'provider-error', 'child-unconverged', 'child-error', 'no-result-line', 'unknown'] as const;
 
 export type PodExitClass = typeof POD_EXIT_CLASSES[number];
@@ -143,6 +161,8 @@ export function podChildEvidenceLedgerRow(input: {
   noResultDiagnostic?: string | null;
   noResultLogEvidence?: Record<string, unknown> | null;
   podTermination?: PodTermination | null;
+  /** OBS-GAP-BATCH-1030 — 실패 행에만 붙는 두 스칼라(provider · HTTP status). 없으면 종전 행 그대로. */
+  providerFailure?: PodProviderFailureFact | null;
 }): Record<string, unknown> | null {
   const { result } = input;
   const persist = input.state === 'failed' || input.state === 'aborted' || input.noResultLogEvidence != null
@@ -163,6 +183,8 @@ export function podChildEvidenceLedgerRow(input: {
     childEvidence,
     childRunId: input.childRunId,
     job: input.job,
+    ...(input.providerFailure?.provider ? { provider: input.providerFailure.provider } : {}),
+    ...(input.providerFailure?.httpStatusCode !== undefined ? { httpStatusCode: input.providerFailure.httpStatusCode } : {}),
     ...(input.podTermination ? { podTermination: input.podTermination } : {}),
     ...(childResult && Object.keys(childResult).length > 0 ? { childResult } : {}),
   };
@@ -195,6 +217,75 @@ function isPodProviderErrorLine(line: string): boolean {
   return POD_PROVIDER_ERROR_LINE.test(line);
 }
 
+/** 401·429·503 같은 «상태 숫자»만 — 응답 본문·메시지는 돌려주지 않는다. 4xx/5xx 밖의 수는 상태가 아니다. */
+function podProviderHttpStatus(line: string): number | undefined {
+  const explicit = /"status"\s*:\s*(\d{3})/u.exec(line) ?? /\b(?:LLM API|HTTP|status(?:[ _-]?code)?)\b\s*[:=]?\s*(\d{3})\b/iu.exec(line);
+  // 맨숫자 형태는 «상태 자리»에 선 것만 — `500ms`·`1.5e3` 같은 수를 상태로 세지 않는다.
+  const digits = (explicit ?? /(?:^|[^\d])([45]\d{2})(?![\d\p{L}.])/u.exec(line))?.[1];
+  const value = digits === undefined ? NaN : Number(digits);
+  return Number.isSafeInteger(value) && value >= 400 && value <= 599 ? value : undefined;
+}
+
+/** 줄이 이름한 provider — `llm.<id>` 접두 우선, 없으면 줄 안의 정식 이름/별칭. 목록 밖 이름은 세지 않는다. */
+function podLineProvider(line: string): PodChildProvider | undefined {
+  const scoped = /\bllm\.([a-z0-9_-]+)\b/iu.exec(line)?.[1];
+  const scopedProvider = podChildProviderOf(scoped);
+  if (scopedProvider) return scopedProvider;
+  for (const token of line.match(/[A-Za-z][A-Za-z0-9_-]{1,31}/gu) ?? []) {
+    const provider = podChildProviderOf(token);
+    if (provider) return provider;
+  }
+  return undefined;
+}
+
+/** provider 실패를 «말하는» 줄 — 분류기가 provider-error 로 읽는 줄, 또는 자식이 낸 `LLM API <status>` 문면. */
+const isPodProviderFailureSource = (line: string): boolean => isPodProviderErrorLine(line) || /\bLLM API\s+\d{3}\b/iu.test(line);
+
+/**
+ * 마지막 canonical 자식 terminal 과 «그 직전» 구간 — duplicate-cap 귀속의 한 자리(classifyPodExit 과 같은 규칙).
+ * terminal 이 없으면 구간은 전체 로그다(결과행 없는 자식도 provider 실패는 귀속된다).
