elanous 0.2.12 → 0.2.13

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -58,6 +58,9 @@ import { envLiteral } from '../../platform/env-literal.js';
 import { LLM_TIER_MAP_BY_PROVIDER, lookupLlmTierSpec, type LlmTierProvider } from '../../model-tier/llm-tier-map.js';
 import { parseSelfImplementJson, type SelfImplementJobDone, type SelfImplementJobSpawn } from './self-implement.js';
 import { codexQuotaPolicyFromConfig } from '../../oauth/codex-account-store.js';
+import { goalTypeOf } from '../../../scripts/measure-pod-memory-by-goal.js';
+import { readPodMemoryAdvice, type PodMemoryAdvice } from '../../cli/pod-memory-advice.js';
+import { getUserConfig } from '../../user-config.js';
 
 export type Kubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
 
@@ -132,6 +135,10 @@ export interface PodSpawnOptions {
   env?: NodeJS.ProcessEnv;
   /** Detail switch file (test injection; defaults to the host's local/production selection). */
   liveDetailFile?: string;
+  /** Test seam for the opt-in user configuration; otherwise read the active user config. */
+  adviseDefaults?: boolean;
+  /** Test seam for the read-only measured advice. */
+  memoryAdvice?: () => PodMemoryAdvice;
 }
 
 export function defaultKubectl(args: readonly string[], input?: string): { status: number | null; stdout: string; stderr: string } {
@@ -411,7 +418,7 @@ export const POD_MEMORY_HIGH_DEFAULT = '32Gi';
 export const POD_MEMORY_LITE_DEFAULT = '2Gi';
 export const POD_MEMORY_TIERS = ['lite', 'standard', 'high'] as const;
 export type PodMemoryTier = (typeof POD_MEMORY_TIERS)[number];
-export type PodMemorySource = 'option' | 'goal-line' | 'pwa-auto' | 'default' | 'parent-goal-line' | 'parent-pwa-auto';
+export type PodMemorySource = 'option' | 'goal-line' | 'pwa-auto' | 'default' | 'parent-goal-line' | 'parent-pwa-auto' | 'advise';
 const PWA_PATH = /(?:^|[\s`'"(,·])apps\/pwa\//m;
 const GOAL_LINE = /^[ \t]*(?:Pod 메모리|pod-memory)[ \t]*:[ \t]*(lite|standard|high)[ \t]*\r?$/im;
 
@@ -453,14 +460,21 @@ function memoryGi(v: string): number | null {
   return m[2] === 'Gi' ? Number(m[1]) : Number(m[1]) / 1024;
 }
 
