alasio 8.0.0 → 10.0.0

package/dist/cli/src/manifests/alasio.js

@@ -1,311 +1,72 @@
 /**
- * alasio itself: its Deployment, its telemetry receiver's Service, the
- * namespaces its workspaces run in, its identity in them, and the templates it makes
- * its workspaces' Sandboxes from (src/kube/config.ts); main's, or a branch environment's
- * in its own namespaces (./branch.ts), and main's Service of the forks it makes for them.
+ * alasio itself: its Deployment, the namespaces its workspaces run in, its identity in
+ * them, and the template it makes its folder workspaces' Sandboxes from (src/kube/
+ * config.ts); main's, or a branch environment's in its own namespaces (./branch.ts), and
+ * main's Service of the forks it asks the sandbox gateway for them.
  */
-import { isDeepStrictEqual } from "node:util";
-import { Result } from "effect";
-import { BRANCH_FORK_PORT, branchSessionsNamespace } from "../../../src/branch/names.js";
-import { decodeKubeTemplates } from "../../../src/kube/config.js";
-import { BAYMA_STOP_SECONDS, CPU_FEATURES_ANNOTATION, STOP_WAIT_ARG } from "../../../src/kube/sandbox-shape.js";
-import { gvisorRuntimeClass, NODE_AGENT_PORT, NODE_AGENT_TOKEN_VARIABLE } from "../../../src/node-agent/names.js";
+import { posix } from "node:path";
+import { BRANCH_PARENT_LABEL, branchSessionsNamespace, forksGroup, forksTopic, MAIN_ENVIRONMENT_NAME } from "../../../src/branch/names.js";
+import { eventsGroup, eventsTopic } from "../../../src/events/names.js";
+import { ALASIO_GATEWAY_CALLER_KEY_VARIABLE, ALASIO_GATEWAY_ENVIRONMENT_VARIABLE, ALASIO_GATEWAY_FOLDERS_VARIABLE, ALASIO_GATEWAY_URL_VARIABLE } from "../../../src/gateway/names.js";
+import { STARTED_CONFIG_MAP } from "../../../src/kube/started-map.js";
 import { gvisorReleases, NODE_PINS } from "../cluster/node.js";
 import { imageReference } from "../images.js";
-import { alasioAccount, busyLabelPolicy, cloneJobPolicy, resumedConditionPolicy, sandboxPolicy, sandboxPolicyName, secretPolicy } from "./admission.js";
-import { alasioGroup, environmentLogSecret, environmentName, lakeWakeTopic, LOG_BROKERS, telegramTopic } from "./log.js";
-import { BRANCH_FORK_SECRET, BRANCH_LABEL, componentName, databaseSecret, envOf, given, goJson, helperResources, hostVolumeMounts, hostVolumes, imagePullSecrets, labels, lakeRuns, MAIN_ENVIRONMENT, NAMESPACE, nodeAgentRuns, ONE, otelEnv, RELEASE, replicasOf, restrictedContainer, restrictedPod, roleVerifiers, selectorLabels, sha256, } from "./common.js";
+import { busyLabelPolicy } from "./admission.js";
+import { codexLoginObjects, codexLoginUrl } from "./codex-login.js";
+import { foldersRun } from "./folders.js";
+import { carriedPools, GATEWAY, GATEWAY_PORT } from "./sandbox-gateway.js";
+import { alasioGroup, environmentLogSecret, environmentName, lagTrigger, lakeWakeTopic, LOG_BROKERS, logAuthentication, telegramTopic } from "./log.js";
+import { scaledObject } from "./scalers.js";
+import { STOP_GRACE_SECONDS } from "../../../src/telegram/stop.js";
+import { BRANCH_FORK_SECRET, BRANCH_LABEL, componentName, DATABASE_SECRET, envOf, given, imagePullSecrets, labels, lakeRuns, MAIN_ENVIRONMENT, NAMESPACE, otelEnv, RELEASE, replicasOf, restrictedContainer, restrictedPod, roleVerifiers, selectorLabels, SESSIONS_CALLER_SECRET, } from "./common.js";
 import { durationSeconds } from "./config.js";
-import { busyBudget } from "./disruption.js";
+import { busyBudget, replicaBudget, spread } from "./disruption.js";
 import { priority } from "./priorities.js";
 import { verticalPodAutoscaler } from "./sizing.js";
-import { cloneJob } from "./workspace-storage.js";
-/** The port every workspace's bayma serves MCP on. */
-const BAYMA_PORT = 7290;
 /** The namespace of the sessions of the alasio of `environment`: the configured one, or a branch environment's own. */
 export function sessionsNamespace(config, { branch }) {
     return branch ? branchSessionsNamespace(branch) : config.sessions.namespace;
 }
-/** The namespaces whose Sandboxes alasio drives: the sessions', and the host profile's. */
-function workspaceNamespaces(config, environment) {
-    return [...(config.sessions.enabled ? [sessionsNamespace(config, environment)] : []), ...(config.host.enabled ? [config.host.namespace] : [])];
-}
-/**
- * The template of session filesystems' Sandboxes: an empty, isolated workspace under
- * the sessions' runtime, restricted, on a volume of workspace storage's class when it is
- * on. alasio adds what is per Sandbox: its name and labels, bayma's token, and its
- * network mode. A branch environment's are in its own namespace, and neither clones a
- * session (its parent does, src/branch/fork.ts) nor removes JuiceFS's mount pods, which
- * are main's to drive.
- */
-function sessionsProfile(config, environment, { cpuBaseline, gvisorReleases }) {
-    const { sessions, workspaceStorage } = config;
-    const main = environment.branch === null;
-    // Snapshotted once every node's CPU features are known, its sandboxes held to those all have.
-    const snapshotted = main && nodeAgentRuns(config) && cpuBaseline !== null;
-    const agent = imageReference(config.images.agent);
-    const storageClassName = sessions.storage.storageClassName || (workspaceStorage.enabled ? workspaceStorage.storageClassName : "");
-    // On workspace storage, the volume's mounts follow its mount pod's, as upstream's
-    // template has them (gVisor does not, and alasio restarts a session whose mount is
-    // gone), and its files are given the pod's group only when its root is not the group's,
-    // as walking a JuiceFS volume is slow.