+ */
+function podTerminalWindow(logs: string): { terminal: ReturnType<typeof podTerminalRow>; window: string[] } {
+  const lines = logs.split(/\r\n|\n|\r/u);
+  let terminal: ReturnType<typeof podTerminalRow> = null;
+  let lastIndex = -1;
+  let previousIndex = -1;
+  for (const [index, raw] of lines.entries()) {
+    const line = raw.trim();
+    if (!line.startsWith('{')) continue;
+    let parsed: unknown;
+    try { parsed = JSON.parse(line); } catch { continue; }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
+    const row = podTerminalRow(parsed as Record<string, unknown>);
+    if (!row) continue;
+    previousIndex = lastIndex;
+    terminal = row;
+    lastIndex = index;
+  }
+  const window = lines.slice(previousIndex + 1, lastIndex === -1 ? undefined : lastIndex)
+    .map((line) => line.trim()).filter(Boolean);
+  return { terminal, window };
+}
+
+/**
+ * OBS-GAP-BATCH-1030 — 자식 실패를 «공급자 + HTTP status» 로 귀속한다(응답 본문·자격증명 제외).
+ * 마지막 canonical terminal 이 성공이면 null — 과거(재시도 전) provider 실패를 성공한 결과에 재사용하지 않는다.
+ * 줄이 공급자를 이름하지 않으면 호출자가 준 hint(Pod 의 자식 provider)를 정규 id 로만 쓴다.
+ */
+export function podChildProviderFailureFact(logs: string, opts?: { providerHint?: string }): PodProviderFailureFact | null {
+  const { terminal, window } = podTerminalWindow(logs);
+  if (terminal?.ok === true) return null;
+  const terminalErrors = typeof terminal?.error === 'string'
+    ? terminal.error.split(/\r\n|\n|\r/u).map((line) => line.trim()).filter(Boolean) : [];
+  const sources = [...window, ...terminalErrors].filter((line) => isPodProviderFailureSource(line)).reverse();
+  if (!sources.length) return null;
+  // 마지막 줄이 `LLM API <status>` 만 말할 수 있다 — 공급자는 «이름한» 줄에서 따로 찾는다.
+  const provider = sources.map(podLineProvider).find((named) => named !== undefined) ?? podChildProviderOf(opts?.providerHint);
+  const httpStatusCode = sources.map(podProviderHttpStatus).find((status) => status !== undefined);
+  if (!provider && httpStatusCode === undefined) return null;
+  return { ...(provider ? { provider } : {}), ...(httpStatusCode !== undefined ? { httpStatusCode } : {}) };
+}
+
 /**
  * POD-FAIL-EVIDENCE-CAPTURE-FU — duplicate-cap 귀속: 마지막 «canonical» 자식 terminal 하나에만 실패를 붙인다.
  * canonical 접두(`self`/`external`)가 아닌 lookalike kind 행은 건너뛰고, 마지막 canonical terminal 이 성공이거나

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { podTerminalRow } from './pod-failure-reason.js';
 
 /** Capture a failed Job against its recorded placement, never the caller's current kubectl context. */
 export function captureFailedPodJobs(input: {
@@ -39,10 +40,14 @@ export function captureFailedPodJobs(input: {
     finish('failed', 'placement-conflict'); return;
   }
   const location = { host: first.host, context: first.context, namespace: first.namespace, childRunId: first.childRunId, jobUid: first.jobUid };
+  const childRows = rows.filter(row => row.event === 'pod-child-run' && row.data?.job === job
+    && row.data.childRunId === first.childRunId && Number.isSafeInteger(row.data.attempt)
+    && (row.data.attempt as number) > 0);
+  const attempt = childRows.length ? childRows[childRows.length - 1]!.data!.attempt as number : undefined;
   const evidenceDir = join(artifactDir, 'pod-failure-capture', runId, job, first.childRunId as string);
   // A failed kubectl/SSH read is itself the missing diagnostic. Keep its stderr in
   // the private artifact directory and put only the path and exit status in the ledger.
