@harness-engineering/orchestrator 0.10.0 → 0.11.2

package/dist/index.d.mts

@@ -1993,6 +1993,15 @@ declare class Orchestrator extends EventEmitter {
      * `store.load()`.
      */
     private initModelPool;
+    /**
+     * LMLM Phase 7 wiring: apply the operator's configured pool bounds (disk
+     * budget + org/family allowlist) from `localModels.pool` to the live pool.
+     * Called after `PoolStateStore.load()` so config wins over persisted bounds
+     * (D2, declarative precedence). No-op when the pool is null (LMLM disabled)
+     * or no `pool` block is configured, so it is safe to call unconditionally
+     * on the startup path.
+     */
+    private applyConfiguredPoolBounds;
     /**
      * LMLM Phase 6: arm the single background refresh scheduler over the live
      * pool. No-op when LMLM is disabled (`modelPool` null). Each tick runs

package/dist/index.d.ts

@@ -1993,6 +1993,15 @@ declare class Orchestrator extends EventEmitter {
      * `store.load()`.
      */
     private initModelPool;
+    /**
+     * LMLM Phase 7 wiring: apply the operator's configured pool bounds (disk
+     * budget + org/family allowlist) from `localModels.pool` to the live pool.
+     * Called after `PoolStateStore.load()` so config wins over persisted bounds
+     * (D2, declarative precedence). No-op when the pool is null (LMLM disabled)
+     * or no `pool` block is configured, so it is safe to call unconditionally
+     * on the startup path.
+     */
+    private applyConfiguredPoolBounds;
     /**
      * LMLM Phase 6: arm the single background refresh scheduler over the live
      * pool. No-op when LMLM is disabled (`modelPool` null). Each tick runs

package/dist/index.js

@@ -3109,7 +3109,7 @@ var PromptRenderer = class {
 var import_node_events = require("events");
 var path21 = __toESM(require("path"));
 var import_node_crypto15 = require("crypto");
-var import_core15 = require("@harness-engineering/core");
+var import_core16 = require("@harness-engineering/core");
 
 // src/core/stall-detector.ts
 function detectStalledIssues(running, nowMs, stallTimeoutMs) {
@@ -3685,7 +3685,7 @@ var CompletionHandler = class {
 };
 
 // src/orchestrator.ts
-var import_core16 = require("@harness-engineering/core");
+var import_core17 = require("@harness-engineering/core");
 
 // src/tracker/adapters/github-issues-issue-tracker.ts
 var import_types9 = require("@harness-engineering/types");
@@ -4084,8 +4084,8 @@ var LocalModelResolver = class {
 };
 
 // src/orchestrator.ts
-var import_local_models4 = require("@harness-engineering/local-models");
-var import_core17 = require("@harness-engineering/core");
+var import_local_models5 = require("@harness-engineering/local-models");
+var import_core18 = require("@harness-engineering/core");
 
 // src/agent/config-migration.ts
 var MIGRATION_GUIDE = "docs/guides/multi-backend-routing.md";
@@ -7049,7 +7049,7 @@ function buildRoutingUseCase(issue, backendParam, catalog) {
 // src/server/http.ts
 var http = __toESM(require("http"));
 var path17 = __toESM(require("path"));
-var import_core11 = require("@harness-engineering/core");
+var import_core12 = require("@harness-engineering/core");
 
 // src/server/websocket.ts
 var import_ws = require("ws");
@@ -9186,17 +9186,196 @@ async function runForceRefresh(res, scheduler, deps) {
   });
 }
 