-    const propagation = workspaceStorage.enabled ? { mountPropagation: "HostToContainer" } : {};
-    const ownership = workspaceStorage.enabled ? { fsGroupChangePolicy: "OnRootMismatch" } : {};
-    return {
-        namespace: sessionsNamespace(config, environment),
-        port: BAYMA_PORT,
-        workspaceDir: "/workspace",
-        egressGate: sessions.egressGate,
-        fullModeNameservers: [...sessions.fullModeNameservers],
-        ...(main && mountPodsRemoved(config) ? { mountPodNamespace: workspaceStorage.csi.namespace } : {}),
-        podTemplate: {
-            metadata: {
-                labels: { "app.kubernetes.io/part-of": "alasio", "app.kubernetes.io/instance": RELEASE, "app.kubernetes.io/component": "session" },
-                // Under gVisor, /tmp is a tmpfs of the sandbox's own, by gVisor's mount hints, rather
-                // than the emptyDir's directory on the node: a snapshot of the sandbox holds it, as it
-                // holds the files that bayma's runtimes keep open there.
-                annotations: {
-                    "dev.gvisor.spec.mount.tmp.share": "container",
-                    "dev.gvisor.spec.mount.tmp.type": "tmpfs",
-                    "dev.gvisor.spec.mount.tmp.options": "rw",
-                    ...(snapshotted ? { [CPU_FEATURES_ANNOTATION]: cpuBaseline.join(",") } : {}),
-                },
-            },
-            spec: {
-                ...(sessions.runtimeClassName ? { runtimeClassName: sessions.runtimeClassName } : {}),
-                ...priority("turn"),
-                // A pod that ends is ended: alasio brings the session up in a new one, and nothing
-                // starts bayma again in a sandbox that a snapshot has just ended.
-                restartPolicy: "Never",
-                // Ended by other than alasio, bayma holds its stop for alasio's snapshot, then stops.
-                ...(snapshotted ? { terminationGracePeriodSeconds: stopWaitSeconds(config) + BAYMA_STOP_SECONDS } : {}),
-                securityContext: { ...restrictedPod(1000, 1000), ...ownership },
-                ...imagePullSecrets(config),
-                ...given("nodeSelector", { ...sessions.nodeSelector }),
-                ...given("tolerations", [...sessions.tolerations]),
-                initContainers: [
-                    // The workspace and home on the session's volume, and bayma's toolbelt, which the
-                    // image installs, linked into the home.
-                    {
-                        name: "prepare",
-                        image: agent,
-                        imagePullPolicy: config.images.pullPolicy,
-                        command: [
-                            "/bin/sh",
-                            "-c",
-                            "mkdir -p /data/workspace /data/home/.local/share/bayma && ln -sfn /opt/bayma-data/bayma/toolbelt /data/home/.local/share/bayma/toolbelt",
-                        ],
-                        securityContext: restrictedContainer(),
-                        ...helperResources(),
-                        volumeMounts: [{ name: "data", mountPath: "/data" }],
-                    },
-                ],
-                containers: [{
-                        name: "bayma",
-                        image: agent,
-                        imagePullPolicy: config.images.pullPolicy,
-                        command: ["/usr/bin/tini", "-s", "--", "node", "/opt/bayma/bayma.js"],
-                        args: [
-                            "mcp-http",
-                            "--host",
-                            "0.0.0.0",
-                            "--port",
-                            String(BAYMA_PORT),
-                            "--state-dir",
-                            "/home/agent/.bayma",
-                            ...(snapshotted ? [STOP_WAIT_ARG, String(stopWaitSeconds(config) * 1000)] : []),
-                        ],
-                        workingDir: "/workspace",
-                        env: [
-                            { name: "HOME", value: "/home/agent" },
-                            { name: "USER", value: "agent" },
-                            { name: "BAYMA_PAYLOAD_DIR", value: "/opt/bayma/payload" },
-                        ],
-                        ports: [{ name: "mcp", containerPort: BAYMA_PORT }],
-                        securityContext: restrictedContainer(),
-                        resources: sessions.resources,
-                        volumeMounts: [
-                            { name: "data", mountPath: "/workspace", subPath: "workspace", ...propagation },
-                            { name: "data", mountPath: "/home/agent", subPath: "home", ...propagation },
-                            { name: "tmp", mountPath: "/tmp" },
-                        ],
-                    }],
-                volumes: [{ name: "tmp", emptyDir: { sizeLimit: "2Gi" } }],
-            },
-        },
-        volumeClaimTemplates: [{
-                metadata: { name: "data" },
-                spec: {
-                    accessModes: ["ReadWriteOnce"],
-                    ...(storageClassName ? { storageClassName } : {}),
-                    resources: { requests: { storage: sessions.storage.size } },
-                },
-            }],
-        ...(main && sessionsForked(config) ? { clone: { claimTemplate: "data", job: cloneJob(config) } } : {}),
-        ...(snapshotted ? { snapshots: sessionSnapshots(config, gvisorReleases) } : {}),
-    };
-}
 /** How long a session's bayma holds a stop alasio did not make (sessions.snapshots.stopWait). */
-function stopWaitSeconds(config) {
+export function stopWaitSeconds(config) {
     // A duration, as the configuration checks it.
     return durationSeconds(config.sessions.snapshots.stopWait) ?? 0;
 }
-/**
- * How session sandboxes are snapshotted as they are released (src/sandbox/snapshots.ts),
- * where the node agents run: once sessions.snapshots.releaseAfter has passed without an
- * exec or a turn, live every sessions.snapshots.liveEvery while execs run, and as their
- * pods are ended by other than alasio, within sessions.snapshots.stopWait, under the
- * gVisor `releases` alasio keeps (../kept-releases.ts), the
- * current one first, each restored with a RuntimeClass of its own, by the agents in
- * alasio's namespace.
- */
-function sessionSnapshots(config, releases) {
-    return {
-        // A duration, as the configuration checks it.