-  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+  const captureStderr = (reason: string, result: { status: number | null; stderr: string }): Record<string, unknown> => {
     let stderrEvidence: string | null = null;
     let stderrCaptureStatus: 'saved' | 'redacted' | 'empty' | 'write-failed' = result.stderr ? 'saved' : 'empty';
     if (result.stderr) {
@@ -61,19 +66,40 @@ export function captureFailedPodJobs(input: {
         }
       } catch { stderrEvidence = null; stderrCaptureStatus = 'write-failed'; }
     }
-    finish('failed', reason, { ...location, ...extra, kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus });
+    return { kubectlStatus: result.status, stderrEvidence, stderrCaptureStatus };
+  };
+  const readFailure = (reason: string, result: { status: number | null; stderr: string }, extra: Record<string, unknown> = {}): void => {
+    finish('failed', reason, { ...location, ...extra, ...captureStderr(reason, result) });
   };
   const previous = rows.find(row => row.event === 'pod-failure-capture' && row.data?.job === job && row.data?.outcome === 'collected'
     && row.data.childRunId === first.childRunId && row.data.jobUid === first.jobUid
     && row.data.host === first.host && row.data.context === first.context && row.data.namespace === first.namespace);
+  const priorLogEvidence = previous?.data?.logEvidence;
+  const priorPreviousLogEvidence = previous?.data?.previousLogEvidence;
+  const priorCurrentReadStatus = previous?.data?.currentLogReadStatus;
+  const priorPreviousReadStatus = previous?.data?.previousLogReadStatus;
   // A ledger row describes a prior collection; it does not guarantee that its files survived.
-  // Check all three expected paths before treating it as complete, then recapture any missing evidence.
-  if (previous && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json'], ['logEvidence', 'child.log']] as const)
+  // Validate the required artifacts and every log artifact claimed by the prior row before deduping.
+  // Unknown restart count is terminal for this Job snapshot: another identical Pod read cannot recover it.
+  const previousReadComplete = priorCurrentReadStatus === 'captured'
+    ? ['captured', 'empty', 'not-needed', 'unknown'].includes(String(priorPreviousReadStatus))
+    : priorCurrentReadStatus === 'empty' && priorPreviousReadStatus === 'captured';
+  const currentLogEvidencePresent = priorCurrentReadStatus === 'captured'
+    && priorLogEvidence === join(evidenceDir, 'child.log')
+    && (() => { try { return statSync(priorLogEvidence).isFile(); } catch { return false; } })();
+  const previousLogEvidencePresent = priorPreviousReadStatus === 'captured'
+    && priorPreviousLogEvidence === join(evidenceDir, 'child.previous.log')
+    && (() => { try { return statSync(priorPreviousLogEvidence).isFile(); } catch { return false; } })();
+  const logEvidenceComplete = currentLogEvidencePresent
+    ? priorPreviousReadStatus !== 'captured' || previousLogEvidencePresent
+    : priorCurrentReadStatus === 'empty' && previousLogEvidencePresent;
+  if (previous && previousReadComplete && ([['jobEvidence', 'job.json'], ['podEvidence', 'pods.json']] as const)
     .every(([field, filename]) => {
       const path = join(evidenceDir, filename);
       if (previous.data?.[field] !== path) return false;
       try { return statSync(path).isFile(); } catch { return false; }
-    })) return;
+    })
+    && logEvidenceComplete) return;
   const args = ['--context', first.context as string, '-n', first.namespace as string] as const;
   try {
     const jobResult = kubectl(first.host as string, [...args, 'get', 'job', job, '-o', 'json']);
@@ -103,23 +129,88 @@ export function captureFailedPodJobs(input: {
     });
     const podResult = kubectl(first.host as string, [...args, 'get', 'pods', '-l', `job-name=${job}`, '-o', 'json']);
     if (podResult.status !== 0) { readFailure('pods-read-failed', podResult, { jobEvidence }); return; }
-    const pods = JSON.parse(podResult.stdout) as { items?: Array<{ metadata?: { name?: string; ownerReferences?: Array<{ uid?: string }> } }> };
+    const pods = JSON.parse(podResult.stdout) as { items?: Array<{
+      metadata?: { name?: string; uid?: string; ownerReferences?: Array<{ uid?: string }> };
+      status?: { phase?: string; containerStatuses?: Array<{ name?: string; restartCount?: number;
+        state?: { terminated?: { reason?: string; exitCode?: number; finishedAt?: string } } }> };
+    }> };