+// src/server/routes/v1/local-models-pool-mutation.ts
+var import_core11 = require("@harness-engineering/core");
+var import_local_models3 = require("@harness-engineering/local-models");
+var INSTALL_RE = /^\/api\/v1\/local-models\/pool\/install(?:\?.*)?$/;
+var REMOVE_RE = /^\/api\/v1\/local-models\/pool\/remove(?:\?.*)?$/;
+var RESOLVE_TOP = 50;
+function sendJSON10(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function decidedByOf(deps, req) {
+  if (deps.getDecidedBy) return deps.getDecidedBy(req);
+  const token = req._authToken;
+  return token?.id ?? "operator";
+}
+function handlerDeps(deps, req, pool) {
+  return {
+    pool,
+    bus: deps.bus,
+    updateProposal: (id, patch) => (0, import_core11.updateProposal)(deps.projectPath, id, patch),
+    decidedBy: decidedByOf(deps, req),
+    ...deps.isModelInUse ? { isModelInUse: deps.isModelInUse } : {}
+  };
+}
+async function readJsonBody(req) {
+  try {
+    const raw = await readBody(req);
+    if (raw.length === 0) return {};
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function handleInstall(req, res, deps) {
+  const pool = deps.getModelPool();
+  if (pool === null) return sendJSON10(res, 503, { error: "LMLM disabled" });
+  const body = await readJsonBody(req);
+  if (body === void 0) return sendJSON10(res, 400, { error: "invalid JSON body" });
+  const hfRepoId = typeof body.hfRepoId === "string" ? body.hfRepoId : "";
+  if (hfRepoId.length === 0) return sendJSON10(res, 400, { error: "hfRepoId is required" });
+  const quant = typeof body.quant === "string" ? body.quant : void 0;
+  if (!deps.getRecommendations) {
+    return sendJSON10(res, 503, { error: "recommendations unavailable" });
+  }
+  const ranked = await deps.getRecommendations({ top: RESOLVE_TOP, profile: "general" });
+  const match = ranked.find(
+    (r) => r.hfRepoId === hfRepoId && (quant === void 0 || r.quant === quant)
+  );
+  if (!match) {
+    return sendJSON10(res, 404, {
+      error: `no recommendation for ${hfRepoId}${quant ? ` @ ${quant}` : ""}`
+    });
+  }
+  if (!match.ollamaName) {
+    return sendJSON10(res, 422, { error: `${hfRepoId} has no known Ollama mirror to install` });
+  }
+  const content = {
+    action: "add",
+    target: { hfRepoId: match.hfRepoId, ollamaName: match.ollamaName },
+    scoreDelta: match.score,
+    justification: {
+      summary: `Operator-initiated install of ${match.ollamaName} (${match.quant}).`,
+      benchmarkBasis: [],
+      hardwareFit: match.fitsHardware ? "fits detected hardware" : "may not fit detected hardware",
+      evidence: match.evidence,
+      freshness: `snapshot ${match.benchmarkSnapshot}`
+    },
+    // Estimate the on-disk size from the candidate's params + quant (the same
+    // `estimateDiskGb` the automated proposal engine uses). The pool needs a
+    // size for its pre-commit budget check *before* the pull; it cannot inspect
+    // the target first, because ollama `/api/show` 404s for a model that is not
+    // yet pulled locally — which would surface as a spurious "no longer
+    // available on HuggingFace" 404 on every operator install.
+    diskImpactGb: (0, import_local_models3.estimateDiskGb)({
+      sizeB: match.sizeB,
+      quant: match.quant,
+      ...match.activeB !== void 0 ? { activeB: match.activeB } : {}
+    })
+  };
+  const record = await (0, import_core11.createModelProposal)(deps.projectPath, content, {
+    proposedBy: decidedByOf(deps, req)
+  });
+  const outcome = await onApproveModelProposal(handlerDeps(deps, req, pool), record);
+  if (outcome.status === "approved") {
+    const result = {
+      disposition: "installed",
+      proposalId: record.id,
+      evicted: outcome.evicted.map((e) => e.ollamaName)
+    };
+    return sendJSON10(res, 200, result);
+  }
+  if (outcome.status === "failed_target_missing") {
+    return sendJSON10(res, 404, {
+      error: `${hfRepoId} is no longer available on HuggingFace`,
+      proposalId: record.id
+    });
+  }
+  const status = outcome.code === "not_allowed" || outcome.code === "budget_exceeded" ? 409 : 502;
+  return sendJSON10(res, status, {
+    error: outcome.message,
+    code: outcome.code,
+    proposalId: record.id
+  });
+}
+async function handleRemove(req, res, deps) {
+  const pool = deps.getModelPool();
+  if (pool === null) return sendJSON10(res, 503, { error: "LMLM disabled" });
+  const body = await readJsonBody(req);
+  if (body === void 0) return sendJSON10(res, 400, { error: "invalid JSON body" });
+  const ollamaName = typeof body.ollamaName === "string" ? body.ollamaName : "";
+  if (ollamaName.length === 0) return sendJSON10(res, 400, { error: "ollamaName is required" });
+  const entry = pool.snapshot().entries.find((e) => e.ollamaName === ollamaName);
+  if (!entry) return sendJSON10(res, 404, { error: `${ollamaName} is not in the pool` });
+  const content = {
+    action: "evict",
+    target: { hfRepoId: entry.hfRepoId, ollamaName },
+    scoreDelta: 0,
+    justification: {
+      summary: `Operator-initiated removal of ${ollamaName}.`,
+      benchmarkBasis: [],
+      hardwareFit: "",
+      evidence: "operator",
+      freshness: ""
+    },
+    diskImpactGb: entry.sizeOnDiskGb
+  };
+  const record = await (0, import_core11.createModelProposal)(deps.projectPath, content, {
+    proposedBy: decidedByOf(deps, req)
+  });
+  const outcome = await onApproveModelProposal(handlerDeps(deps, req, pool), record);
+  if (outcome.status === "error") {
+    return sendJSON10(res, 502, {
+      error: outcome.message,
+      code: outcome.code,
+      proposalId: record.id
+    });
+  }
+  if (outcome.status === "failed_target_missing") {
+    return sendJSON10(res, 500, {
+      error: "unexpected failed_target_missing on evict",
+      proposalId: record.id
+    });
+  }
+  if (outcome.evicted.length > 0) {
+    const result2 = {
+      disposition: "removed",
+      proposalId: record.id,
+      evicted: outcome.evicted.map((e) => e.ollamaName)
+    };
+    return sendJSON10(res, 200, result2);
+  }
+  const stillPresent = pool.snapshot().entries.some((e) => e.ollamaName === ollamaName);
+  if (stillPresent) {
+    const result2 = {
+      disposition: "deferred",
+      proposalId: record.id,
+      evicted: [],
+      message: "model is in use; it will be removed after the current run"
+    };
+    return sendJSON10(res, 202, result2);
+  }
+  const result = { disposition: "removed", proposalId: record.id, evicted: [] };
+  return sendJSON10(res, 200, result);
+}
+function handleV1LocalModelsMutationRoute(req, res, deps) {
+  const url = req.url ?? "";
+  if ((req.method ?? "GET") !== "POST") return false;
+  if (INSTALL_RE.test(url)) {
+    void handleInstall(req, res, deps);
+    return true;
+  }
+  if (REMOVE_RE.test(url)) {
+    void handleRemove(req, res, deps);
+    return true;
+  }
+  return false;
+}
+
 // src/server/routes/v1/routing.ts
 var import_zod14 = require("zod");
 var CONFIG_RE = /^\/api\/v1\/routing\/config(?:\?.*)?$/;
 var DECISIONS_RE = /^\/api\/v1\/routing\/decisions(?:\?.*)?$/;
 var TRACE_RE = /^\/api\/v1\/routing\/trace(?:\?.*)?$/;
-function sendJSON10(res, status, body) {
+function sendJSON11(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function unavailable(res) {
-  sendJSON10(res, 503, { error: "BackendRouter not available" });
+  sendJSON11(res, 503, { error: "BackendRouter not available" });
   return true;
 }
 function resolveChain(value, backends) {
@@ -9233,7 +9412,7 @@ function buildResolvedChains(routing, backends) {
 }
 function handleConfig(res, deps) {
   if (!deps.router || !deps.routing || !deps.backends) return unavailable(res);
-  sendJSON10(res, 200, {
+  sendJSON11(res, 200, {
     routing: deps.routing,
     resolvedChains: buildResolvedChains(deps.routing, deps.backends),
     backends: Object.keys(deps.backends)
@@ -9261,7 +9440,7 @@ function parseDecisionsQuery(url) {
 function handleDecisions(req, res, deps) {
   if (!deps.bus) return unavailable(res);
   const filter = parseDecisionsQuery(req.url ?? "");
-  sendJSON10(res, 200, { decisions: deps.bus.recent(filter) });
+  sendJSON11(res, 200, { decisions: deps.bus.recent(filter) });
   return true;
 }
 var UseCaseSchema = import_zod14.z.discriminatedUnion("kind", [
@@ -9293,19 +9472,19 @@ async function handleTrace(req, res, deps) {
   try {
     raw = await readBody(req);
   } catch {
-    sendJSON10(res, 400, { error: "body read failed" });
+    sendJSON11(res, 400, { error: "body read failed" });
     return true;
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    sendJSON10(res, 400, { error: "invalid JSON body" });
+    sendJSON11(res, 400, { error: "invalid JSON body" });
     return true;
   }
   const r = TraceBodySchema.safeParse(parsed);
   if (!r.success) {
-    sendJSON10(res, 400, { error: r.error.message });
+    sendJSON11(res, 400, { error: r.error.message });
     return true;
   }
   const opts = r.data.invocationOverride !== void 0 ? { invocationOverride: r.data.invocationOverride } : void 0;
@@ -9318,9 +9497,9 @@ async function handleTrace(req, res, deps) {
       r.data.useCase,
       opts
     );
-    sendJSON10(res, 200, { decision, def: { type: def.type } });
+    sendJSON11(res, 200, { decision, def: { type: def.type } });
   } catch (err) {
-    sendJSON10(res, 500, { error: String(err) });
+    sendJSON11(res, 500, { error: String(err) });
   }
   return true;
 }
@@ -9557,7 +9736,7 @@ var CreateBodySchema = import_zod16.z.object({
   tenantId: import_zod16.z.string().optional(),
   expiresAt: import_zod16.z.string().datetime().optional()
 });
-function sendJSON11(res, status, body) {
+function sendJSON12(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -9567,19 +9746,19 @@ async function handlePost(req, res, store) {
     raw = await readBody(req);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to read body";
-    sendJSON11(res, 413, { error: msg });
+    sendJSON12(res, 413, { error: msg });
     return;
   }
   let json;
   try {
     json = JSON.parse(raw);
   } catch {
-    sendJSON11(res, 400, { error: "Invalid JSON body" });
+    sendJSON12(res, 400, { error: "Invalid JSON body" });
     return;
   }
   const parsed = CreateBodySchema.safeParse(json);
   if (!parsed.success) {
-    sendJSON11(res, 422, { error: "Invalid body", issues: parsed.error.issues });
+    sendJSON12(res, 422, { error: "Invalid body", issues: parsed.error.issues });
     return;
   }
   try {
@@ -9592,37 +9771,37 @@ async function handlePost(req, res, store) {
     if (parsed.data.expiresAt !== void 0) input.expiresAt = parsed.data.expiresAt;
     const result = await store.create(input);
     const publicRecord = import_types25.AuthTokenPublicSchema.parse(result.record);
-    sendJSON11(res, 200, {
+    sendJSON12(res, 200, {
       ...publicRecord,
       token: result.token
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to create token";
     if (msg.includes("already exists")) {
-      sendJSON11(res, 409, { error: msg });
+      sendJSON12(res, 409, { error: msg });
       return;
     }
-    sendJSON11(res, 500, { error: "Internal error creating token" });
+    sendJSON12(res, 500, { error: "Internal error creating token" });
   }
 }
 async function handleList3(res, store) {
   try {
     const list = await store.list();
-    sendJSON11(res, 200, list);
+    sendJSON12(res, 200, list);
   } catch {
-    sendJSON11(res, 500, { error: "Internal error listing tokens" });
+    sendJSON12(res, 500, { error: "Internal error listing tokens" });
   }
 }
 async function handleDelete2(res, store, id) {
   try {
     const ok = await store.revoke(id);
     if (!ok) {
-      sendJSON11(res, 404, { error: "Token not found" });
+      sendJSON12(res, 404, { error: "Token not found" });
       return;
     }
-    sendJSON11(res, 200, { deleted: true });
+    sendJSON12(res, 200, { deleted: true });
   } catch {
-    sendJSON11(res, 500, { error: "Internal error revoking token" });
+    sendJSON12(res, 500, { error: "Internal error revoking token" });
   }
 }
 var DELETE_PATH_RE2 = /^\/api\/v1\/auth\/tokens\/([^/?]+)(?:\?.*)?$/;
@@ -9647,12 +9826,12 @@ function handleAuthRoute(req, res, store) {
       return true;
     }
   }
-  sendJSON11(res, 405, { error: "Method not allowed" });
+  sendJSON12(res, 405, { error: "Method not allowed" });
   return true;
 }
 