-        releaseAfterSeconds: durationSeconds(config.sessions.snapshots.releaseAfter) ?? 0,
-        liveEverySeconds: durationSeconds(config.sessions.snapshots.liveEvery) ?? 0,
-        releases: releases.map((release) => ({ release, runtimeClassName: gvisorRuntimeClass(release) })),
-        agents: {
-            namespace: NAMESPACE,
-            selector: Object.entries(selectorLabels("node-agent")).map(([label, value]) => `${label}=${value}`).join(","),
-            port: NODE_AGENT_PORT,
-        },
-    };
-}
-/** Whether alasio forks sessions: where their volumes are workspace storage's, which JuiceFS clones. */
-export function sessionsForked({ sessions, workspaceStorage }) {
-    return workspaceStorage.enabled && [workspaceStorage.storageClassName, ""].includes(sessions.storage.storageClassName);
-}
-/** The template of folder workspaces' bayma: bayma itself, as the operator, with the machine's mounts. */
-function hostProfile(config) {
-    const { host } = config;
-    return {
-        namespace: host.namespace,
-        port: BAYMA_PORT,
-        stateRoot: host.stateRoot,
-        podTemplate: {
-            metadata: { labels: { "app.kubernetes.io/part-of": "alasio", "app.kubernetes.io/instance": RELEASE, "app.kubernetes.io/component": "folder-bayma" } },
-            spec: {
-                // May restart alasio, by rolling out its Deployment, as an agent restarts it.
-                serviceAccountName: componentName("host-agent"),
-                ...priority("turn"),
-                securityContext: {
-                    runAsUser: host.uid,
-                    runAsGroup: host.gid,
-                    // The group the bayma token's Secret volume is given, which the operator's user
-                    // reads it as; the node's own paths the mounts give are left as they are.
-                    fsGroup: host.gid,
-                    ...given("supplementalGroups", [...host.supplementalGroups]),
-                },
-                ...imagePullSecrets(config),
-                containers: [{
-                        name: "bayma",
-                        image: imageReference(host.baymaImage),
-                        imagePullPolicy: "IfNotPresent",
-                        args: ["mcp-http", "--host", "0.0.0.0", "--port", String(BAYMA_PORT), "--default-durability", "checkpointed"],
-                        workingDir: host.home,
-                        env: [{ name: "HOME", value: host.home }, ...envOf(host.env)],
-                        ports: [{ name: "mcp", containerPort: BAYMA_PORT }],
-                        securityContext: {
-                            // What bayma needs to snapshot its REPL sessions' processes as it stops and
-                            // restore them whole as it starts again.
-                            capabilities: { add: ["CHECKPOINT_RESTORE", "SYS_PTRACE"] },
-                            seccompProfile: { type: "Unconfined" },
-                            appArmorProfile: { type: "Unconfined" },
-                        },
-                        resources: host.resources,
-                        ...given("volumeMounts", hostVolumeMounts(config)),
-                    }],
-                ...given("volumes", hostVolumes(config)),
-            },
-        },
-    };
-}
-/** What a cluster keeps where up has found nothing of it yet: no baseline, the releases pinned, and no bot. */
-export const NOTHING_KEPT = { cpuBaseline: null, gvisorReleases: gvisorReleases(NODE_PINS), botChecksum: null };
+/** What a cluster keeps where up has found nothing of it yet: no baseline, the releases pinned, no bot, no API server known, and none of the mount's Services. */
+export const NOTHING_KEPT = { cpuBaseline: null, gvisorReleases: gvisorReleases(NODE_PINS), botChecksum: null, apiServer: null, mountServices: {} };
 /** Nothing carried forward: a first installation's, and a branch environment's. */
-export const NOTHING_CARRIED = { previousSessions: null, ...NOTHING_KEPT };
-/** The ConfigMap of the templates, by its name. */
-export const SANDBOX_TEMPLATES = componentName("sandbox-templates");
+export const NOTHING_CARRIED = { previousPools: { none: null, full: null }, ...NOTHING_KEPT };
 /**
  * What the installation `config` describes, with what the cluster keeps, `kept`, carries
- * forward from `live`, the templates of the installation it replaces (its ConfigMap's
- * `templates.json`, if it has one): the sessions' profile it ran, where their template
- * changes, or else the one it carried. A profile is carried for one change of the
- * template, and no more. Pure, for tests.
- *
- * What it carries is pinned whole into the Sandbox policy (./admission.ts) as a template
- * alasio may make a Sandbox from, read back from the cluster rather than rendered from the
- * config: the ConfigMap is the anchor of that trust. It is one as long as only the
- * operator, by `alasio up`, writes it: alasio's ServiceAccount may write no ConfigMap
- * (./alasio.ts identity). Were alasio given that, it could write any pod template into
- * the ConfigMap, and the next `up` would let it make Sandboxes of it.
- */
-export function carriedFrom(config, live, kept) {
-    const nothing = { ...NOTHING_CARRIED, ...kept };
-    if (!config.sessions.enabled || live === undefined)
-        return nothing;
-    // Carried as the ConfigMap held them, which alasio read as they are: the profile a snapshot recorded the hash of.
-    if (Result.isFailure(decodeKubeTemplates(SANDBOX_TEMPLATES, live)))
-        return nothing;
-    const held = JSON.parse(live);
-    if (!held.sessions)
-        return nothing;
-    // The current profile as the ConfigMap holds it, to compare with what it held.
-    const current = JSON.parse(goJson(sessionsProfile(config, MAIN_ENVIRONMENT, kept), ""));
-    return { previousSessions: isDeepStrictEqual(held.sessions.podTemplate, current.podTemplate) ? (held.previousSessions ?? null) : held.sessions, ...kept };
-}
-/**
- * The CPU baseline the installation whose templates are `live` (as carriedFrom takes
- * them) holds sessions to: what its sessions' template sets, if anything.
+ * forward from `liveGateway`, the sandbox gateway's configuration of the installation it
+ * replaces (its ConfigMap's `config.json`, if it has one): its pools' templates before the
+ * current ones (./sandbox-gateway.ts carriedPools). Pure, for tests.