     if (!pods.items?.length || pods.items.some(p => !p.metadata?.ownerReferences?.some(owner => owner.uid === jobBody.metadata?.uid))) {
       finish('failed', 'pod-owner-mismatch', { ...location, jobEvidence }); return;
     }
     const podEvidence = save('pods.json', podResult.stdout);
-    const podName = pods.items[0]?.metadata?.name;
+    const pod = pods.items[0]!;
+    const podName = pod.metadata?.name;
     if (pods.items.length !== 1 || !podName || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(podName)) {
       finish('failed', 'pod-ambiguous', { ...location, jobEvidence, podEvidence }); return;
     }
+    const childStatus = pod.status?.containerStatuses?.find(status => status.name === 'child');
+    const terminated = childStatus?.state?.terminated;
+    const shortCode = (value: unknown): string | undefined => typeof value === 'string' && /^[A-Za-z0-9_.:-]{1,64}$/.test(value) && !SECRET_VALUE.test(value) ? value : undefined;
+    const numeric = (value: unknown): number | undefined => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+    const exitCode = (value: unknown): number | undefined => typeof value === 'number' && Number.isSafeInteger(value) ? value : undefined;
+    const restartCount = numeric(childStatus?.restartCount);
+    const podSummary: Record<string, unknown> = {
+      ...location,
+      ...(attempt !== undefined ? { attempt } : {}), podName,
+      ...(shortCode(pod.metadata?.uid) ? { podUid: shortCode(pod.metadata?.uid) } : {}),
+      ...(shortCode(pod.status?.phase) ? { podPhase: shortCode(pod.status?.phase) } : {}),
+      ...(shortCode(terminated?.reason) ? { containerReason: shortCode(terminated?.reason) } : {}),
+      ...(exitCode(terminated?.exitCode) !== undefined ? { containerExitCode: exitCode(terminated?.exitCode) } : {}),
+      ...(typeof terminated?.finishedAt === 'string' && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(terminated.finishedAt) ? { containerFinishedAt: terminated.finishedAt } : {}),
+      ...(restartCount !== undefined ? { containerRestartCount: restartCount } : {}),
+    };
     const logs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child']);
-    if (logs.status !== 0) { readFailure('logs-read-failed', logs, { jobEvidence, podEvidence }); return; }
-    if (!logs.stdout.trim()) { finish('failed', 'logs-empty', { ...location, jobEvidence, podEvidence }); return; }
-    const logEvidence = save('child.log', logs.stdout);
-    finish('collected', 'job-failed', { ...location, jobEvidence, podEvidence, logEvidence });
+    const currentLogReadStatus = logs.status === 0 ? (logs.stdout.trim() ? 'captured' : 'empty') : 'failed';
+    const currentLogBytes = logs.status === 0 ? Buffer.byteLength(logs.stdout) : 0;
+    let logEvidence: string | undefined;
+    let previousLogEvidence: string | undefined;
+    let previousLogReadStatus = restartCount === undefined || restartCount > 0 ? 'unknown' : 'not-needed';
+    let previousLogBytes: number | undefined;
+    let previousLogFailure: Record<string, unknown> = {};
+    let resultMarkerPresent = false;
+    if (logs.status === 0 && logs.stdout.trim()) {
+      logEvidence = save('child.log', logs.stdout);
+      resultMarkerPresent = hasTerminalMarker(logs.stdout);
+    }
+    if (restartCount !== undefined && restartCount > 0) {
+      const previousLogs = kubectl(first.host as string, [...args, 'logs', `pod/${podName}`, '-c', 'child', '--previous']);
+      previousLogReadStatus = previousLogs.status === 0 ? (previousLogs.stdout.trim() ? 'captured' : 'empty') : 'failed';
+      previousLogBytes = previousLogs.status === 0 ? Buffer.byteLength(previousLogs.stdout) : 0;
+      if (previousLogs.status !== 0) {
+        const failure = captureStderr('previous-logs-read-failed', previousLogs);
+        previousLogFailure = {
+          previousLogKubectlStatus: failure.kubectlStatus,
+          previousLogStderrEvidence: failure.stderrEvidence,
+          previousLogStderrCaptureStatus: failure.stderrCaptureStatus,
+        };
+      }
+      if (previousLogs.status === 0 && previousLogs.stdout.trim()) {
+        previousLogEvidence = save('child.previous.log', previousLogs.stdout);
+        resultMarkerPresent ||= hasTerminalMarker(previousLogs.stdout);
+      }
+    }
+    const summary = { ...podSummary, jobEvidence, podEvidence, currentLogReadStatus, currentLogBytes,
+      previousLogReadStatus, ...(previousLogBytes !== undefined ? { previousLogBytes } : {}), ...previousLogFailure, resultMarkerPresent,
+      ...(logEvidence ? { logEvidence } : {}), ...(previousLogEvidence ? { previousLogEvidence } : {}) };