 // src/server/routes/local-model.ts
-function sendJSON12(res, status, body) {
+function sendJSON13(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -9660,30 +9839,30 @@ function handleLocalModelRoute(req, res, getStatus) {
   const { method, url } = req;
   if (url !== "/api/v1/local-model/status") return false;
   if (method !== "GET") {
-    sendJSON12(res, 405, { error: "Method not allowed" });
+    sendJSON13(res, 405, { error: "Method not allowed" });
     return true;
   }
   if (!getStatus) {
-    sendJSON12(res, 503, { error: "Local backend not configured" });
+    sendJSON13(res, 503, { error: "Local backend not configured" });
     return true;
   }
   const status = getStatus();
   if (!status) {
-    sendJSON12(res, 503, { error: "Local backend not configured" });
+    sendJSON13(res, 503, { error: "Local backend not configured" });
     return true;
   }
-  sendJSON12(res, 200, status);
+  sendJSON13(res, 200, status);
   return true;
 }
 function handleLocalModelsRoute(req, res, getStatuses) {
   const { method, url } = req;
   if (url !== "/api/v1/local-models/status") return false;
   if (method !== "GET") {
-    sendJSON12(res, 405, { error: "Method not allowed" });
+    sendJSON13(res, 405, { error: "Method not allowed" });
     return true;
   }
   const statuses = getStatuses ? getStatuses() : [];
-  sendJSON12(res, 200, statuses);
+  sendJSON13(res, 200, statuses);
   return true;
 }
 
@@ -10056,6 +10235,21 @@ var V1_BRIDGE_ROUTES = [
     scope: "manage-proposals",
     description: "Force a background-scheduler refresh tick and return emitted proposals (O4)."
   },
+  // ── LMLM dashboard pool mutation — operator-initiated install/remove ──
+  // Modeled as auto-approved model proposals, so the same `manage-proposals`
+  // write scope that governs approve/reject governs these too.
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/pool\/install(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Install a recommended model into the local pool (auto-approved proposal)."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/pool\/remove(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Remove a model from the local pool (auto-approved proposal)."
+  },
   // ── LMLM Phase 7 — read surface (hardware/pool/recommendations/proposals) ──
   // Load-bearing: `local-models` is in `V1_WRAPPABLE`, so without these entries
   // the `/api/v1` rewrite shim would rewrite `/api/v1/local-models/<name>` →
@@ -10490,6 +10684,17 @@ var OrchestratorServer = class {
           ...this.isModelInUseFn ? { isModelInUse: this.isModelInUseFn } : {}
         });
       },
+      // LMLM dashboard pool mutation — POST /pool/install + /pool/remove.
+      // Operator-initiated install/remove via auto-approved proposals; reuses
+      // the same mutation pool + bus + in-use probe the proposals route uses.
+      // Registered before the read surface so /pool/install|remove match first.
+      (req, res) => handleV1LocalModelsMutationRoute(req, res, {
+        projectPath: this.projectPath,
+        bus: this.orchestrator,
+        getModelPool: () => this.getModelPoolFn?.() ?? null,
+        ...this.getRecommendationsFn ? { getRecommendations: this.getRecommendationsFn } : {},
+        ...this.isModelInUseFn ? { isModelInUse: this.isModelInUseFn } : {}
+      }),
       // LMLM Phase 6/7 — POST /refresh + the GET read surface
       // (hardware/pool/recommendations/proposals). Registered before the
       // chat-proxy fallback so it owns the path. Each accessor is spread in
@@ -10583,7 +10788,7 @@ var OrchestratorServer = class {
     return this.broadcaster.clientCount;
   }
   async start() {
-    (0, import_core11.assertPortUsable)(this.port, "orchestrator");
+    (0, import_core12.assertPortUsable)(this.port, "orchestrator");
     if (this.interactionQueue) {
       this.planWatcher = new PlanWatcher(this.plansDir, this.interactionQueue);
       this.planWatcher.start();
@@ -11085,7 +11290,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
 