  */
-export function recordedCpuBaseline(live) {
-    if (live === undefined || Result.isFailure(decodeKubeTemplates(SANDBOX_TEMPLATES, live)))
-        return null;
-    const held = JSON.parse(live);
-    const recorded = held.sessions?.podTemplate.metadata?.annotations?.[CPU_FEATURES_ANNOTATION];
-    return recorded ? recorded.split(",") : null;
-}
-/** The ConfigMap of the templates, and their checksum, which alasio's pod carries so it is replaced when they change. */
-function sandboxTemplates(config, environment, carried) {
-    const name = SANDBOX_TEMPLATES;
-    const templates = goJson({
-        ...(config.sessions.enabled ? { sessions: sessionsProfile(config, environment, carried) } : {}),
-        ...(config.sessions.enabled && carried.previousSessions ? { previousSessions: carried.previousSessions } : {}),
-        ...(config.host.enabled ? { host: hostProfile(config) } : {}),
-    }, "  ");
-    return {
-        configMap: { apiVersion: "v1", kind: "ConfigMap", metadata: { name, namespace: environment.namespace, labels: labels("alasio") }, data: { "templates.json": templates } },
-        checksum: sha256(templates),
-    };
+export function carriedFrom(config, kept, liveGateway) {
+    return { ...kept, previousPools: carriedPools(config, liveGateway, kept) };
 }
 /** Where alasio's Secrets of branch environments are mounted: main's key, or a branch's token. */
 const BRANCH_SECRETS = "/run/alasio/branch";
 /**
  * What alasio is told of branch environments: main, where it forks sessions, where the
  * key their tokens are signed with is, from the stack's Secret, which may be made after
- * it starts; a branch, which it is, and where its parent forks the sessions it inherited
- * for it, with its token (src/branch/fork.ts).
+ * it starts; a branch, which it is, and its token to ask its parent to fork the sessions it
+ * inherited with, on the log (src/branch/fork.ts).
  */
-function branchEnv(config, { branch }) {
+function branchEnv({ branch }) {
     if (branch) {
         return [
             { name: "ALASIO_BRANCH", value: branch },
-            { name: "ALASIO_PARENT_FORKS_URL", value: `http://${componentName("branches")}.${NAMESPACE}.svc:${BRANCH_FORK_PORT}` },
             { name: "ALASIO_BRANCH_FORK_TOKEN_FILE", value: `${BRANCH_SECRETS}/token` },
         ];
     }
-    return forksForBranches(config) ? [{ name: "ALASIO_BRANCH_FORK_KEY_FILE", value: `${BRANCH_SECRETS}/fork-key` }] : [];
+    return [{ name: "ALASIO_BRANCH_FORK_KEY_FILE", value: `${BRANCH_SECRETS}/fork-key` }];
 }
 /** The volume of branch environments' Secret: main's key, kept optional, or a branch's token. */
-function branchSecretVolume(config, { branch }) {
+function branchSecretVolume({ branch }) {
     if (branch)
         return [{ name: "branch", secret: { secretName: BRANCH_FORK_SECRET, items: [{ key: "token", path: "token" }] } }];
-    return forksForBranches(config) ? [{ name: "branch", secret: { secretName: componentName("branches"), items: [{ key: "fork-key", path: "fork-key" }], optional: true } }] : [];
-}
-/** Whether main forks its sessions for branch environments: where it has Neon to branch, and forks sessions. */
-export function forksForBranches(config) {
-    return config.neon.enabled && sessionsForked(config);
+    return [{ name: "branch", secret: { secretName: componentName("branches"), items: [{ key: "fork-key", path: "fork-key" }], optional: true } }];
 }
 /**
  * The roles main's alasio makes for what reads its Neon beside it (common.ts
@@ -319,20 +80,20 @@ function readerRoles(config, { branch }) {
 function alasioEnv(config, home, operatorHome, environment) {
     const { alasio, host } = config;
     return [
-        { name: "ALASIO_KUBE_TEMPLATES", value: "/etc/alasio/templates.json" },
         { name: "ALASIO_STATE_DIR", value: "/var/lib/alasio/state" },
         { name: "HOME", value: home },
         // A home of alasio's own does not outlast its pod; the operator's keeps their login.
         ...(operatorHome ? [] : [{ name: "ALASIO_KEEP_CODEX_LOGIN", value: "1" }]),
-        { name: "ALASIO_DEPLOYMENT", value: RELEASE },
         { name: "ALASIO_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
         { name: "ALASIO_POD", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } },
         { name: "TELEGRAM_BOT_TOKEN", valueFrom: { secretKeyRef: { name: alasio.telegram.existingSecret, key: "token" } } },
         { name: "TELEGRAM_ALLOWED_USER_IDS", valueFrom: { secretKeyRef: { name: alasio.telegram.existingSecret, key: "allowedUserIds" } } },
         { name: "ALASIO_DATABASE_URL_FILE", value: "/run/alasio/database/url" },
         { name: "ALASIO_LAKE_VERIFIER_FILE", value: "/run/alasio/database/lake-verifier" },
+        { name: "ALASIO_HARNESS_VERIFIER_FILE", value: "/run/alasio/database/harness-verifier" },
+        { name: "ALASIO_CODEX_LOGIN_VERIFIER_FILE", value: "/run/alasio/database/codex-login-verifier" },
         ...readerRoles(config, environment).map(({ key, variable }) => ({ name: variable, value: `/run/alasio/database/${key}` })),
-        { name: "ALASIO_LAKE_ENABLED", value: config.lake.enabled && config.neon.enabled ? "1" : "0" },
+        { name: "ALASIO_LAKE_ENABLED", value: config.lake.enabled ? "1" : "0" },
         // Its Telegram updates: its environment's topic, read in its group as its principal.
         { name: "ALASIO_LOG_BROKERS", value: LOG_BROKERS },
         { name: "ALASIO_LOG_USERNAME", valueFrom: { secretKeyRef: { name: environmentLogSecret(environment), key: "username" } } },
@@ -341,36 +102,84 @@ function alasioEnv(config, home, operatorHome, environment) {
         { name: "ALASIO_TELEGRAM_GROUP", value: alasioGroup(environmentName(environment)) },
         // Its environment's wake topic, which it tells the lake's loader of each transcript it writes on, as that principal.
         ...(lakeRuns(config) ? [{ name: "ALASIO_LAKE_WAKE_TOPIC", value: lakeWakeTopic(environmentName(environment)) }] : []),
-        { name: "ALASIO_TELEMETRY_RECEIVER_SERVICE", value: `${componentName("telemetry")}.${environment.namespace}.svc` },
-        { name: "ALASIO_TELEMETRY_RECEIVER_PORT", value: String(config.telemetry.receiverPort) },
         ...(alasio.defaultHarness ? [{ name: "ALASIO_DEFAULT_HARNESS", value: alasio.defaultHarness }] : []),
         ...(host.enabled && host.workspaceRoot ? [{ name: "ALASIO_WORKSPACE_ROOT", value: host.workspaceRoot }] : []),
         ...(alasio.claude.existingSecret
             ? [{ name: "CLAUDE_CODE_OAUTH_TOKEN", valueFrom: { secretKeyRef: { name: alasio.claude.existingSecret, key: alasio.claude.key } } }]
             : []),
-        // What it presents to the node agents, which snapshot its sessions.