+    if (currentLogReadStatus !== 'captured' && previousLogReadStatus !== 'captured') {
+      if (logs.status !== 0) { readFailure('logs-read-failed', logs, summary); return; }
+      finish('failed', 'logs-empty', summary); return;
+    }
+    if (logs.status !== 0) finish('collected', 'job-failed', { ...summary, ...captureStderr('logs-read-failed', logs) });
+    else finish('collected', 'job-failed', summary);
   } catch { finish('failed', 'capture-error', location); }
 }
 
+function hasTerminalMarker(logs: string): boolean {
+  for (const line of logs.split(/\r?\n/)) {
+    try {
+      const row: unknown = JSON.parse(line);
+      if (row && typeof row === 'object' && !Array.isArray(row) && podTerminalRow(row as Record<string, unknown>)) return true;
+    } catch { /* ordinary child output is not a terminal result marker */ }
+  }
+  return false;
+}
+
 const SECRET_FIELD = /token|secret|password|authorization|key/i;
 const SAFE_FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
 const SECRET_VALUE = /(?:\b(?:bearer|basic)\s+\S+|\b(?:token|secret|password|authorization|api[-_]?key|access[-_]?key|private[-_]?key)\b\s*(?:is|[=:])\s*["']?\S+|\b(?:sk-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}))\b/i;
@@ -127,8 +218,12 @@ const MAX_FIELDS = 32;
 // Review R2: only lifecycle events the host needs to see, and no free text. Event names must start with a known
 // lifecycle prefix; string fields survive only when they are short code-like values in a fixed set of keys.
 const EVENT_ALLOWED = /^(?:gate|gated|review|reviewed|repair|repaired|rework|merge|merged|pr|land|landed|stage|round|supervisor|child|plan|planned|decompose|decomposed|shard|stall|harvest|decision|run|pipeline|progress|human|start|started|finish|finished|done|implement|implemented|commit|test|typecheck)(?:-(?:started|finished|round|opened|closed|failed|passed|blocked|done|entry|node|outcome|delivery|decision|stop|merged|ready|requested|resolved|result|fix|must-fix|verdict|skipped|origin|cleared))*$/;
-const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result']);
+const CODE_FIELDS = new Set(['stage', 'outcome', 'verdict', 'status', 'kind', 'phase', 'role', 'result', 'containerReason',
+  'podPhase', 'currentLogReadStatus', 'previousLogReadStatus', 'previousLogStderrCaptureStatus', 'stderrCaptureStatus']);
 const CODE_VALUE = /^[a-z0-9_.:-]{1,40}$/i;
+const IDENTITY_FIELDS = new Set(['job', 'jobUid', 'childRunId', 'host', 'context', 'namespace', 'podName', 'podUid']);
+const SAFE_ID_VALUE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const SAFE_ISO_TIMESTAMP = /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/;
 
 function secretValues(root: Record<string, unknown>): string[] {
   const secrets: string[] = [];
@@ -163,7 +258,8 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
   const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
   const knownSecrets = secretValues(entry);
   const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
-  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
+  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'pod-failure-capture'
+    && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
 
   const data: Record<string, unknown> = { runId };
   let fields = 0;
@@ -176,7 +272,10 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
       if (!SAFE_FIELD.test(outputName) || SECRET_FIELD.test(outputName) || Object.hasOwn(data, outputName)) continue;
       if (typeof value === 'string') {
         // Free text (reasons, messages, patches) never leaves the pod ledger; only short code values in known keys.
-        if (!CODE_FIELDS.has(name) || !CODE_VALUE.test(value) || containsCredential(value)) continue;
+        const acceptedCode = CODE_FIELDS.has(name) && CODE_VALUE.test(value);
+        const acceptedIdentity = IDENTITY_FIELDS.has(name) && SAFE_ID_VALUE.test(value);
+        const acceptedTimestamp = name === 'containerFinishedAt' && SAFE_ISO_TIMESTAMP.test(value);
+        if ((!acceptedCode && !acceptedIdentity && !acceptedTimestamp) || containsCredential(value)) continue;
         data[name] = value;
       } else if (typeof value === 'number' && Number.isFinite(value) || typeof value === 'boolean' || value === null) {
         data[name] = value;

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -107,6 +107,10 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     // Count calls performed by this Pod source stage. Branch validation via
     // assertRemoteBase runs on the host before Job creation and is outside it.