-export function podMemoryLimitFor(feature: string, env: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>, parentGoal?: string): { limit: string; tier: PodMemoryTier; source: PodMemorySource } {
+export function podMemoryLimitFor(feature: string, env: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>, parentGoal?: string, advice?: PodMemoryAdvice): { limit: string; tier: PodMemoryTier; source: PodMemorySource } {
   const option = parsePodMemoryTier(env.ELANOUS_POD_MEMORY_TIER);
   const line = parsePodMemoryTier(GOAL_LINE.exec(feature)?.[1]);
-  const parentLine = !option && !line && !goalTouchesPwa(feature) ? parsePodMemoryTier(GOAL_LINE.exec(parentGoal ?? '')?.[1]) : null;
+  const parentLine = !option && !line ? parsePodMemoryTier(GOAL_LINE.exec(parentGoal ?? '')?.[1]) : null;
+  const goalType = advice && !option && !line && !parentLine
+    ? (broadPodTestWarning(feature) ? 'test' : goalTypeOf(feature))
+      ?? (parentGoal ? (broadPodTestWarning(parentGoal) ? 'test' : goalTypeOf(parentGoal)) : null)
+    : null;
+  const recommendation = advice?.byGoalType.find((entry) => entry.goalType === goalType && entry.evidence.runs > 0)?.recommended;
   const [tier, source]: [PodMemoryTier, PodMemorySource] = option ? [option, 'option']
     : line ? [line, 'goal-line']
+    // 조각 자신의 PWA 경로가 부모 줄·실측 권고보다 먼저다 — 부모 «standard» 가 PWA 조각을 16Gi 로 내리면 OOM(POD7 · #23569 순서 회귀)
     : goalTouchesPwa(feature) ? ['high', 'pwa-auto']
     : parentLine ? [parentLine, 'parent-goal-line']
+    : recommendation ? [recommendation, 'advise']
     : parentGoal && goalTouchesPwa(parentGoal) ? ['high', 'parent-pwa-auto']
     : ['standard', 'default'];
   if (tier === 'lite') return { limit: env.ELANOUS_POD_MEMORY_LITE?.trim() || POD_MEMORY_LITE_DEFAULT, tier, source };
@@ -640,7 +654,6 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
   const hostSupervised = options.hostSupervised ?? true;
   return (input) => {
     const name = podJobName(input.spaceId);
-    const featureMemory = podMemoryLimitFor(input.feature, env);
     let parentGoal: string | undefined;
     let parentGoalUnreadable = false;
     let inheritedFrom: string | undefined;
@@ -658,7 +671,14 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         inheritedFrom = withinRoot;
       } catch { parentGoalUnreadable = true; }
     }
-    const { limit: selectedMemoryLimit, tier: memoryTier, source: memorySource } = parentGoal === undefined ? featureMemory : podMemoryLimitFor(input.feature, env, parentGoal);
+    let advice: PodMemoryAdvice | undefined;
+    const explicitMemory = Boolean(parsePodMemoryTier(env.ELANOUS_POD_MEMORY_TIER) || GOAL_LINE.test(input.feature) || GOAL_LINE.test(parentGoal ?? ''));
+    const useAdvice = options.adviseDefaults ?? getUserConfig().pod?.memory?.adviseDefaults === true;
+    if (useAdvice && !explicitMemory) {
+      try { advice = (options.memoryAdvice ?? readPodMemoryAdvice)(); }
+      catch (error) { debug.log('self-implement.pod', 'memory-advice-unavailable', { spaceId: input.spaceId, reason: error instanceof Error ? error.message : String(error) }, { level: 'warn' }); }
+    }
+    const { limit: selectedMemoryLimit, tier: memoryTier, source: memorySource } = podMemoryLimitFor(input.feature, env, parentGoal, advice);
     for (const [where, text] of [['feature', input.feature], ['parent-goal', parentGoal]] as const) {
       if (text && text.split(/\r?\n/u).some((line) => /Pod 메모리/u.test(line) && !GOAL_LINE.test(line))) {
         const reason = '한 줄 단독 `Pod 메모리: high|standard` 형식이 아님';
@@ -716,7 +736,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
       if (recoveryError) return { exitCode: 1, output: '', error: { code: 'pod-oom-recovery', message: recoveryError } };
       // Each Job attempt has its own host lease; releasing the first after OOM lets the retry
       // compete with other processes for the newly measured capacity before applying another Job.
-      let releaseAdmission: ((() => void) & { applied?: () => void }) | undefined;
+      let releaseAdmission: ((() => void) & { applied?: (job: string, context: string, namespace: string) => void; observed?: () => void }) | undefined;
       try {
       // Every attempt, including an OOM retry, must acquire a pool slot before applying a Job.
       const acquireSlot = async (): Promise<PodPoolMember | null> => {
@@ -1067,6 +1087,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         const job = podJobManifest({ name, namespace, image: jobImage, ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), args, passEnv: jobPassEnv, deadlineSeconds: options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS, ...(goalDoc ? { goalDoc } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, imageCommit: options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
         const a = kubectl(['apply', '-f', '-'], JSON.stringify(job));
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
+        releaseAdmission?.applied?.(name, context, namespace);
         if (options.source?.kind === 'bundle') {
           const podName = await waitForRunningPod(kubectl, namespace, name, sleep);
           if (!podName) {
@@ -1074,6 +1095,8 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             cleanupSecret();
             return { exitCode: 1, output: '', error: { code: 'pod-source', message: `Pod for ${name} did not become Running` } };
           }
+          releaseAdmission?.observed?.();
+          if (releaseAdmission) delete releaseAdmission.observed;
           const copied = kubectl(['cp', options.source.bundlePath, `${podName}:/tmp/source.bundle`, '-c', 'child', '-n', namespace]);
           if (copied.status !== 0) {
             debug.log('self-implement.pod', 'source-mismatch', { job: name, kind: 'bundle', headCommit: options.source.headCommit });
@@ -1106,7 +1129,6 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         }
         writePodFragment({ spaceId: input.spaceId, context, namespace, job: name, inboxDir: POD_CONTROL_INBOX_DIR, ...(liveChildRunId === normalizeRunId(liveChildRunId) ? { runId: liveChildRunId } : {}), ...(parentRunId && normalizeRunId(parentRunId) === parentRunId ? { parentRunId } : {}) }, env);
         recorded = true;
-        releaseAdmission?.applied?.();
         debug.log('self-implement.pod', 'job-applied', { job: name, namespace, ...(member ? { context: member.context } : {}), image: jobImage, spaceId: input.spaceId, passEnv, extraArgs: options.extraArgs ?? [], ...(options.armEnv?.ELANOUS_ARM_ID ? { armId: options.armEnv.ELANOUS_ARM_ID } : {}) });
         let state: 'complete' | 'failed' | 'aborted' = 'failed';
         let failedReason = '';
@@ -1122,8 +1144,9 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
           }
           const g = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[*].type}']);
           const types = g.stdout;
-          if (/Complete|SuccessCriteriaMet/.test(types)) { state = 'complete'; break; }
+          if (/Complete|SuccessCriteriaMet/.test(types)) { releaseAdmission?.observed?.(); state = 'complete'; break; }
           if (/Failed|FailureTarget/.test(types)) {
+            releaseAdmission?.observed?.();
             state = 'failed';
             const reason = kubectl(['-n', namespace, 'get', 'job', name, '-o', 'jsonpath={.status.conditions[?(@.type=="Failed")].reason}']);
             failedReason = reason.status === 0 ? reason.stdout.trim() : '';
@@ -1143,6 +1166,13 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
             debug.log('self-implement.pod', 'container-terminated', { job: name, container: 'child', reason: containerReason, exitCode: containerExitCode, jobReason: failedReason || null, memoryLimit });
             break;
           }
+          if (releaseAdmission?.observed) {
+            const podPhase = kubectl(['-n', namespace, 'get', 'pods', '-l', `job-name=${name}`, '-o', 'jsonpath={.items[*].status.phase}']);
+            if (podPhase.status === 0 && /\b(?:Running|Succeeded|Failed)\b/.test(podPhase.stdout)) {
+              releaseAdmission.observed();
+              delete releaseAdmission.observed;
+            }
+          }
           if (ghTokenExpiresAt !== null && ghTokenExpiresAt - now() <= 10 * 60_000) {
             try {
               const fresh = await issueVerifiedAppCredential();

package/src/telegram-dispatch-forward.ts

@@ -42,7 +42,7 @@ export function defaultBaseUrl(deps: { runtime?: () => ReturnType<typeof readNex
   return `http://${host}:${rt.httpPort}`;
 }
 