 // src/gateway/telemetry/fanout.ts
 var import_node_crypto13 = require("crypto");
-var import_core12 = require("@harness-engineering/core");
+var import_core13 = require("@harness-engineering/core");
 var TOPICS = {
   MAINTENANCE_STARTED: "maintenance:started",
   MAINTENANCE_COMPLETED: "maintenance:completed",
@@ -11217,7 +11422,7 @@ function buildSpan(topic, plan, payload) {
     spanId: plan.spanId,
     ...plan.parentSpanId !== void 0 ? { parentSpanId: plan.parentSpanId } : {},
     name: SPAN_NAME[topic],
-    kind: import_core12.SpanKind.INTERNAL,
+    kind: import_core13.SpanKind.INTERNAL,
     startTimeNs: startNs,
     endTimeNs: startNs,
     attributes: buildAttributes(payload, { "harness.topic": topic }),
@@ -11674,7 +11879,7 @@ function wireNotificationSinks({ bus, registry }) {
 }
 
 // src/orchestrator.ts
-var import_core18 = require("@harness-engineering/core");
+var import_core19 = require("@harness-engineering/core");
 
 // src/logging/logger.ts
 var StructuredLogger = class {
@@ -11716,7 +11921,7 @@ var StructuredLogger = class {
 // src/workspace/config-scanner.ts
 var import_node_fs = require("fs");
 var import_node_path4 = require("path");
-var import_core13 = require("@harness-engineering/core");
+var import_core14 = require("@harness-engineering/core");
 var CONFIG_FILES = ["CLAUDE.md", "AGENTS.md", ".gemini/settings.json", "skill.yaml"];
 var BLOCKING_INJECTION_PREFIXES = ["INJ-UNI-", "INJ-REROL-"];
 var DOWNGRADED_SECURITY_RULES = /* @__PURE__ */ new Set(["SEC-AGT-006"]);
@@ -11738,29 +11943,29 @@ async function scanSingleFile(filePath, targetDir, scanner) {
   } catch {
     return null;
   }
-  const injectionFindings = (0, import_core13.scanForInjection)(content);
-  const findings = (0, import_core13.mapInjectionFindings)(injectionFindings);
+  const injectionFindings = (0, import_core14.scanForInjection)(content);
+  const findings = (0, import_core14.mapInjectionFindings)(injectionFindings);
   const secFindings = await scanner.scanFile(filePath);
-  findings.push(...(0, import_core13.mapSecurityFindings)(secFindings, findings));
+  findings.push(...(0, import_core14.mapSecurityFindings)(secFindings, findings));
   const adjusted = adjustFindingSeverity(findings);
   return {
     file: (0, import_node_path4.relative)(targetDir, filePath).replaceAll("\\", "/"),
     findings: adjusted,
-    overallSeverity: (0, import_core13.computeOverallSeverity)(adjusted)
+    overallSeverity: (0, import_core14.computeOverallSeverity)(adjusted)
   };
 }
 async function scanWorkspaceConfig(workspacePath) {
-  const scanner = new import_core13.SecurityScanner((0, import_core13.parseSecurityConfig)({}));
+  const scanner = new import_core14.SecurityScanner((0, import_core14.parseSecurityConfig)({}));
   const results = [];
   for (const configFile of CONFIG_FILES) {
     const result = await scanSingleFile((0, import_node_path4.join)(workspacePath, configFile), workspacePath, scanner);
     if (result) results.push(result);
   }
-  return { exitCode: (0, import_core13.computeScanExitCode)(results), results };
+  return { exitCode: (0, import_core14.computeScanExitCode)(results), results };
 }
 