     'pod_source_io_origin_calls=0',
+    ...(source.kind === 'default' && baseSha ? [
+      'pod_source_base_sha_origin_fallback=false',
+      'pod_source_base_sha_mirror_fetch_attempted=false',
+    ] : []),
     'pod_source_io_started=$(date +%s)',
     'pod_source_io_reported=0',
     'pod_source_io_measured=0',
@@ -117,7 +121,9 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     '  [ -n "${pod_source_io_seconds:-}" ] || pod_source_io_seconds=$(( $(date +%s) - pod_source_io_started ))',
     '  [ -n "${pod_source_io_files:-}" ] || pod_source_io_files=null',
     '  pod_source_io_status=incomplete; if [ "$pod_source_io_measured" -eq 1 ]; then pod_source_io_status=complete; fi',
-    '  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"',
+    ...(source.kind === 'default' && baseSha
+      ? ['  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"baseShaOriginFallback":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_base_sha_origin_fallback" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"']
+      : ['  printf \'ELANOUS_POD_SOURCE_IO {"originCalls":%s,"checkoutFiles":%s,"sourceVia":"%s","sourceSeconds":%s,"sourceStatus":"%s","pushCalls":null,"installRan":null,"installSeconds":null}\\n\' "$pod_source_io_origin_calls" "$pod_source_io_files" "${source_via:-unknown}" "$pod_source_io_seconds" "$pod_source_io_status"']),
     '  pod_source_result_emit "$pod_source_exit"',
     '}',
     'trap pod_source_io_emit EXIT',
@@ -174,7 +180,7 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     `if ! [ -d ${quotedMirror} ]; then mirror_skip=no-mount`,
     `elif ! git -C ${quotedMirror} rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=rev-parse-failed`,
     ...(source.kind === 'default' && baseSha
-      ? [`elif ! git init -q -b main repo || ! git -C repo fetch --quiet --no-write-fetch-head ${quotedMirror} '${baseSha}' || ! git -C repo cat-file -e '${baseSha}^{commit}' 2>/dev/null; then mirror_skip=sha-fetch-failed`]
+      ? [`elif pod_source_base_sha_mirror_fetch_attempted=true; ! git init -q -b main repo || ! git -C repo fetch --quiet --no-write-fetch-head ${quotedMirror} '${baseSha}' || ! git -C repo cat-file -e '${baseSha}^{commit}' 2>/dev/null; then mirror_skip=sha-fetch-failed`]
       : [`elif ! git clone -q --shared -- ${quotedMirror} repo || ! git -C repo rev-parse --verify HEAD >/dev/null 2>&1; then mirror_skip=clone-failed`]),
     'fi',
     'if [ -z "$mirror_skip" ]; then',
@@ -187,10 +193,9 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     "  printf 'ELANOUS_POD_SOURCE_MIRROR_SKIP %s\\n' \"$mirror_skip\"",
     '  if [ -e repo ]; then rm -r -- repo || exit 5; fi',
     ...(source.kind === 'default' && baseSha ? [] : ['  pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))']),
-    ...(source.kind === 'default' && baseSha ? [
-        `  pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${baseSha}'`,
-      '  exit 5',
-    ] : [`  ${clone} || exit 5`]),
+    ...(source.kind === 'default' && baseSha
+      ? [`  git init -q -b main repo && git -C repo remote add origin ${quotedUrl} || exit 5`]
+      : [`  ${clone} || exit 5`]),
     '  source_via=github',
     'fi',
     'fi',
@@ -209,12 +214,19 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
       return [
         ...ioStart,
         ...start,
-        // «실제 객체 출처» 마커: image 라우트는 핀 객체, mirror 라우트는 --shared alternates 가
-        // 해결된 SHA 를 이미 갖고 있으면 그 쪽이 출처다. 어느 쪽에도 없으면 호스트 미러에서
-        // raw-SHA fetch 로 Pod 전용 object store 에 직접 가져온다(프로덕션 미러 = push 로 심은
-        // bare 저장소, upload-pack 기본 설정 · refs/브랜치 경유 없음).