-function defaultToken(): string | null {
+export function defaultToken(): string | null {
   const p = join(getElanousConfigDir(), 'acp-token');
   try { return existsSync(p) ? readFileSync(p, 'utf-8').trim() || null : null; } catch { return null; }
 }

package/src/telegram-fabric-plan.ts

@@ -0,0 +1,90 @@
+import { defaultBaseUrl, defaultToken } from './telegram-dispatch-forward.js';
+import type { FabricPlan } from './self-dev/fabric-plan-core.js';
+import type { TelegramBot, TgIncoming } from './telegram.js';
+
+export interface TelegramFabricPlanDeps {
+  fetchImpl?: typeof fetch;
+  baseUrl?: () => string | null;
+  token?: () => string | null;
+}
+
+/** Only a successful daemon draft is offered for approval; no execution endpoint is called here. */
+export function attachTelegramFabricPlan(
+  bot: Pick<TelegramBot, 'isOwnerAllowed' | 'sendMessage' | 'sendInlineKeyboard' | 'onCallbackQuery' | 'answerCallbackQuery'>,
+  deps: TelegramFabricPlanDeps = {},
+): (ctx: TgIncoming) => Promise<boolean> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const pending = new Map<string, { chatId: number; userId: number; threadId?: number; messageId: number }>();
+  const endpoint = (path: string): { url: string; token: string | null } => {
+    const base = (deps.baseUrl ?? defaultBaseUrl)();
+    if (!base) throw new Error('데몬에 연결할 수 없습니다');
+    return { url: `${base}${path}`, token: (deps.token ?? defaultToken)() };
+  };
+  const post = async (path: string, body?: unknown): Promise<unknown> => {
+    const { url, token } = endpoint(path);
+    const response = await fetchImpl(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+    if (!response.ok) throw new Error(`데몬 응답 ${response.status}`);
+    return response.json();
+  };
+
+  bot.onCallbackQuery(async (q) => {
+    const match = /^fabric:(approve|edit):([a-f0-9-]{36})$/i.exec(q.data);
+    if (!match) return;
+    const planId = match[2]!;
+    const original = pending.get(planId);
+    if (!original || !bot.isOwnerAllowed(q.userId) || q.userId !== original.userId
+      || q.chatId !== original.chatId || q.threadId !== original.threadId || q.messageId !== original.messageId) {
+      await bot.answerCallbackQuery(q.id, { text: '이 초안의 요청자만 선택할 수 있습니다' });
+      return;
+    }
+    if (match[1] === 'edit') {
+      pending.delete(planId);
+      await bot.answerCallbackQuery(q.id);
+      await bot.sendMessage(original.chatId, '고칠 내용을 반영해 «아크: <복합 문장>»으로 다시 보내세요. 이 초안은 승인되지 않았습니다.', { threadId: original.threadId });
+      return;
+    }
+    try {
+      await post(`/v1/fabric/plans/${planId}/approve`);
+      pending.delete(planId);
+      await bot.answerCallbackQuery(q.id, { text: '승인되었습니다' });
+      await bot.sendMessage(original.chatId, `아크 초안 ${planId} 승인됨 — 실행은 별도 단계입니다.`, { threadId: original.threadId });
+    } catch (error) {
+      await bot.answerCallbackQuery(q.id, { text: `승인 실패: ${error instanceof Error ? error.message : String(error)}` });
+    }
+  });
+
+  return async (ctx) => {
+    if (ctx.attachments.length || ctx.video || !ctx.text.startsWith('아크:')) return false;
+    const request = ctx.text.slice('아크:'.length).trim();
+    if (!request || request.includes('\n')) {
+      await bot.sendMessage(ctx.chatId, '«아크: <복합 문장>» 한 줄로 보내세요.', { replyTo: ctx.messageId, threadId: ctx.threadId });
+      return true;
+    }
+    try {
+      const body = await post('/v1/fabric/decompose', { request }) as { plan?: FabricPlan };
+      const plan = body.plan;
+      if (!plan || plan.status !== 'draft' || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(plan.id)
+        || !Array.isArray(plan.nodes) || plan.nodes.length === 0) throw new Error('초안 형식 오류');
+      const steps = plan.nodes.map((node, i) => `${i + 1}. ${node.title}`).join('\n');
+      const preview = `아크 초안 · 실행 전 검토\n${steps}`;
+      const reply = { replyTo: ctx.messageId, threadId: ctx.threadId };
+      for (let offset = 0; offset + 4000 < preview.length; offset += 4000) {
+        const sent = await bot.sendMessage(ctx.chatId, preview.slice(offset, offset + 4000), reply);
+        if (sent?.messageId === undefined) throw new Error('단계 미리보기를 전부 전달하지 못했습니다 — 승인 불가');
+      }
+      const finalOffset = Math.floor((preview.length - 1) / 4000) * 4000;
+      const sent = await bot.sendInlineKeyboard(ctx.chatId, preview.slice(finalOffset), [[
+        { text: '승인', data: `fabric:approve:${plan.id}` },
+        { text: '고치기', data: `fabric:edit:${plan.id}` },
+      ]], reply);
+      if (sent?.messageId !== undefined) pending.set(plan.id, { chatId: ctx.chatId, userId: ctx.userId, threadId: ctx.threadId, messageId: sent.messageId });
+    } catch (error) {
+      await bot.sendMessage(ctx.chatId, `아크 초안 생성 실패: ${error instanceof Error ? error.message : String(error)}`, { replyTo: ctx.messageId, threadId: ctx.threadId });
+    }
+    return true;
+  };
+}