-        ...(environment.branch === null && nodeAgentRuns(config)
-            ? [{ name: NODE_AGENT_TOKEN_VARIABLE, valueFrom: { secretKeyRef: { name: componentName("node-agent"), key: "token" } } }]
-            : []),
-        ...branchEnv(config, environment),
+        // Its environment's sessions, through the sandbox gateway, by its environment's own key of the gateway's.
+        { name: ALASIO_GATEWAY_URL_VARIABLE, value: `http://${GATEWAY}.${NAMESPACE}.svc.cluster.local:${GATEWAY_PORT}` },
+        { name: ALASIO_GATEWAY_ENVIRONMENT_VARIABLE, value: environmentName(environment) },
+        { name: ALASIO_GATEWAY_CALLER_KEY_VARIABLE, valueFrom: { secretKeyRef: { name: SESSIONS_CALLER_SECRET, key: "caller-key" } } },
+        // Main's folder workspaces, the gateway's folder instances, where the host profile renders them.
+        ...(environment.branch === null && foldersRun(config) ? [{ name: ALASIO_GATEWAY_FOLDERS_VARIABLE, value: "1" }] : []),
+        // Where its conversations' harnesses' pools' pods reach its environment's relay of its Codex login (./codex-login.ts).
+        { name: "ALASIO_CODEX_LOGIN_URL", value: codexLoginUrl(environment) },
+        ...branchEnv(environment),
         ...otelEnv(config, environment),
         ...envOf(alasio.env),
     ];
 }
 /**
- * alasio's Deployment: one replica, the one member of its group on its topic's one
- * partition, which its turns run in, so an update stops the old pod before the new one
- * starts. It keeps no volume: its state is in Neon,
+ * What of the machine alasio's pod mounts under the host profile: what alasio itself reads and
+ * writes there, now that no harness runs in its pod, each where the host profile's mounts put it
+ * (its folder conversations' harnesses run in pools of their own, with every mount):
+ * - the root its folder workspaces are under (ALASIO_WORKSPACE_ROOT, else its home), which it
+ *   lists and makes folders in, reads a reply's media from, and starts Claude Code in to list
+ *   the models its login can use (../../../src/harness/claude/models.ts);
+ * - where its home is the operator's and outside that root, the operator's Claude and Codex
+ *   homes in it, `~/.claude` and `~/.codex`: Claude Code's login and settings it lists models
+ *   with, and the Codex login its app-server keeps fresh and lists models with, and the
+ *   configuration it gives folder conversations' Codex (../../../src/codex/configuration.ts);
+ *   the rest of that home its own, an emptyDir.
+ * Nothing else: no socket, binary, or other path of the machine any mount gives. A path no mount
+ * gives is mounted from nowhere, as it was not given the machine's.
+ */
+export function hostPaths(config, home) {
+    const { host } = config;
+    if (!host.enabled)
+        return { mounts: [], volumes: [], homeIsGiven: false };
+    const under = (path, of) => path === of || path.startsWith(`${of.replace(/\/$/u, "")}/`);
+    /** Where on the machine the mount that gives `path` has it, and whether it gives it read-only; null where none does. */
+    const given = (path) => {
+        const [mount] = host.mounts.filter(({ mountPath }) => under(path, mountPath)).sort((a, b) => b.mountPath.length - a.mountPath.length);
+        return mount ? { hostPath: posix.join(mount.hostPath, posix.relative(mount.mountPath, path)), readOnly: mount.readOnly } : null;
+    };
+    const root = host.workspaceRoot || home;
+    const operatorHome = host.alasioHome;
+    const paths = [
+        { name: "workspace-root", path: root, type: "Directory" },
+        ...(operatorHome && !under(home, root)
+            ? [{ name: "claude-home", path: posix.join(home, ".claude"), type: "DirectoryOrCreate" }, { name: "codex-home", path: posix.join(home, ".codex"), type: "DirectoryOrCreate" }]
+            : []),
+    ];
+    const mounts = [];
+    const volumes = [];
+    for (const { name, path, type } of paths) {
+        const at = given(path);
+        if (!at)
+            continue;
+        mounts.push({ name, mountPath: path, ...(at.readOnly ? { readOnly: true } : {}) });
+        volumes.push({ name, hostPath: { path: at.hostPath, type } });
+    }
+    return { mounts, volumes, homeIsGiven: operatorHome && under(home, root) && given(root) !== null };
+}
+/**
+ * alasio's Deployment: of alasio.scaling's replicas, which KEDA moves between its min and max
+ * where they are apart (alasioScaling). At one at most, an update stops the old pod before the
+ * new one starts; beyond, the new one starts beside the old, which drains as it stops, within
+ * STOP_GRACE_SECONDS (src/telegram/stop.ts, src/telegram/drain.ts). It keeps no volume: its state is in Neon,
  * and what it writes to disk (received files written for the agent, its home unless it
  * is the operator's) is written again as needed, on emptyDirs. Under the
- * host profile it runs as the operator, in their home, with the machine's mounts. A
+ * host profile it runs as the operator, in their home, with what of the machine it reads
+ * itself (hostPaths), no more of the machine's mounts. A
  * branch environment's runs in its namespace on the branch's database, told it is the
  * branch, with its token to ask main to fork the sessions it inherited; main's is given
  * the key branch environments' tokens are signed with, where it forks sessions. Its pod
- * carries the checksums of its templates and, where up read it, of its bot's Secret, so
- * it is replaced when either changes.
+ * carries, where up read it, the checksum of its bot's Secret, so it is replaced when it
+ * changes.
  */
-function deployment(config, templatesChecksum, botChecksum, environment) {
+function deployment(config, botChecksum, environment) {
     const { alasio, host } = config;
     const operatorHome = host.enabled && host.alasioHome;
     const home = operatorHome ? host.home : "/var/lib/alasio/home";
@@ -378,25 +187,28 @@ function deployment(config, templatesChecksum, botChecksum, environment) {
     const gid = host.enabled ? host.gid : alasio.runAsGroup;
     const groups = [...new Set([...alasio.supplementalGroups, ...(host.enabled ? host.supplementalGroups : [])])];
     const image = imageReference(config.images.alasio);
-    const branchSecret = branchSecretVolume(config, environment);
+    const branchSecret = branchSecretVolume(environment);
+    const machine = hostPaths(config, home);
+    // Its home its own, an emptyDir, but where the machine's root it is given holds it.