+        // «실제 객체 출처» 마커: image pin을 우선 쓰고, SHA가 없으면 host mirror 다음 origin에서
+        // raw-SHA fetch 해 Pod 전용 object store 에 넣는다. origin 시도 수·성공 여부는 IO summary로
+        // debug.log 에 남겨 다음 실패에서 소스 부재와 네트워크 fallback을 구분한다.
         'pod_source_base_sha_from="$source_via"',
-        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; fi`,
+        `if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then`,
+        `  if [ "$pod_source_base_sha_mirror_fetch_attempted" = false ] && [ -d ${quotedMirror} ]; then pod_source_base_sha_mirror_fetch_attempted=true; if git fetch --quiet --no-write-fetch-head ${quotedMirror} '${sha}'; then pod_source_base_sha_from=mirror; else printf 'ELANOUS_POD_SOURCE_BASE_SHA_MIRROR_FETCH failed %s\\n' '${sha}'; fi; fi`,
+        `  if ! git cat-file -e '${sha}^{commit}' 2>/dev/null; then`,
+        '    pod_source_io_origin_calls=$((pod_source_io_origin_calls + 1))',
+        '    pod_source_base_sha_origin_fallback=true',
+        `    printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH start %s\\n' '${sha}'`,
+        `    if git fetch --quiet --no-write-fetch-head origin '${sha}'; then pod_source_base_sha_from=origin; source_via=origin; printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH complete %s\\n' '${sha}'; else pod_source_stage=base-sha; pod_source_failure_code=base-sha-unavailable; printf 'ELANOUS_POD_SOURCE_BASE_SHA_ORIGIN_FETCH failed %s\\n' '${sha}'; printf 'ELANOUS_POD_SOURCE_BASE_SHA_UNAVAILABLE %s\\n' '${sha}'; exit 5; fi`,
+        '  fi',
+        'fi',
         `printf 'ELANOUS_POD_SOURCE_BASE_SHA_FROM %s\\n' "$pod_source_base_sha_from"`,
         `git checkout -q -B ${quotedBase} '${sha}' || exit 5`,
         `git update-ref ${quotedTrackingRef} '${sha}' || exit 5`,

package/src/task-orchestrator/surfaces/pod-warm-switch.ts

@@ -85,6 +85,8 @@ export function warmReuseFlagOn(config: unknown, consumer: WarmReuseConsumer): b
 
 function evidenceReason(evidence: WarmReuseEvidence | undefined, minSamples: number): string | null {
   if (!evidence) return 'evidence-unmeasured';
+  // A measured mismatch is the most actionable reason even when it also makes the latest canary fail.
+  if (typeof evidence.recentMismatchCount === 'number' && evidence.recentMismatchCount > 0) return 'recent-mismatch';
   if (evidence.leaseValid !== true) return evidence.leaseValid === false ? 'lease-invalid' : 'lease-unmeasured';
   if (evidence.canaryPassed !== true) return evidence.canaryPassed === false ? 'canary-failed' : 'canary-unmeasured';
   for (const field of IDENTITY_FIELDS) {

package/src/task-orchestrator/surfaces/pod-warm-worker-provider.ts

@@ -62,7 +62,9 @@ export interface WarmPodProviderOptions {
   transport?: (spec: WarmPodSpec) => Pick<WarmPodTransport, 'request'>;
   maxShadowMs?: number;
   now?: () => number;
-  kubectl?: (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
+  kubectl?: (args: readonly string[], input?: string) => {
+    status: number | null; stdout: string; stderr: string; error?: NodeJS.ErrnoException;
+  };
   /** Private directory for cross-process prepare leases; defaults to a per-user directory under tmpdir(). */
   prepareLockDirectory?: string;
   /** Cancels a prepare waiting for another process to finish the same host/worker slot. */
@@ -431,7 +433,8 @@ export class WarmPodProvider {
       const result = spawnSync('kubectl', argv, { encoding: 'utf8', input, env,
         timeout: argv[4] === 'wait' ? (POD_READY_WAIT_SECONDS + 30) * 1000 : 360_000,
         maxBuffer: 2 * 1024 * 1024 });
-      return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+      return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '',
+        error: result.error };
     };
     const parse = (result: { status: number | null; stdout: string }) => {
       if (result.status !== 0) return null;
@@ -483,11 +486,25 @@ export class WarmPodProvider {
       && Object.entries(metadata.annotations).every(([key, value]) => pod.metadata.annotations?.[key] === value)
       && pod.spec?.nodeName === nodeName
       && sameSpec(normalizedSpec(pod.spec), template);
+    const skipDiscovery = (reason: string): false => {
+      debug.log('pod.warm', 'warm-pod-list-skipped', { reason }, { level: 'warn' });
+      return false;
+    };
+    const kubectlErrorCode = (error: unknown): string | undefined => {
+      if (!error || typeof error !== 'object' || !('code' in error)) return undefined;
+      return typeof error.code === 'string' ? error.code : undefined;
+    };
     // Resolve the pinned Pod independently; namespace size must not affect this read.