 // src/core/lane-persistence.ts
-var import_core14 = require("@harness-engineering/core");
+var import_core15 = require("@harness-engineering/core");
 var import_types29 = require("@harness-engineering/types");
 var SIGNAL_TO_LANE = {
   claim: "claimed",
@@ -11774,16 +11979,16 @@ function mapOrchestratorLane(signal) {
 }
 async function persistLane(projectPath, issueId, signal) {
   try {
-    const reg = await import_core14.eventSourcing.registerTask(projectPath, issueId, []);
+    const reg = await import_core15.eventSourcing.registerTask(projectPath, issueId, []);
     if (!reg.ok) return reg;
-    return await import_core14.eventSourcing.transitionLane(projectPath, issueId, mapOrchestratorLane(signal));
+    return await import_core15.eventSourcing.transitionLane(projectPath, issueId, mapOrchestratorLane(signal));
   } catch (err) {
     return (0, import_types29.Err)(err instanceof Error ? err : new Error(String(err)));
   }
 }
 async function readPersistedLanes(projectPath) {
   try {
-    const snap = await import_core14.eventSourcing.readSnapshot(projectPath);
+    const snap = await import_core15.eventSourcing.readSnapshot(projectPath);
     return snap.ok ? snap.value.lanes : { tasks: {} };
   } catch {
     return { tasks: {} };
@@ -13884,7 +14089,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     if (overrides?.poolState) {
       this.poolStateProvider = overrides.poolState;
     } else if (localModelsEnabled) {
-      this.poolStateStore = new import_local_models4.PoolStateStore({
+      this.poolStateStore = new import_local_models5.PoolStateStore({
         onWarn: (message, cause) => this.logger.warn(message, cause !== void 0 ? { cause } : void 0)
       });
       this.poolStateProvider = this.poolStateStore;
@@ -13904,7 +14109,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         this.localResolvers.set(name, new LocalModelResolver(resolverOpts));
       }
     }
-    this.cacheMetrics = new import_core18.CacheMetricsRecorder();
+    this.cacheMetrics = new import_core19.CacheMetricsRecorder();
     if (this.config.agent.backends !== void 0 && Object.keys(this.config.agent.backends).length > 0) {
       const sandboxPolicy = this.config.agent.sandboxPolicy === "docker" ? "docker" : "none";
       const firstBackendName = Object.keys(this.config.agent.backends)[0];
@@ -14031,7 +14236,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
           const { ranked } = await this.modelRecommender(hardware);
           return ranked.slice(0, top);
         },
-        listModelProposals: () => (0, import_core17.listProposals)(this.projectRoot, { status: "open", kind: "model" })
+        listModelProposals: () => (0, import_core18.listProposals)(this.projectRoot, { status: "open", kind: "model" })
       });
       this.server.setRecorder(this.recorder);
       this.interactionQueue.onPush((interaction) => {
@@ -14048,7 +14253,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   setupTelemetryExport(config, webhookStore, webhookDelivery) {
     const otlpCfg = config.telemetry?.export?.otlp;
     if (!otlpCfg) return;
-    this.otlpExporter = new import_core18.OTLPExporter({
+    this.otlpExporter = new import_core19.OTLPExporter({
       endpoint: otlpCfg.endpoint,
       ...otlpCfg.enabled !== void 0 ? { enabled: otlpCfg.enabled } : {},
       ...otlpCfg.headers !== void 0 ? { headers: otlpCfg.headers } : {},
@@ -14151,7 +14356,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         ...this.config.tracker.apiKey ? { token: this.config.tracker.apiKey } : {},
         ...this.config.tracker.endpoint ? { apiBase: this.config.tracker.endpoint } : {}
       };
-      const clientResult = (0, import_core16.createTrackerClient)(trackerCfg);
+      const clientResult = (0, import_core17.createTrackerClient)(trackerCfg);
       if (!clientResult.ok) throw clientResult.error;
       return new GitHubIssuesIssueTrackerAdapter(clientResult.value, this.config.tracker);
     }
@@ -14730,12 +14935,12 @@ ${messages}`);
   async postLifecycleComment(identifier, externalId, event) {
     try {
       if (!externalId) return;
-      const trackerConfig = (0, import_core16.loadTrackerSyncConfig)(this.projectRoot);
+      const trackerConfig = (0, import_core17.loadTrackerSyncConfig)(this.projectRoot);
       if (!trackerConfig) return;
       const token = process.env.GITHUB_TOKEN;
       if (!token) return;
       const orchestratorId = await this.orchestratorIdPromise;
-      const adapter = new import_core16.GitHubIssuesSyncAdapter({ token, config: trackerConfig });
+      const adapter = new import_core17.GitHubIssuesSyncAdapter({ token, config: trackerConfig });
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
       const actionMap = {
         claimed: "Dispatching agent for autonomous execution",
@@ -14809,7 +15014,7 @@ ${messages}`);
             ...f.line !== void 0 ? { line: f.line } : {}
           }))
         );
-        (0, import_core15.writeTaint)(
+        (0, import_core16.writeTaint)(
           workspacePath,
           issue.id,
           "Medium-severity injection patterns found in workspace config files",
@@ -15087,11 +15292,29 @@ ${messages}`);
   initModelPool(store) {
     const onWarn = (message, cause) => this.logger.warn(message, cause !== void 0 ? { cause } : void 0);
     const installerCfg = this.config.localModels?.installer;
-    this.modelInstaller = new import_local_models4.OllamaInstallAdapter({
+    this.modelInstaller = new import_local_models5.OllamaInstallAdapter({
       baseUrl: installerCfg?.ollamaEndpoint ?? "http://localhost:11434",
       onWarn
     });
-    this.modelPool = new import_local_models4.PoolManager({ store, installer: this.modelInstaller, onWarn });
+    this.modelPool = new import_local_models5.PoolManager({ store, installer: this.modelInstaller, onWarn });
+  }
+  /**
+   * LMLM Phase 7 wiring: apply the operator's configured pool bounds (disk
+   * budget + org/family allowlist) from `localModels.pool` to the live pool.
+   * Called after `PoolStateStore.load()` so config wins over persisted bounds
+   * (D2, declarative precedence). No-op when the pool is null (LMLM disabled)
+   * or no `pool` block is configured, so it is safe to call unconditionally
+   * on the startup path.
+   */
+  async applyConfiguredPoolBounds() {
+    const pool = this.modelPool;
+    const bounds = this.config.localModels?.pool;
+    if (pool === null || !bounds) return;
+    await pool.configurePool({
+      diskBudgetGb: bounds.diskBudgetGb,
+      allowedOrgs: bounds.allowedOrgs,
+      allowedFamilies: bounds.allowedFamilies
+    });
   }
   /**
    * LMLM Phase 6: arm the single background refresh scheduler over the live
@@ -15109,10 +15332,21 @@ ${messages}`);
     if (this.modelPool === null) return;
     const pool = this.modelPool;
     const refreshCfg = this.config.localModels?.refresh;
-    const recommend = (0, import_local_models4.createNativeRecommender)({ candidates: [] });
+    const frozen = (0, import_local_models5.loadFrozenCandidates)();
+    const candidates = (0, import_local_models5.selectCandidates)(frozen.candidates, this.config.localModels?.pool);
+    for (const warning of frozen.warnings) {
+      this.logger.warn("LMLM frozen candidate snapshot degraded", { warning });
+    }
+    if (candidates.length === 0) {
+      this.logger.warn("LMLM recommender has no candidates", {
+        frozenCount: frozen.candidates.length,
+        allowedOrgs: this.config.localModels?.pool?.allowedOrgs ?? []
+      });
+    }
+    const recommend = (0, import_local_models5.createNativeRecommender)({ candidates });
     this.modelRecommender = recommend;
-    this.refreshScheduler = new import_local_models4.RefreshScheduler({
-      runTick: () => (0, import_local_models4.runRefreshTick)({
+    this.refreshScheduler = new import_local_models5.RefreshScheduler({
+      runTick: () => (0, import_local_models5.runRefreshTick)({
         detectHardware: () => this.detectLmlmHardware(),
         recommend,
         poolManager: pool,
@@ -15120,7 +15354,7 @@ ${messages}`);
         // Phase 7: after persisting the proposal, emit `local-models:proposal`
         // (== MODEL_PROPOSAL_TOPIC) on the bus so it fans out to WS clients and
         // notification sinks. Literal to avoid a proposals/model-handlers cycle.
-        emitProposal: (c) => (0, import_core17.createModelProposal)(this.projectRoot, c).then((record) => {
+        emitProposal: (c) => (0, import_core18.createModelProposal)(this.projectRoot, c).then((record) => {
           this.emit("local-models:proposal", {
             id: record.id,
             status: "created",
@@ -15143,12 +15377,12 @@ ${messages}`);
   /** Resolve the hardware profile for a refresh tick (operator override wins). */
   async detectLmlmHardware() {
     const override = this.config.localModels?.hardware?.override;
-    const detector = new import_local_models4.HardwareDetector(override !== void 0 ? { override } : {});
+    const detector = new import_local_models5.HardwareDetector(override !== void 0 ? { override } : {});
     return (await detector.detect()).profile;
   }
   /** Map the on-disk model-proposal queue to F7 dedup pairs (open→pending, rejected→rejected). */
   async lmlmDedupSource() {
-    const proposals = await (0, import_core17.listProposals)(this.projectRoot, { kind: "model" });
+    const proposals = await (0, import_core18.listProposals)(this.projectRoot, { kind: "model" });
     const pending = [];
     const rejected = [];
     for (const p of proposals) {
@@ -15186,6 +15420,7 @@ ${messages}`);
       }
       if (this.poolStateStore !== null) {
         await this.poolStateStore.load();
+        await this.applyConfiguredPoolBounds();
       }
       for (const resolver of this.localResolvers.values()) {
         await resolver.start();

package/dist/index.mjs

@@ -3976,9 +3976,11 @@ import {
   HardwareDetector,
   RefreshScheduler,
   runRefreshTick,
-  createNativeRecommender
+  createNativeRecommender,
+  loadFrozenCandidates,
+  selectCandidates as selectCandidates2
 } from "@harness-engineering/local-models";
-import { createModelProposal, listProposals as listProposals2 } from "@harness-engineering/core";
+import { createModelProposal as createModelProposal2, listProposals as listProposals2 } from "@harness-engineering/core";
 
 // src/agent/config-migration.ts
 var MIGRATION_GUIDE = "docs/guides/multi-backend-routing.md";
@@ -9139,17 +9141,196 @@ async function runForceRefresh(res, scheduler, deps) {
   });
 }
 