package/src/telegram-project-command.ts

@@ -35,17 +35,23 @@ export function projectCommand(deps: TelegramProjectCommandDeps = {
         debug.log('telegram.project', 'listed', { projects: projects.slice(0, 20).map(p => ({ id: p.id, name: p.name })) });
         if (ctx.isDm && ctx.chatId === ctx.userId
           && String(ctx.userId) === telegramDecisionOwner(ctxOptions.userConfig) && ctxOptions.sendButtons) {
-          const buttons = projects.filter(p => {
+          const eligible = projects.filter(p => {
             const bytes = Buffer.byteLength(`prj:${p.id}`, 'utf8');
             if (bytes <= 64) return true;
             debug.log('telegram.project', 'button-rejected', { reason: 'callback-data-too-long', projectId: p.id, bytes });
             return false;
-          }).slice(0, 8).map(p => ({ text: p.name, data: `prj:${p.id}` }));
-          buttons.push({ text: '받은 대화로', data: 'prj:-' });
+          });
+          const visible = eligible.slice(0, 7);
+          if (current && eligible.some(p => p.id === current.id) && !visible.some(p => p.id === current.id)) {
+            visible[visible.length - 1] = current;
+          }
+          const buttons = visible.map(p => ({ text: `${p.id === current?.id ? '✓ ' : ''}${p.name}`, data: `prj:${p.id}` }));
+          buttons.push({ text: `${session.projectId ? '' : '✓ '}받은 대화로`, data: 'prj:-' });
           const rows: Array<Array<{ text: string; data: string }>> = [];
           for (let i = 0; i < buttons.length; i += 2) rows.push(buttons.slice(i, i + 2));
           try {
             await ctxOptions.sendButtons('프로젝트를 선택하세요', rows);
+            return;
           } catch (err) {
             debug.log('telegram.project', 'button-rejected', {
               reason: 'send-failed', error: err instanceof Error ? err.message : String(err),
@@ -140,6 +146,6 @@ export function attachTelegramProjectButtons(
     deps.update(session.id, m => { m.projectId = project.id; });
     debug.log('telegram.project', 'button-moved', { chatId, sessionId: session.id, projectId: project.id });
     await bot.answerCallbackQuery(q.id);
-    await bot.sendMessage(chatId, `이 대화를 ${project.name} 프로젝트로 옮겼습니다`);
+    await bot.sendMessage(chatId, `지금 프로젝트: ${project.name}`);
   });
 }

package/src/telegram.ts

@@ -77,6 +77,7 @@ import { handleTelegramFieldNote } from './field-note/telegram.js';
 import type { TranscriptionEngine, FieldAudio } from './field-note/transcribe.js';
 import { maybeHandleCardPhoto, type CardPhotoDeps } from './telegram-card-followup.js';
 import { attachTelegramProjectButtons } from './telegram-project-command.js';
+import { attachTelegramFabricPlan } from './telegram-fabric-plan.js';
 
 export type TgAttachmentKind = 'photo' | 'voice' | 'audio' | 'document';
 
@@ -229,6 +230,7 @@ export interface TelegramBotOpts {
   fieldNoteDecodeAudio?: (file: string, recordedAt: string) => FieldAudio;
   /** Test seam for the business-card graph and its private run root. */
   cardFollowupDeps?: Pick<CardPhotoDeps, 'runGraph' | 'rootDir' | 'ocrText'>;
+  fabricPlanDeps?: import('./telegram-fabric-plan.js').TelegramFabricPlanDeps;
 }
 
 /** Surface-unification v2 (FU-2) — Telegram trigger event passed to
@@ -350,6 +352,7 @@ export class TelegramBot {
   private readonly fieldNoteDecodeAudio?: (file: string, recordedAt: string) => FieldAudio;
   private readonly cardFollowupDeps: Pick<CardPhotoDeps, 'runGraph' | 'rootDir' | 'ocrText'>;
   private readonly seatWorkDeps: TelegramSeatWorkDeps;
+  private readonly handleFabricPlan: (ctx: TgIncoming) => Promise<boolean>;
   private seatAskTimer: ReturnType<typeof setInterval> | null = null;
   /** 앨범 id → `#현장` 행사 · 답장 디바운스. 태그된 앨범만 들어온다. */
   private readonly fieldGroups = new Map<string, {
@@ -388,6 +391,7 @@ export class TelegramBot {
     this.fieldNoteEngine = opts.fieldNoteEngine;
     this.fieldNoteDecodeAudio = opts.fieldNoteDecodeAudio;
     this.cardFollowupDeps = opts.cardFollowupDeps ?? {};
+    this.handleFabricPlan = attachTelegramFabricPlan(this, opts.fabricPlanDeps);
     this.seatWorkDeps = { ...opts.seatWorkDeps, askDeps: { ...opts.seatWorkDeps?.askDeps,
       channel: 'telegram', botId: this.botId,
       send: opts.seatWorkDeps?.askDeps?.send ?? (async (origin, text) => {
@@ -1539,6 +1543,7 @@ export class TelegramBot {
       await this.refuseMessage(ctx);
       return;
     }
+    if (await this.handleFabricPlan(ctx)) return;
     // 현장 업로드 — `#현장` 캡션(또는 태그된 앨범의 나머지)의 사진·영상은 LLM 대신 현장 폴더로.
     if (await this.tryHandleFieldUpload(ctx)) return;
     if (await handleTelegramFieldNote(ctx, {

package/src/tool-runtime/elanous-control-runtimes.ts

@@ -3,6 +3,7 @@ import { StringDecoder } from 'node:string_decoder';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
 import type { LLMToolSpec } from '../llm.js';
+import { stateDirSourceForChild } from '../agent/identity-env.js';
 import { debug } from '../debug/log.js';
 import { canonicalizeForBoundary, isWithinBoundary, resolveHarnessBoundary } from '../harness/harness-write-boundary.js';
 import { getHarnessSpace } from '../harness/harness-space.js';
@@ -133,7 +134,7 @@ async function spawnHeldElanous(command: string[], cwd: string, instanceRoot: st
     try {
       child = deps.spawn(command[0]!, command.slice(1), {
         cwd,
-        env: { ...process.env, ELANOUS_STATE_DIR: instanceRoot },
+        env: { ...process.env, ELANOUS_STATE_DIR: instanceRoot, ELANOUS_STATE_DIR_SOURCE: stateDirSourceForChild(instanceRoot) },
         detached: true,
         stdio: ['ignore', 'pipe', 'pipe'],
       });

package/src/user-config.ts

@@ -3475,7 +3475,34 @@ export function resolveRoleModel(role: ModelRole, config: UserConfig = getUserCo
 }
 