-    const namedResult = kubectl(['get', 'pods', `--field-selector=metadata.name=${spec.name}`, '-o', 'json']);
+    let namedResult: ReturnType<typeof kubectl>;
+    try { namedResult = kubectl(['get', 'pods', `--field-selector=metadata.name=${spec.name}`, '-o', 'json']); }
+    catch (error) {
+      return skipDiscovery(kubectlErrorCode(error) === 'ENOBUFS' ? 'output-too-large' : 'kubectl-failed');
+    }
+    if (kubectlErrorCode(namedResult.error) === 'ENOBUFS') return skipDiscovery('output-too-large');
+    if (namedResult.status !== 0) return skipDiscovery('kubectl-failed');
     const namedList = parse(namedResult);
     if (!Array.isArray(namedList?.items) || !namedList.metadata || typeof namedList.metadata !== 'object'
-      || Array.isArray(namedList.metadata)) return false;
+      || Array.isArray(namedList.metadata)) return skipDiscovery('malformed-output');
     const namedMatches = namedList.items.filter((row: any) => row?.metadata?.name === spec.name);
     if (namedMatches.length > 1) return false;
     const namedPod = namedMatches[0] ?? null;
@@ -497,20 +514,29 @@ export class WarmPodProvider {
     const warmPods: any[] = [];
     let continuation = '';
     const seenContinuations = new Set<string>();
+    let completedPages = false;
     for (let page = 0; page < 100; page++) {
-      const args = ['get', 'pods', '-l', 'elanous.kind=warm-worker', '--limit=10', '-o', 'json'];
+      const args = ['get', 'pods', '-l', 'elanous.kind=warm-worker', '--chunk-size=50', '-o', 'json'];
       if (continuation) args.splice(5, 0, '--continue', continuation);
-      const result = kubectl(args);
+      let result: ReturnType<typeof kubectl>;
+      try { result = kubectl(args); }
+      catch (error) {
+        return skipDiscovery(kubectlErrorCode(error) === 'ENOBUFS' ? 'output-too-large' : 'kubectl-failed');
+      }
+      if (kubectlErrorCode(result.error) === 'ENOBUFS') return skipDiscovery('output-too-large');
+      if (result.status !== 0) return skipDiscovery('kubectl-failed');
       const listed = parse(result);
       if (!listed || !Array.isArray(listed.items) || !listed.metadata || typeof listed.metadata !== 'object'
         || Array.isArray(listed.metadata)
-        || (listed.metadata.continue !== undefined && typeof listed.metadata.continue !== 'string')) return false;
+        || (listed.metadata.continue !== undefined && typeof listed.metadata.continue !== 'string'))
+        return skipDiscovery('malformed-output');
       warmPods.push(...listed.items);
       continuation = listed.metadata?.continue ?? '';
-      if (!continuation) break;
-      if (seenContinuations.has(continuation) || page === 99) return false;
+      if (!continuation) { completedPages = true; break; }
+      if (seenContinuations.has(continuation) || page === 99) return skipDiscovery('malformed-output');
       seenContinuations.add(continuation);
     }
+    if (!completedPages) return skipDiscovery('malformed-output');
     const hostPods = warmPods.filter((row: any) => row?.metadata?.name === spec.name
       || row?.metadata?.annotations?.['elanous.dev/warm-worker-id'] === spec.workerId);
     if (namedPod && !hostPods.some((row: any) => row?.metadata?.name === spec.name)) hostPods.push(namedPod);