+// src/server/routes/v1/local-models-pool-mutation.ts
+import { createModelProposal, updateProposal as updateProposal4 } from "@harness-engineering/core";
+import { estimateDiskGb } from "@harness-engineering/local-models";
+var INSTALL_RE = /^\/api\/v1\/local-models\/pool\/install(?:\?.*)?$/;
+var REMOVE_RE = /^\/api\/v1\/local-models\/pool\/remove(?:\?.*)?$/;
+var RESOLVE_TOP = 50;
+function sendJSON10(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function decidedByOf(deps, req) {
+  if (deps.getDecidedBy) return deps.getDecidedBy(req);
+  const token = req._authToken;
+  return token?.id ?? "operator";
+}
+function handlerDeps(deps, req, pool) {
+  return {
+    pool,
+    bus: deps.bus,
+    updateProposal: (id, patch) => updateProposal4(deps.projectPath, id, patch),
+    decidedBy: decidedByOf(deps, req),
+    ...deps.isModelInUse ? { isModelInUse: deps.isModelInUse } : {}
+  };
+}
+async function readJsonBody(req) {
+  try {
+    const raw = await readBody(req);
+    if (raw.length === 0) return {};
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function handleInstall(req, res, deps) {
+  const pool = deps.getModelPool();
+  if (pool === null) return sendJSON10(res, 503, { error: "LMLM disabled" });
+  const body = await readJsonBody(req);
+  if (body === void 0) return sendJSON10(res, 400, { error: "invalid JSON body" });
+  const hfRepoId = typeof body.hfRepoId === "string" ? body.hfRepoId : "";
+  if (hfRepoId.length === 0) return sendJSON10(res, 400, { error: "hfRepoId is required" });
+  const quant = typeof body.quant === "string" ? body.quant : void 0;
+  if (!deps.getRecommendations) {
+    return sendJSON10(res, 503, { error: "recommendations unavailable" });
+  }
+  const ranked = await deps.getRecommendations({ top: RESOLVE_TOP, profile: "general" });
+  const match = ranked.find(
+    (r) => r.hfRepoId === hfRepoId && (quant === void 0 || r.quant === quant)
+  );
+  if (!match) {
+    return sendJSON10(res, 404, {
+      error: `no recommendation for ${hfRepoId}${quant ? ` @ ${quant}` : ""}`
+    });
+  }
+  if (!match.ollamaName) {
+    return sendJSON10(res, 422, { error: `${hfRepoId} has no known Ollama mirror to install` });
+  }
+  const content = {
+    action: "add",
+    target: { hfRepoId: match.hfRepoId, ollamaName: match.ollamaName },
+    scoreDelta: match.score,
+    justification: {
+      summary: `Operator-initiated install of ${match.ollamaName} (${match.quant}).`,
+      benchmarkBasis: [],
+      hardwareFit: match.fitsHardware ? "fits detected hardware" : "may not fit detected hardware",
+      evidence: match.evidence,
+      freshness: `snapshot ${match.benchmarkSnapshot}`
+    },
+    // Estimate the on-disk size from the candidate's params + quant (the same
+    // `estimateDiskGb` the automated proposal engine uses). The pool needs a
+    // size for its pre-commit budget check *before* the pull; it cannot inspect
+    // the target first, because ollama `/api/show` 404s for a model that is not
+    // yet pulled locally — which would surface as a spurious "no longer
+    // available on HuggingFace" 404 on every operator install.
+    diskImpactGb: estimateDiskGb({
+      sizeB: match.sizeB,
+      quant: match.quant,
+      ...match.activeB !== void 0 ? { activeB: match.activeB } : {}
+    })
+  };
+  const record = await createModelProposal(deps.projectPath, content, {
+    proposedBy: decidedByOf(deps, req)
+  });
+  const outcome = await onApproveModelProposal(handlerDeps(deps, req, pool), record);
+  if (outcome.status === "approved") {
+    const result = {
+      disposition: "installed",
+      proposalId: record.id,
+      evicted: outcome.evicted.map((e) => e.ollamaName)
+    };
+    return sendJSON10(res, 200, result);
+  }
+  if (outcome.status === "failed_target_missing") {
+    return sendJSON10(res, 404, {
+      error: `${hfRepoId} is no longer available on HuggingFace`,
+      proposalId: record.id
+    });
+  }
+  const status = outcome.code === "not_allowed" || outcome.code === "budget_exceeded" ? 409 : 502;
+  return sendJSON10(res, status, {
+    error: outcome.message,
+    code: outcome.code,
+    proposalId: record.id
+  });
+}
+async function handleRemove(req, res, deps) {
+  const pool = deps.getModelPool();
+  if (pool === null) return sendJSON10(res, 503, { error: "LMLM disabled" });
+  const body = await readJsonBody(req);
+  if (body === void 0) return sendJSON10(res, 400, { error: "invalid JSON body" });
+  const ollamaName = typeof body.ollamaName === "string" ? body.ollamaName : "";
+  if (ollamaName.length === 0) return sendJSON10(res, 400, { error: "ollamaName is required" });
+  const entry = pool.snapshot().entries.find((e) => e.ollamaName === ollamaName);
+  if (!entry) return sendJSON10(res, 404, { error: `${ollamaName} is not in the pool` });
+  const content = {
+    action: "evict",
+    target: { hfRepoId: entry.hfRepoId, ollamaName },
+    scoreDelta: 0,
+    justification: {
+      summary: `Operator-initiated removal of ${ollamaName}.`,
+      benchmarkBasis: [],
+      hardwareFit: "",
+      evidence: "operator",
+      freshness: ""
+    },
+    diskImpactGb: entry.sizeOnDiskGb
+  };
+  const record = await createModelProposal(deps.projectPath, content, {
+    proposedBy: decidedByOf(deps, req)
+  });
+  const outcome = await onApproveModelProposal(handlerDeps(deps, req, pool), record);
+  if (outcome.status === "error") {
+    return sendJSON10(res, 502, {
+      error: outcome.message,
+      code: outcome.code,
+      proposalId: record.id
+    });
+  }
+  if (outcome.status === "failed_target_missing") {
+    return sendJSON10(res, 500, {
+      error: "unexpected failed_target_missing on evict",
+      proposalId: record.id
+    });
+  }
+  if (outcome.evicted.length > 0) {
+    const result2 = {
+      disposition: "removed",
+      proposalId: record.id,
+      evicted: outcome.evicted.map((e) => e.ollamaName)
+    };
+    return sendJSON10(res, 200, result2);
+  }
+  const stillPresent = pool.snapshot().entries.some((e) => e.ollamaName === ollamaName);
+  if (stillPresent) {
+    const result2 = {
+      disposition: "deferred",
+      proposalId: record.id,
+      evicted: [],
+      message: "model is in use; it will be removed after the current run"
+    };
+    return sendJSON10(res, 202, result2);
+  }
+  const result = { disposition: "removed", proposalId: record.id, evicted: [] };
+  return sendJSON10(res, 200, result);
+}
+function handleV1LocalModelsMutationRoute(req, res, deps) {
+  const url = req.url ?? "";
+  if ((req.method ?? "GET") !== "POST") return false;
+  if (INSTALL_RE.test(url)) {
+    void handleInstall(req, res, deps);
+    return true;
+  }
+  if (REMOVE_RE.test(url)) {
+    void handleRemove(req, res, deps);
+    return true;
+  }
+  return false;
+}
+
 // src/server/routes/v1/routing.ts
 import { z as z14 } from "zod";
 var CONFIG_RE = /^\/api\/v1\/routing\/config(?:\?.*)?$/;
 var DECISIONS_RE = /^\/api\/v1\/routing\/decisions(?:\?.*)?$/;
 var TRACE_RE = /^\/api\/v1\/routing\/trace(?:\?.*)?$/;
-function sendJSON10(res, status, body) {
+function sendJSON11(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function unavailable(res) {
-  sendJSON10(res, 503, { error: "BackendRouter not available" });
+  sendJSON11(res, 503, { error: "BackendRouter not available" });
   return true;
 }
 function resolveChain(value, backends) {
@@ -9186,7 +9367,7 @@ function buildResolvedChains(routing, backends) {
 }
 function handleConfig(res, deps) {
   if (!deps.router || !deps.routing || !deps.backends) return unavailable(res);
-  sendJSON10(res, 200, {
+  sendJSON11(res, 200, {
     routing: deps.routing,
     resolvedChains: buildResolvedChains(deps.routing, deps.backends),
     backends: Object.keys(deps.backends)
@@ -9214,7 +9395,7 @@ function parseDecisionsQuery(url) {
 function handleDecisions(req, res, deps) {
   if (!deps.bus) return unavailable(res);
   const filter = parseDecisionsQuery(req.url ?? "");
-  sendJSON10(res, 200, { decisions: deps.bus.recent(filter) });
+  sendJSON11(res, 200, { decisions: deps.bus.recent(filter) });
   return true;
 }
 var UseCaseSchema = z14.discriminatedUnion("kind", [
@@ -9246,19 +9427,19 @@ async function handleTrace(req, res, deps) {
   try {
     raw = await readBody(req);
   } catch {
-    sendJSON10(res, 400, { error: "body read failed" });
+    sendJSON11(res, 400, { error: "body read failed" });
     return true;
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    sendJSON10(res, 400, { error: "invalid JSON body" });
+    sendJSON11(res, 400, { error: "invalid JSON body" });
     return true;
   }
   const r = TraceBodySchema.safeParse(parsed);
   if (!r.success) {
-    sendJSON10(res, 400, { error: r.error.message });
+    sendJSON11(res, 400, { error: r.error.message });
     return true;
   }
   const opts = r.data.invocationOverride !== void 0 ? { invocationOverride: r.data.invocationOverride } : void 0;
@@ -9271,9 +9452,9 @@ async function handleTrace(req, res, deps) {
       r.data.useCase,
       opts
     );
-    sendJSON10(res, 200, { decision, def: { type: def.type } });
+    sendJSON11(res, 200, { decision, def: { type: def.type } });
   } catch (err) {
-    sendJSON10(res, 500, { error: String(err) });
+    sendJSON11(res, 500, { error: String(err) });
   }
   return true;
 }
@@ -9514,7 +9695,7 @@ var CreateBodySchema = z16.object({
   tenantId: z16.string().optional(),
   expiresAt: z16.string().datetime().optional()
 });
-function sendJSON11(res, status, body) {
+function sendJSON12(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -9524,19 +9705,19 @@ async function handlePost(req, res, store) {
     raw = await readBody(req);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to read body";
-    sendJSON11(res, 413, { error: msg });
+    sendJSON12(res, 413, { error: msg });
     return;
   }
   let json;
   try {
     json = JSON.parse(raw);
   } catch {
-    sendJSON11(res, 400, { error: "Invalid JSON body" });
+    sendJSON12(res, 400, { error: "Invalid JSON body" });
     return;
   }
   const parsed = CreateBodySchema.safeParse(json);
   if (!parsed.success) {
-    sendJSON11(res, 422, { error: "Invalid body", issues: parsed.error.issues });
+    sendJSON12(res, 422, { error: "Invalid body", issues: parsed.error.issues });
     return;
   }
   try {
@@ -9549,37 +9730,37 @@ async function handlePost(req, res, store) {
     if (parsed.data.expiresAt !== void 0) input.expiresAt = parsed.data.expiresAt;
     const result = await store.create(input);
     const publicRecord = AuthTokenPublicSchema.parse(result.record);
-    sendJSON11(res, 200, {
+    sendJSON12(res, 200, {
       ...publicRecord,
       token: result.token
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to create token";
     if (msg.includes("already exists")) {
-      sendJSON11(res, 409, { error: msg });
+      sendJSON12(res, 409, { error: msg });
       return;
     }
-    sendJSON11(res, 500, { error: "Internal error creating token" });
+    sendJSON12(res, 500, { error: "Internal error creating token" });
   }
 }
 async function handleList3(res, store) {
   try {
     const list = await store.list();
-    sendJSON11(res, 200, list);
+    sendJSON12(res, 200, list);
   } catch {
-    sendJSON11(res, 500, { error: "Internal error listing tokens" });
+    sendJSON12(res, 500, { error: "Internal error listing tokens" });
   }
 }
 async function handleDelete2(res, store, id) {
   try {
     const ok = await store.revoke(id);
     if (!ok) {
-      sendJSON11(res, 404, { error: "Token not found" });
+      sendJSON12(res, 404, { error: "Token not found" });
       return;
     }
-    sendJSON11(res, 200, { deleted: true });
+    sendJSON12(res, 200, { deleted: true });
   } catch {
-    sendJSON11(res, 500, { error: "Internal error revoking token" });
+    sendJSON12(res, 500, { error: "Internal error revoking token" });
   }
 }
 var DELETE_PATH_RE2 = /^\/api\/v1\/auth\/tokens\/([^/?]+)(?:\?.*)?$/;
@@ -9604,12 +9785,12 @@ function handleAuthRoute(req, res, store) {
       return true;
     }
   }
-  sendJSON11(res, 405, { error: "Method not allowed" });
+  sendJSON12(res, 405, { error: "Method not allowed" });
   return true;
 }
 