+    const ownHome = !machine.homeIsGiven;
     return {
         apiVersion: "apps/v1",
         kind: "Deployment",
         metadata: { name: RELEASE, namespace: environment.namespace, labels: labels("alasio") },
         spec: {
-            ...replicasOf(ONE),
-            strategy: { type: "Recreate" },
+            ...replicasOf(alasio.scaling),
+            strategy: alasio.scaling.max > 1 ? { type: "RollingUpdate", rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } } : { type: "Recreate" },
             selector: { matchLabels: selectorLabels("alasio") },
             template: {
                 metadata: {
                     labels: labels("alasio"),
-                    annotations: { "checksum/sandbox-templates": templatesChecksum, ...(botChecksum === null ? {} : { "checksum/telegram": botChecksum }) },
+                    ...(botChecksum === null ? {} : { annotations: { "checksum/telegram": botChecksum } }),
                 },
                 spec: {
                     serviceAccountName: RELEASE,
                     ...priority("turn"),
-                    // alasio finishes its turns' bookkeeping and records what it interrupts as it stops.
-                    terminationGracePeriodSeconds: 60,
+                    // alasio finishes its turns' bookkeeping and records what it interrupts as it stops, and delivers what it owes.
+                    terminationGracePeriodSeconds: STOP_GRACE_SECONDS,
                     securityContext: { ...restrictedPod(uid, gid), ...given("supplementalGroups", groups) },
                     ...imagePullSecrets(config),
                     containers: [{
@@ -406,68 +218,51 @@ function deployment(config, templatesChecksum, botChecksum, environment) {
                             workingDir: home,
                             env: alasioEnv(config, home, operatorHome, environment),
                             ...given("envFrom", [...alasio.envFrom]),
-                            ports: [
-                                { name: "telemetry", containerPort: config.telemetry.receiverPort },
-                                ...(environment.branch === null && forksForBranches(config) ? [{ name: "branch-forks", containerPort: BRANCH_FORK_PORT }] : []),
-                            ],
                             securityContext: restrictedContainer(),
                             resources: alasio.resources,
                             volumeMounts: [
                                 { name: "state", mountPath: "/var/lib/alasio/state" },
-                                ...(operatorHome ? [] : [{ name: "alasio-home", mountPath: home }]),
-                                { name: "templates", mountPath: "/etc/alasio", readOnly: true },
+                                ...(ownHome ? [{ name: "alasio-home", mountPath: home }] : []),
                                 { name: "database", mountPath: "/run/alasio/database", readOnly: true },
                                 { name: "log", mountPath: "/run/alasio/log", readOnly: true },
                                 ...branchSecret.map(({ name }) => ({ name, mountPath: BRANCH_SECRETS, readOnly: true })),
-                                ...(host.enabled ? hostVolumeMounts(config) : []),
+                                ...machine.mounts,
                             ],
                         }],
                     volumes: [
                         { name: "state", emptyDir: {} },
-                        ...(operatorHome ? [] : [{ name: "alasio-home", emptyDir: {} }]),
-                        { name: "templates", configMap: { name: componentName("sandbox-templates") } },
+                        ...(ownHome ? [{ name: "alasio-home", emptyDir: {} }] : []),
                         {
                             name: "database",
                             secret: {
-                                secretName: databaseSecret(config),
-                                items: ["url", "lake-verifier", ...readerRoles(config, environment).map(({ key }) => key)].map((key) => ({ key, path: key })),
+                                secretName: DATABASE_SECRET,
+                                items: ["url", "lake-verifier", "harness-verifier", "codex-login-verifier", ...readerRoles(config, environment).map(({ key }) => key)].map((key) => ({ key, path: key })),
                             },
                         },
                         { name: "log", secret: { secretName: environmentLogSecret(environment), items: [{ key: "password", path: "password" }] } },
                         ...branchSecret,
-                        ...(host.enabled ? hostVolumes(config) : []),
+                        ...machine.volumes,
                     ],
                     ...given("nodeSelector", { ...alasio.nodeSelector }),
                     ...given("tolerations", [...alasio.tolerations]),
                     ...given("affinity", alasio.affinity),
+                    // Its replicas, where it may run more than one, on as many nodes as there are.
+                    ...spread("alasio", alasio.scaling),
                 },
             },
         },
     };
 }
-/** Where session sandboxes export their telemetry: alasio's receiver. */
-function telemetryService(config, environment) {
-    return {
-        apiVersion: "v1",
-        kind: "Service",
-        metadata: { name: componentName("telemetry"), namespace: environment.namespace, labels: labels("alasio") },
-        spec: { selector: selectorLabels("alasio"), ports: [{ name: "otlp-http", port: config.telemetry.receiverPort, targetPort: "telemetry" }] },
-    };
-}
-/** Where branch environments ask main to fork the sessions they inherited (src/branch/fork.ts). */
-function branchForksService() {
-    return {
-        apiVersion: "v1",
-        kind: "Service",
-        metadata: { name: componentName("branches"), namespace: NAMESPACE, labels: labels("alasio") },
-        spec: { selector: selectorLabels("alasio"), ports: [{ name: "branch-forks", port: BRANCH_FORK_PORT, targetPort: "branch-forks" }] },
-    };
-}
 /**
  * The namespaces workspaces run in, which alasio makes unless told not to. Sessions'
  * enforces Pod Security "restricted": nothing privileged, no host paths, no added
- * capabilities. The host profile's is "privileged", as its pods mount the machine. A
- * branch environment always has its own, beside its own namespace.
+ * capabilities; but where the sandbox service runs, whose pools' pods mount their own
+ * directories on their nodes, a host path no level but "privileged" allows, it enforces that
+ * and warns and audits of "restricted", the sandbox pods' policy holding every pod of it to the
+ * pools' templates instead (./admission.ts sandboxPodPolicy). The host profile's is
+ * "privileged", as its pods mount the machine. A branch environment always has its own,
+ * beside its own namespace, which records the environment it was branched from, main's
+ * (BRANCH_PARENT_LABEL), as the sandbox gateway forks main's sessions into it for that alone.