 
-export type StewardLoopMode = 'off' | 'shadow' | 'live';
+export type OrchestratorSeat = 'OP' | 'TC' | 'MK' | 'UX';
+export interface OrchestratorLoopConfig {
+  seatTrees: Partial<Record<OrchestratorSeat, string[]>>;
+  seatCaps: Record<OrchestratorSeat, number>;
+  trafficMode: 'shadow' | 'live';
+}
+
+export const ORCHESTRATOR_DEFAULTS: OrchestratorLoopConfig = {
+  seatTrees: {}, seatCaps: { TC: 8, UX: 6, MK: 6, OP: 4 }, trafficMode: 'shadow',
+};
+
+export function parseOrchestratorLoopConfig(raw: unknown): OrchestratorLoopConfig {
+  const value = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw as Record<string, unknown> : {};
+  const rawTrees = value.seatTrees && typeof value.seatTrees === 'object' && !Array.isArray(value.seatTrees)
+    ? value.seatTrees as Record<string, unknown> : {};
+  const rawCaps = value.seatCaps && typeof value.seatCaps === 'object' && !Array.isArray(value.seatCaps)
+    ? value.seatCaps as Record<string, unknown> : {};
+  const seatTrees: OrchestratorLoopConfig['seatTrees'] = {};
+  const seatCaps = { ...ORCHESTRATOR_DEFAULTS.seatCaps };
+  for (const seat of ['OP', 'TC', 'MK', 'UX'] as const) {
+    if (Array.isArray(rawTrees[seat])) seatTrees[seat] = rawTrees[seat].filter((path): path is string => typeof path === 'string' && isAbsolute(path));
+    const cap = rawCaps[seat];
+    if (typeof cap === 'number' && Number.isSafeInteger(cap) && cap >= 0) seatCaps[seat] = cap;
+  }
+  return { seatTrees, seatCaps, trafficMode: value.trafficMode === 'live' ? 'live' : 'shadow' };
+}
+
+export type StewardLoopMode = 'off' | 'shadow' | 'live' | 'rescue';
 
 export type SeatLoopMode = 'off' | 'shadow' | 'on';
 
@@ -3516,25 +3543,51 @@ export function parseEventsConfig(input: unknown): EventsConfig {
   return { mode: events.mode === 'on' ? 'on' : 'shadow', routes, linearAssignees };
 }
 