 // src/server/routes/local-model.ts
-function sendJSON12(res, status, body) {
+function sendJSON13(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -9617,30 +9798,30 @@ function handleLocalModelRoute(req, res, getStatus) {
   const { method, url } = req;
   if (url !== "/api/v1/local-model/status") return false;
   if (method !== "GET") {
-    sendJSON12(res, 405, { error: "Method not allowed" });
+    sendJSON13(res, 405, { error: "Method not allowed" });
     return true;
   }
   if (!getStatus) {
-    sendJSON12(res, 503, { error: "Local backend not configured" });
+    sendJSON13(res, 503, { error: "Local backend not configured" });
     return true;
   }
   const status = getStatus();
   if (!status) {
-    sendJSON12(res, 503, { error: "Local backend not configured" });
+    sendJSON13(res, 503, { error: "Local backend not configured" });
     return true;
   }
-  sendJSON12(res, 200, status);
+  sendJSON13(res, 200, status);
   return true;
 }
 function handleLocalModelsRoute(req, res, getStatuses) {
   const { method, url } = req;
   if (url !== "/api/v1/local-models/status") return false;
   if (method !== "GET") {
-    sendJSON12(res, 405, { error: "Method not allowed" });
+    sendJSON13(res, 405, { error: "Method not allowed" });
     return true;
   }
   const statuses = getStatuses ? getStatuses() : [];
-  sendJSON12(res, 200, statuses);
+  sendJSON13(res, 200, statuses);
   return true;
 }
 