  */
 function namespaces(config, environment) {
     const { sessions, host } = config;
@@ -475,7 +270,7 @@ function namespaces(config, environment) {
     const branched = branch ? { [BRANCH_LABEL]: branch } : {};
     return [
         ...(branch ? [{ apiVersion: "v1", kind: "Namespace", metadata: { name: environment.namespace, labels: { ...labels("alasio"), ...branched } } }] : []),
-        ...(sessions.enabled && (sessions.createNamespace || branch)
+        ...(sessions.createNamespace || branch
             ? [{
                     apiVersion: "v1",
                     kind: "Namespace",
@@ -484,9 +279,12 @@ function namespaces(config, environment) {
                         labels: {
                             ...labels("session"),
                             ...branched,
-                            "pod-security.kubernetes.io/enforce": "restricted",
-                            "pod-security.kubernetes.io/enforce-version": "latest",
+                            ...(branch ? { [BRANCH_PARENT_LABEL]: MAIN_ENVIRONMENT_NAME } : {}),
+                            "pod-security.kubernetes.io/enforce": "privileged",
+                            "pod-security.kubernetes.io/audit": "restricted",
+                            "pod-security.kubernetes.io/audit-version": "latest",
                             "pod-security.kubernetes.io/warn": "restricted",
+                            "pod-security.kubernetes.io/warn-version": "latest",
                         },
                     },
                 }]
@@ -501,97 +299,34 @@ function namespaces(config, environment) {
     ];
 }
 /**
- * Whether alasio removes the JuiceFS mount pods of a session whose mount is lost as it
- * restarts it (src/sandbox/index.ts): where it installs JuiceFS's driver, whose mount pods
- * it then knows to be in the driver's namespace.
- */
-function mountPodsRemoved({ workspaceStorage }) {
-    return workspaceStorage.enabled && workspaceStorage.csi.enabled;
-}
-/**
- * alasio's identity: it drives its workspaces' Sandboxes, their token Secrets, and reads
- * files from sessions through exec, in the namespaces it owns, labelling their pods busy
- * while turns run in them, as it does its own in its namespace (src/kube/busy.ts); where
- * it snapshots sessions, sets a restored session's readiness; where it forks
- * sessions, reads sessions' volume claims and runs the Jobs that clone them in its own;
- * where the node agents run, watches pods in its own, theirs among them, and reads the
- * cluster's nodes, for a restore to go to one that takes its pod; and, where it installs
- * JuiceFS's driver, lists and deletes pods in the driver's namespace, its mount pods; and
- * nothing else.
+ * alasio's identity: it labels its own pod busy while turns run in it (src/kube/busy.ts),
+ * reads it to stop as it is deleted (src/kube/own-pod.ts), and keeps the time of its last
+ * start in a ConfigMap of its own, made here empty, which it may read and patch alone
+ * (src/kube/started.ts); nothing else. Its sessions and its folder workspaces are the sandbox
+ * gateway's, which it reaches by its key alone.
  */
 function identity(config, environment) {
-    const main = environment.branch === null;
-    const binding = (metadata) => ({
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "RoleBinding",
-        metadata,
-        subjects: [{ kind: "ServiceAccount", name: RELEASE, namespace: environment.namespace }],
-        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: RELEASE },
-    });
-    const inDriverNamespace = { name: RELEASE, namespace: config.workspaceStorage.csi.namespace, labels: labels("alasio") };
-    const mountPods = {
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "Role",
-        metadata: inDriverNamespace,
-        rules: [{ apiGroups: [""], resources: ["pods"], verbs: ["list", "delete"] }],
-    };
     const inOwnNamespace = { name: RELEASE, namespace: environment.namespace, labels: labels("alasio") };
     const own = {
         apiVersion: "rbac.authorization.k8s.io/v1",
         kind: "Role",
         metadata: inOwnNamespace,
         rules: [
-            // Its own pod's busy label; and each node's agent, found by its pod on the node.
-            { apiGroups: [""], resources: ["pods"], verbs: main && nodeAgentRuns(config) ? ["list", "watch", "patch"] : ["list", "patch"] },
-            ...(main && sessionsForked(config) ? [{ apiGroups: ["batch"], resources: ["jobs"], verbs: ["create", "get", "delete"] }] : []),
+            { apiGroups: [""], resources: ["pods"], verbs: ["get", "list", "patch"] },
+            { apiGroups: [""], resources: ["configmaps"], resourceNames: [STARTED_CONFIG_MAP], verbs: ["get", "patch"] },
         ],
     };
-    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name: RELEASE, namespace: environment.namespace, labels: labels("alasio") } };
-    // The nodes, read alone, for a restore to go to one that takes the session's pod (src/sandbox/snapshots.ts).
-    const nodes = { name: componentName("nodes"), labels: labels("alasio") };
-    const nodesRole = {
-        apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "ClusterRole",
-        metadata: nodes,
-        rules: [{ apiGroups: [""], resources: ["nodes"], verbs: ["get"] }],
-    };
-    const nodesBinding = {
+    // Of no data, which alasio's starts write and `alasio up` leaves to them.
+    const started = { apiVersion: "v1", kind: "ConfigMap", metadata: { name: STARTED_CONFIG_MAP, namespace: environment.namespace, labels: labels("alasio") } };
+    const binding = {
         apiVersion: "rbac.authorization.k8s.io/v1",
-        kind: "ClusterRoleBinding",
-        metadata: nodes,
+        kind: "RoleBinding",
+        metadata: inOwnNamespace,
         subjects: [{ kind: "ServiceAccount", name: RELEASE, namespace: environment.namespace }],
-        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: nodes.name },
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: RELEASE },
     };
-    return [
-        serviceAccount,
-        ...workspaceNamespaces(config, environment).flatMap((namespace) => {
-            const metadata = { name: RELEASE, namespace, labels: labels("alasio") };
-            const forked = main && sessionsForked(config) && namespace === config.sessions.namespace;
-            const snapshotted = main && nodeAgentRuns(config) && namespace === config.sessions.namespace;
-            const role = {
-                apiVersion: "rbac.authorization.k8s.io/v1",
-                kind: "Role",
-                metadata,
-                rules: [
-                    { apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes"], verbs: ["get", "list", "watch", "create", "patch", "delete"] },
-                    { apiGroups: [""], resources: ["secrets"], verbs: ["get", "create"] },
-                    { apiGroups: [""], resources: ["pods"], verbs: ["get", "list", "patch"] },
-                    { apiGroups: [""], resources: ["pods/exec"], verbs: ["create", "get"] },
-                    ...(forked ? [{ apiGroups: [""], resources: ["persistentvolumeclaims"], verbs: ["get"] }] : []),
-                    // A restored session's readiness, once its sandbox is let run, and the network policies that must hold it first (src/sandbox/snapshots.ts).