+export type HqFenceRole = 'telegram-poller' | 'cron' | 'seat-loop' | 'release-run' | 'conatus' | 'git-push' | 'ledger-cli';
+export interface HqConfig {
+  /** ssh host that keeps the lease record — homes push to it; it never sshes back (default cloud-vm). */
+  arbiter?: string;
+  /** This host's identity in the lease (default os.hostname()). */
+  hostName?: string;
+  /** Standby host (default node-b) — the quorum's third member; promoted only by the arbiter. */
+  standby?: string;
+  /** Lease TTL in seconds (default 1500 = 25 min). */
+  ttlSeconds?: number;
+  /** Roles that may still run when this host is fenced only for lack of quorum (never when a newer generation exists). Absent = none. */
+  failOpenRoles?: HqFenceRole[];
+  /** Per-host nexus health URL over the tailnet (default https://<host>.<tailnetDomain>:31415/v1/health). */
+  healthUrls?: Record<string, string>;
+  /** MagicDNS suffix (default: read from `tailscale status --json`). */
+  tailnetDomain?: string;
+  /** `tailscale` binary (default tailscale). */
+  tailscaleBin?: string;
+  /** Highest lease generation this host ever saw (default ~/.elanous-hq/seen-generation · 600). */
+  seenGenerationFile?: string;
+  /** Per-probe timeout in seconds (default 5). */
+  probeTimeoutSeconds?: number;
+}
+
 export interface UserConfig {
   events?: EventsConfig;
   /** Explicit HTTPS destination for doctor diagnostics; absent means no upload. */
   diagnostics?: { uploadUrl?: string };
+  /** HQ lease (본부 임대 · 10-04 HQ-HB/HQ-FENCE): arbiter host over ssh, this host's name, per-role fail-open when the arbiter is unreachable (default: fail closed). */
+  hq?: HqConfig;
   /** Root CLI help audience; absent or invalid means owner. */
   cli?: { helpRole?: 'owner' | 'contributor' | 'general' };
   /** Execution-phase HITL answer deadline; absent means 30 minutes. */
   hitl?: { executionDeadlineMinutes?: number };
   coo?: { linearProject?: string };
-  decisions?: { linearProjection: { enabled: boolean } };
+  decisions?: { linearProjection: { enabled: boolean }; requireCrossCheck: boolean };
   /** Per-seat goal and Pod limits; missing or invalid limits use seat-budget defaults. */
   org?: { budget?: Record<string, { dailyGoals?: number; concurrentPods?: number }> };
   /** Steward and seat loops are parsed independently. An absent seat remains off. */
-  loops?: { steward?: { mode?: StewardLoopMode; linearTeam?: string; roles?: Record<string, { maxConcurrent?: number }>; budget?: number; tracks?: Record<string, string>; alertAfterFailures?: number; launch?: 'off' | 'shadow' | 'live'; maxParallel?: number; podPool?: string }; seat?: SeatLoopConfig; persona?: PersonaLoopConfig };
+  loops?: { orchestrator?: OrchestratorLoopConfig; steward?: { mode?: StewardLoopMode; linearTeam?: string; roles?: Record<string, { maxConcurrent?: number }>; budget?: number; tracks?: Record<string, string>; alertAfterFailures?: number; launch?: 'off' | 'shadow' | 'live'; maxParallel?: number; podPool?: string }; seat?: SeatLoopConfig; persona?: PersonaLoopConfig };
   /** 🔐 Pod 의 Grok API 키 과금은 명시 opt-in 만. 생략·잘못된 값은 false.
    *  budgetGate 와 같은 `harness` 객체다 — 중복 선언이면 뒤 타입이 앞을 지운다. */
-  harness?: { pod?: { grokApiKeyOptIn: boolean }; budgetGate?: HarnessBudgetGateConfig; difficultyPlacement?: boolean; defaultRepo?: string; substrate?: 'local' | 'pod'; podPool?: string; worktreeAddTimeoutSec?: number };
+  harness?: { pod?: { grokApiKeyOptIn: boolean }; budgetGate?: HarnessBudgetGateConfig; difficultyPlacement?: boolean; defaultRepo?: string; substrate?: 'local' | 'pod'; podPool?: string; worktreeAddTimeoutSec?: number; queue?: { seatCap?: Partial<Record<'OP' | 'TC' | 'MK' | 'UX', number>> } };
   /** ☸️ Pod 실행 칸 — `pool` = 기존 기본 풀(`컨텍스트[@ssh호스트][:상한][#k3d-레지스트리:포트]` 쉼표 · 앞이 우선). harness 실행은 인자·ELANOUS_POD_POOL·harness.podPool 다음으로 읽는다. */
-  pod?: { pool?: string; /** 호스트 Git 미러 디렉터리 — Pod Job 에 읽기 전용으로 마운트한다. */ hostMirror?: string; /** 원격 그라운딩 엔드포인트(호스트 nexus · tailnet 주소) — Pod 가 토큰으로 «질의→인용»만 묻는다(P13). */ groundingUrl?: string; /** 읽기 전용 Pod lease 권장에 쓰는 계정별 동시 수. */ lease?: { perAccount?: number } };
+  pod?: { pool?: string; /** 호스트 Git 미러 디렉터리 — Pod Job 에 읽기 전용으로 마운트한다. */ hostMirror?: string; /** 원격 그라운딩 엔드포인트(호스트 nexus · tailnet 주소) — Pod 가 토큰으로 «질의→인용»만 묻는다(P13). */ groundingUrl?: string; /** 읽기 전용 Pod lease 권장에 쓰는 계정별 동시 수. */ lease?: { perAccount?: number }; /** 실측 권고를 Pod 발사 기본값으로 쓸지 (기본 off). */ memory?: { adviseDefaults?: boolean } };
   skillRouter: SkillRouterConfig;
   llm: LLMConfig;
   skills: SkillsConfig;
@@ -3860,8 +3913,8 @@ function defaultConfig(): UserConfig {
   return {
     cli: { helpRole: 'owner' },
     coo: { linearProject: '외부 행정·큰 일 (COO)' },
-    decisions: { linearProjection: { enabled: false } },
-    loops: { steward: { mode: 'shadow' }, seat: { mode: 'off', questions: 'shadow', seats: ['MK'], podPool: 'pool-node-b@node-b:8' }, persona: { enabled: false } },
+    decisions: { linearProjection: { enabled: false }, requireCrossCheck: false },
+    loops: { orchestrator: parseOrchestratorLoopConfig(undefined), steward: { mode: 'shadow' }, seat: { mode: 'off', questions: 'shadow', seats: ['MK'], podPool: 'pool-node-b@node-b:8' }, persona: { enabled: false } },
     skillRouter: { ...SR_DEFAULTS },
     llm: { ...LLM_DEFAULTS },
     skills: skillsDefaults(),
@@ -4388,7 +4441,7 @@ function parseStewardLoopsConfig(input: unknown): UserConfig['loops'] {
     }
   }
   return { steward: {
-    mode: s.mode === 'off' || s.mode === 'shadow' || s.mode === 'live' ? s.mode :
+    mode: s.mode === 'off' || s.mode === 'shadow' || s.mode === 'live' || s.mode === 'rescue' ? s.mode :
       s.launch === 'off' || s.launch === 'shadow' || s.launch === 'live' ? s.launch : 'shadow',
     // A valid legacy launch setting remains effective when mode is absent; explicit mode always wins.
     ...(s.launch === 'off' || s.launch === 'shadow' || s.launch === 'live' ? { launch: s.launch } : {}),
@@ -4407,6 +4460,25 @@ export function parseCliHelpRole(raw: unknown): NonNullable<UserConfig['cli']>['
   return cli.helpRole === 'general' || cli.helpRole === 'contributor' ? cli.helpRole : 'owner';
 }
 