@@ -10016,6 +10197,21 @@ var V1_BRIDGE_ROUTES = [
     scope: "manage-proposals",
     description: "Force a background-scheduler refresh tick and return emitted proposals (O4)."
   },
+  // ── LMLM dashboard pool mutation — operator-initiated install/remove ──
+  // Modeled as auto-approved model proposals, so the same `manage-proposals`
+  // write scope that governs approve/reject governs these too.
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/pool\/install(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Install a recommended model into the local pool (auto-approved proposal)."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/pool\/remove(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Remove a model from the local pool (auto-approved proposal)."
+  },
   // ── LMLM Phase 7 — read surface (hardware/pool/recommendations/proposals) ──
   // Load-bearing: `local-models` is in `V1_WRAPPABLE`, so without these entries
   // the `/api/v1` rewrite shim would rewrite `/api/v1/local-models/<name>` →
@@ -10450,6 +10646,17 @@ var OrchestratorServer = class {
           ...this.isModelInUseFn ? { isModelInUse: this.isModelInUseFn } : {}
         });
       },
+      // LMLM dashboard pool mutation — POST /pool/install + /pool/remove.
+      // Operator-initiated install/remove via auto-approved proposals; reuses
+      // the same mutation pool + bus + in-use probe the proposals route uses.
+      // Registered before the read surface so /pool/install|remove match first.
+      (req, res) => handleV1LocalModelsMutationRoute(req, res, {
+        projectPath: this.projectPath,
+        bus: this.orchestrator,
+        getModelPool: () => this.getModelPoolFn?.() ?? null,
+        ...this.getRecommendationsFn ? { getRecommendations: this.getRecommendationsFn } : {},
+        ...this.isModelInUseFn ? { isModelInUse: this.isModelInUseFn } : {}
+      }),
       // LMLM Phase 6/7 — POST /refresh + the GET read surface
       // (hardware/pool/recommendations/proposals). Registered before the
       // chat-proxy fallback so it owns the path. Each accessor is spread in
@@ -15061,6 +15268,24 @@ ${messages}`);
     });
     this.modelPool = new PoolManager({ store, installer: this.modelInstaller, onWarn });
   }
+  /**
+   * LMLM Phase 7 wiring: apply the operator's configured pool bounds (disk
+   * budget + org/family allowlist) from `localModels.pool` to the live pool.
+   * Called after `PoolStateStore.load()` so config wins over persisted bounds
+   * (D2, declarative precedence). No-op when the pool is null (LMLM disabled)
+   * or no `pool` block is configured, so it is safe to call unconditionally
+   * on the startup path.
+   */
+  async applyConfiguredPoolBounds() {
+    const pool = this.modelPool;
+    const bounds = this.config.localModels?.pool;
+    if (pool === null || !bounds) return;
+    await pool.configurePool({
+      diskBudgetGb: bounds.diskBudgetGb,
+      allowedOrgs: bounds.allowedOrgs,
+      allowedFamilies: bounds.allowedFamilies
+    });
+  }
   /**
    * LMLM Phase 6: arm the single background refresh scheduler over the live
    * pool. No-op when LMLM is disabled (`modelPool` null). Each tick runs
@@ -15077,7 +15302,18 @@ ${messages}`);
     if (this.modelPool === null) return;
     const pool = this.modelPool;
     const refreshCfg = this.config.localModels?.refresh;
-    const recommend = createNativeRecommender({ candidates: [] });
+    const frozen = loadFrozenCandidates();
+    const candidates = selectCandidates2(frozen.candidates, this.config.localModels?.pool);
+    for (const warning of frozen.warnings) {
+      this.logger.warn("LMLM frozen candidate snapshot degraded", { warning });
+    }
+    if (candidates.length === 0) {
+      this.logger.warn("LMLM recommender has no candidates", {
+        frozenCount: frozen.candidates.length,
+        allowedOrgs: this.config.localModels?.pool?.allowedOrgs ?? []
+      });
+    }
+    const recommend = createNativeRecommender({ candidates });
     this.modelRecommender = recommend;
     this.refreshScheduler = new RefreshScheduler({
       runTick: () => runRefreshTick({
@@ -15088,7 +15324,7 @@ ${messages}`);
         // Phase 7: after persisting the proposal, emit `local-models:proposal`
         // (== MODEL_PROPOSAL_TOPIC) on the bus so it fans out to WS clients and
         // notification sinks. Literal to avoid a proposals/model-handlers cycle.
-        emitProposal: (c) => createModelProposal(this.projectRoot, c).then((record) => {
+        emitProposal: (c) => createModelProposal2(this.projectRoot, c).then((record) => {
           this.emit("local-models:proposal", {
             id: record.id,
             status: "created",
@@ -15154,6 +15390,7 @@ ${messages}`);
       }
       if (this.poolStateStore !== null) {
         await this.poolStateStore.load();
+        await this.applyConfiguredPoolBounds();
       }
       for (const resolver of this.localResolvers.values()) {
         await resolver.start();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/orchestrator",
-  "version": "0.10.0",
+  "version": "0.11.2",
   "description": "Orchestrator daemon for dispatching coding agents to issues",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -37,22 +37,22 @@
   "homepage": "https://github.com/Intense-Visions/harness-engineering/tree/main/packages/orchestrator#readme",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.95.1",
-    "@earendil-works/pi-coding-agent": "^0.74.1",
+    "@earendil-works/pi-coding-agent": "^0.79.0",
     "@google/genai": "^2.0.4",
     "bcryptjs": "^2.4.3",
     "better-sqlite3": "^12.10.0",
     "ink": "^4.4.1",
-    "liquidjs": "^10.25.7",
+    "liquidjs": "^10.26.0",
     "openai": "^6.0.0",
     "react": "^18.3.1",
     "ws": "^8.21.0",
     "yaml": "^2.8.3",
     "zod": "^3.25.76",
-    "@harness-engineering/core": "0.34.0",
-    "@harness-engineering/graph": "0.11.4",
-    "@harness-engineering/intelligence": "0.4.2",
-    "@harness-engineering/local-models": "0.3.0",
-    "@harness-engineering/types": "0.18.0"
+    "@harness-engineering/core": "0.34.1",
+    "@harness-engineering/graph": "0.11.5",
+    "@harness-engineering/local-models": "0.4.0",
+    "@harness-engineering/intelligence": "0.4.3",
+    "@harness-engineering/types": "0.19.0"
   },
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^7.3.0",