-                    ...(snapshotted
-                        ? [{ apiGroups: [""], resources: ["pods/status"], verbs: ["patch"] }, { apiGroups: ["networking.k8s.io"], resources: ["networkpolicies"], verbs: ["list"] }]
-                        : []),
-                ],
-            };
-            return [role, binding(metadata)];
-        }),
-        own,
-        binding(inOwnNamespace),
-        ...(main && mountPodsRemoved(config) ? [mountPods, binding(inDriverNamespace)] : []),
-        ...(main && nodeAgentRuns(config) ? [nodesRole, nodesBinding] : []),
-        ...(config.host.enabled ? hostAgentIdentity(config) : []),
-    ];
+    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name: RELEASE, namespace: environment.namespace, labels: labels("alasio") } };
+    return [serviceAccount, own, binding, started, ...(environment.branch === null && foldersRun(config) ? hostAgentIdentity(config) : [])];
 }
 /**
  * Folder workspaces' bayma: the operator's agents, which may restart alasio as they
@@ -624,33 +359,50 @@ function hostAgentIdentity(config) {
     };
     return [serviceAccount, role, binding];
 }
+/** How many updates waiting on its environment's Telegram topic ask for one more alasio: a few chats' bursts. */
+const UPDATES_PER_ALASIO = 20;
+/** What a bound harness asks of alasio's scale: so much that any number of them ask for one alasio, to hear and deliver what they do, and no more. */
+const BOUND_TARGET = 1_000_000;
+/**
+ * KEDA's scaling of the environment's alasio (deployment), where its scale's min and max are
+ * apart: up from none at the first update, event or fork request waiting on its topics, or
+ * harness bound to one of its conversations, and up by one for each UPDATES_PER_ALASIO updates
+ * waiting; back to its min once none of that has been seen for its cooldown. Its groups' lags
+ * read as the log's scaler principal; a group that has read none of a topic counts its records
+ * as it reads them, from its first or from the next written (src/events/consume.ts).
+ */
+export function alasioScaling(config, environment, alasio) {
+    const name = environmentName(environment);
+    const authentication = RELEASE;
+    const triggers = [
+        lagTrigger(alasioGroup(name), telegramTopic(name), UPDATES_PER_ALASIO, authentication),
+        lagTrigger(eventsGroup(name), eventsTopic(name), 1, authentication, environment.branch === null ? "latest" : "earliest"),
+        ...(environment.branch === null ? [lagTrigger(forksGroup(MAIN_ENVIRONMENT_NAME), forksTopic(MAIN_ENVIRONMENT_NAME), 1, authentication)] : []),
+        // Its harnesses bound, of every pool in its namespace, as the gateway counts them.
+        {
+            type: "metrics-api",
+            metadata: { url: `http://${GATEWAY}.${NAMESPACE}.svc.cluster.local:${GATEWAY_PORT}/counts/${environment.namespace}`, valueLocation: "bound", targetValue: String(BOUND_TARGET), activationTargetValue: "0" },
+        },
+    ];
+    const scaledObjects = scaledObject(alasio, config.alasio.scaling, triggers, { pollingSeconds: config.alasio.pollingSeconds, cooldownSeconds: config.alasio.cooldownSeconds });
+    return scaledObjects.length > 0 ? [logAuthentication(authentication, environment.namespace, "alasio"), ...scaledObjects] : [];
+}
 /** The objects of the alasio of `environment`, main's unless a branch environment's, with what main's carries forward. */
 export function alasioObjects(config, environment = MAIN_ENVIRONMENT, carried = NOTHING_CARRIED) {
-    const templates = sandboxTemplates(config, environment, carried);
-    const alasio = deployment(config, templates.checksum, carried.botChecksum, environment);
+    const alasio = deployment(config, carried.botChecksum, environment);
     return [
         ...namespaces(config, environment),
         ...identity(config, environment),
-        templates.configMap,
         alasio,
+        ...alasioScaling(config, environment, alasio),
         // It runs turns, in its harnesses, which a recreation would end.
-        verticalPodAutoscaler(alasio, "Recommended"),
-        // A drain waits for the turns running in its pod and its workspaces' to end.
-        ...[environment.namespace, ...workspaceNamespaces(config, environment)].map(busyBudget),
-        telemetryService(config, environment),
-        ...(environment.branch === null && forksForBranches(config) ? [branchForksService()] : []),
-        // What alasio may do beyond what RBAC can say; the cluster's, but for its Sandboxes', made with main's.
-        ...(environment.branch === null ? [...busyLabelPolicy(), ...secretPolicy()] : []),
-        // Where sessions are snapshotted, what alasio may set of a restored session's pod's status.
-        ...(environment.branch === null && config.sessions.enabled && nodeAgentRuns(config)
-            ? resumedConditionPolicy(componentName("resumed-condition"), alasioAccount(environment.namespace), config.sessions.namespace)
-            : []),
-        ...(environment.branch === null && sessionsForked(config) ? cloneJobPolicy(cloneJob(config)) : []),
-        ...sandboxPolicy(sandboxPolicyName(environment.namespace), alasioAccount(environment.namespace), {
-            sessions: config.sessions.enabled ? sessionsProfile(config, environment, carried) : null,
-            previousSessions: config.sessions.enabled ? carried.previousSessions : null,
-            host: config.host.enabled ? hostProfile(config) : null,
-        }),
+        verticalPodAutoscaler(alasio, "AtStart"),
+        // A drain waits for the turns running in its pod to end, and evicts one of its pods not busy at a time.
+        busyBudget(environment.namespace),
+        ...replicaBudget("alasio", environment.namespace, config.alasio.scaling, { unlessBusy: true }),
+        ...codexLoginObjects(config, environment),
+        // What alasio may do beyond what RBAC can say: the cluster's, made with main's.
+        ...(environment.branch === null ? busyLabelPolicy() : []),
     ];
 }
 //# sourceMappingURL=alasio.js.map