+const HQ_FENCE_ROLES: readonly HqFenceRole[] = ['telegram-poller', 'cron', 'seat-loop', 'release-run', 'conatus', 'git-push'];
+/** `hq` block (HQ-HB · HQ-FENCE): keep only well-typed fields — absent/invalid fields fall back to the hq module defaults. */
+export function parseHqConfig(raw: unknown): HqConfig | undefined {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return undefined;
+  const r = raw as Record<string, unknown>;
+  const str = (v: unknown) => typeof v === 'string' && v.trim() ? v.trim() : undefined;
+  const out: HqConfig = {};
+  for (const key of ['arbiter', 'hostName', 'standby', 'tailnetDomain', 'tailscaleBin', 'seenGenerationFile'] as const) {
+    const v = str(r[key]); if (v) out[key] = v;
+  }
+  if (typeof r.ttlSeconds === 'number' && Number.isFinite(r.ttlSeconds) && r.ttlSeconds > 0) out.ttlSeconds = r.ttlSeconds;
+  if (typeof r.probeTimeoutSeconds === 'number' && Number.isFinite(r.probeTimeoutSeconds) && r.probeTimeoutSeconds > 0) out.probeTimeoutSeconds = r.probeTimeoutSeconds;
+  if (Array.isArray(r.failOpenRoles)) out.failOpenRoles = r.failOpenRoles.filter((v): v is HqFenceRole => HQ_FENCE_ROLES.includes(v as HqFenceRole));
+  if (r.healthUrls && typeof r.healthUrls === 'object' && !Array.isArray(r.healthUrls)) {
+    out.healthUrls = Object.fromEntries(Object.entries(r.healthUrls as Record<string, unknown>).filter((e): e is [string, string] => typeof e[1] === 'string'));
+  }
+  return Object.keys(out).length ? out : undefined;
+}
+
 export function buildUserConfig(path: string = defaultPath()): UserConfig {
   if (!existsSync(path)) return defaultConfigWithRuntimeProvider();
   let raw: unknown;
@@ -4532,6 +4604,8 @@ export function buildUserConfig(path: string = defaultPath()): UserConfig {
       ...(typeof legacyPod.pool === 'string' && legacyPod.pool.trim() ? { pool: legacyPod.pool.trim() } : {}),
       ...(typeof legacyPod.hostMirror === 'string' && legacyPod.hostMirror.trim() ? { hostMirror: legacyPod.hostMirror.trim() } : {}),
       ...(typeof legacyPod.groundingUrl === 'string' ? { groundingUrl: legacyPod.groundingUrl } : {}),
+      memory: { adviseDefaults: Boolean(legacyPod.memory && typeof legacyPod.memory === 'object' && !Array.isArray(legacyPod.memory)
+        && (legacyPod.memory as Record<string, unknown>).adviseDefaults === true) },
       lease: { perAccount: (() => {
         const lease = legacyPod.lease && typeof legacyPod.lease === 'object' && !Array.isArray(legacyPod.lease)
           ? (legacyPod.lease as Record<string, unknown>) : {};
@@ -4542,6 +4616,12 @@ export function buildUserConfig(path: string = defaultPath()): UserConfig {
     harness: {
       pod: { grokApiKeyOptIn: harnessPod.grokApiKeyOptIn === true },
       difficultyPlacement: harness.difficultyPlacement === true,
+      queue: { seatCap: Object.fromEntries(Object.entries(
+        harness.queue && typeof harness.queue === 'object' && !Array.isArray(harness.queue)
+          && (harness.queue as Record<string, unknown>).seatCap && typeof (harness.queue as Record<string, unknown>).seatCap === 'object'
+          && !Array.isArray((harness.queue as Record<string, unknown>).seatCap)
+          ? (harness.queue as { seatCap: Record<string, unknown> }).seatCap : {},
+      ).filter(([seat, cap]) => /^(OP|TC|MK|UX)$/.test(seat) && typeof cap === 'number' && Number.isSafeInteger(cap) && cap > 0)) },
       ...(harness.substrate === 'local' || harness.substrate === 'pod' ? { substrate: harness.substrate } : {}),
       ...(typeof harness.podPool === 'string' && harness.podPool.trim() ? { podPool: harness.podPool.trim() } : {}),
       ...(typeof harness.worktreeAddTimeoutSec === 'number' && Number.isSafeInteger(harness.worktreeAddTimeoutSec)
@@ -5186,11 +5266,13 @@ export function buildUserConfig(path: string = defaultPath()): UserConfig {
       && typeof (rawObj.hitl as Record<string, unknown>).executionDeadlineMinutes === 'number'
       ? { hitl: { executionDeadlineMinutes: (rawObj.hitl as { executionDeadlineMinutes: number }).executionDeadlineMinutes } }
       : {}),
+    ...(parseHqConfig(rawObj.hq) ? { hq: parseHqConfig(rawObj.hq)! } : {}),
     cli: { helpRole: parseCliHelpRole(rawObj.cli) },
     coo: { linearProject: typeof (rawObj.coo as { linearProject?: unknown } | undefined)?.linearProject === 'string' && (rawObj.coo as { linearProject: string }).linearProject.trim()
       ? (rawObj.coo as { linearProject: string }).linearProject.trim() : '외부 행정·큰 일 (COO)' },
-    decisions: { linearProjection: { enabled: ((rawObj.decisions as { linearProjection?: { enabled?: unknown } } | undefined)?.linearProjection?.enabled === true) } },
-    loops: { ...(stewardLoops ?? {}), seat: parseSeatLoopsConfig(rawObj.loops),
+    decisions: { linearProjection: { enabled: ((rawObj.decisions as { linearProjection?: { enabled?: unknown } } | undefined)?.linearProjection?.enabled === true) },
+      requireCrossCheck: (rawObj.decisions as { requireCrossCheck?: unknown } | undefined)?.requireCrossCheck === true },
+    loops: { ...(stewardLoops ?? {}), orchestrator: parseOrchestratorLoopConfig((rawObj.loops as { orchestrator?: unknown } | undefined)?.orchestrator), seat: parseSeatLoopsConfig(rawObj.loops),
       persona: { enabled: (rawObj.loops as { persona?: { enabled?: unknown } } | undefined)?.persona?.enabled === true } },
     events: parseEventsConfig(rawObj.events),
     // M1-1: sparse — undefined when the user hasn't set anything, so
@@ -5790,11 +5872,13 @@ export function saveUserConfig(
       defaultRepo: cfg.harness?.defaultRepo ?? rawHarness.defaultRepo,
       substrate: cfg.harness?.substrate,
       podPool: cfg.harness?.podPool,
+      queue: cfg.harness?.queue ?? rawHarness.queue,
     }),
     ...rawRest,
     ...(cfg.loops ? { loops: {
       ...rawLoops,
       ...(cfg.loops.steward ? { steward: { ...rawSteward, mode: cfg.loops.steward.mode ?? cfg.loops.steward.launch ?? 'shadow' } } : {}),
+      ...(cfg.loops.orchestrator ? { orchestrator: cfg.loops.orchestrator } : {}),
       ...(cfg.loops.seat ? { seat: {
         mode: cfg.loops.seat.mode,
         questions: cfg.loops.seat.questions ?? 'shadow',

package/src/version/packed-revision.json

@@ -1 +1 @@
-{"commit":"27045f4612b148543fb0f91b82d37592d1d6c9f2"}
+{"commit":"5116219907580581e7bb40b93018d155deafa5c2"}

package/src/workflow-runtime/executor.ts

@@ -18,6 +18,7 @@ import {
   isClassifyNode,
   isExtractNode,
   isFilterNode,
+  isKnowledgeNode,
   isHttpRequestNode,
   isIfNode,
   isIterationNode,
@@ -57,6 +58,7 @@ import { executeExtractNode } from './nodes/extract.js';
 import { executeSetNode } from './nodes/set.js';
 import { executeTaskNode } from './nodes/task.js';
 import { executeFilterNode } from './nodes/filter.js';
+import { executeKnowledgeNode } from './nodes/knowledge.js';
 import { executeTemplateNode } from './nodes/template.js';
 import { executeHttpRequestNode } from './nodes/http.js';
 import { executeShowroomNode } from './nodes/showroom.js';
@@ -706,6 +708,7 @@ async function dispatchNode(
   if (isExtractNode(node)) return executeExtractNode(node, ctx, deps);
   if (isSetNode(node)) return executeSetNode(node, ctx, deps);
   if (isFilterNode(node)) return executeFilterNode(node, ctx, deps);
+  if (isKnowledgeNode(node)) return executeKnowledgeNode(node, ctx, deps);
   if (isTemplateNode(node)) return executeTemplateNode(node, ctx, deps);
   if (isHttpRequestNode(node)) return executeHttpRequestNode(node, ctx, deps);
   if (isShowroomNode(node)) return executeShowroomNode(node, ctx, deps);
@@ -748,6 +751,7 @@ function isTriggerVariant(node: DagNode): boolean {
 
 function variantOf(node: DagNode): string {
   if (isPluginKindNode(node)) return node.kind;
+  if (isKnowledgeNode(node)) return 'knowledge';
   const guards: ReadonlyArray<(node: DagNode) => boolean> = [
     isPromptNode, isBashNode, isSkillNode, isCftNode, isApprovalNode, isIfNode,
     isSwitchNode, isIterationNode, isClassifyNode, isExtractNode, isSetNode,

package/src/workflow-runtime/node-catalog.ts

@@ -207,6 +207,19 @@ export const NODE_CATALOG: readonly NodeSpec[] = [
     condition: $item != 'skip'`,
     related: ['iteration'],
   },
+  {
+    kind: 'knowledge',
+    category: 'transform',
+    summary: '볼트 검색 · 찾은 조각을 다음 노드에',
+    yamlKey: 'knowledge',
+    required: ['query'],
+    optional: ['limit'],
+    example: `- id: notes
+  knowledge:
+    query: $ARGUMENTS
+    limit: 3`,
+    related: ['prompt'],
+  },
   {
     kind: 'template',
     category: 'transform',

package/src/workflow-runtime/nodes/knowledge.ts

@@ -0,0 +1,38 @@
+import { dispatchElanousObsidianSearch } from '../../tool-runtime/elanous-obsidian-search-runtime.js';
+import type { KnowledgeNode, NodeExecContext, NodeOutput, WorkflowDeps } from '../types.js';
+import { interpolate } from '../variables.js';
+
+export async function executeKnowledgeNode(
+  node: KnowledgeNode,
+  ctx: NodeExecContext,
+  deps: WorkflowDeps,
+): Promise<NodeOutput> {
+  const startedAt = Date.now();
+  try {
+    const query = interpolate(node.knowledge.query, {
+      arguments: ctx.arguments,
+      artifactsDir: ctx.artifactsDir,
+      outputs: ctx.outputs,
+    }).text;
+    const limit = node.knowledge.limit ?? 5;
+    const result = await (deps.searchObsidian ?? dispatchElanousObsidianSearch)({ query, limit });
+    const matches = result.matches;
+    return {
+      ok: true,
+      output: result.error ? '' : matches.slice(0, limit)
+        .map(match => `— ${match.path}:${match.lineNumber}\n${match.snippet.slice(0, 400)}`)
+        .join('\n\n'),
+      matches,
+      ...(result.error ? { error: result.error } : matches.length === 0 ? { error: 'no matches' } : {}),
+      durationMs: Date.now() - startedAt,
+    };
+  } catch (err) {
+    return {
+      ok: true,
+      output: '',
+      matches: [],
+      error: err instanceof Error ? err.message : String(err),
+      durationMs: Date.now() - startedAt,
+    };
+  }
+}