elanous 0.2.13 → 0.2.14

package/src/hq/promote.ts

@@ -0,0 +1,301 @@
+// HQ promotion runbook: read-only preview by default; all remote mutations are behind --apply.
+import { spawnSync } from 'node:child_process';
+import { getUserConfig } from '../user-config.js';
+import { parseLease, sshLeaseStore, defaultSshRunner, localShellRunner } from './lease.js';
+
+export interface PromoteRunner {
+  lease(): { holder: string | null; generation: number | null; expired: boolean };
+  run(host: string, script: string): { status: number | null; stdout: string; stderr: string };
+}
+
+export interface PromoteLine { step: string; status: 'ready' | 'done' | 'failed'; measurement: string; command: string }
+export interface PromoteResult { ok: boolean; apply: boolean; host: string; lines: PromoteLine[] }
+
+const install = '"$HOME/.local/share/elanous/current/node_modules/elanous"';
+const state = '"$HOME/.elanous-hqstate"';
+const cli = 'elanous';
+// A bind to the same address as nexus distinguishes an available socket from an
+// occupied or uninspectable one; lsof's exit 1 alone cannot make that distinction.
+const portProbe = `command -v lsof >/dev/null || { echo 'lsof unavailable' >&2; exit 1; }
+python3 -c 'import os,socket,subprocess,sys; s=socket.socket(); s.bind(("127.0.0.1",0)); s.listen(); r=subprocess.run(["lsof","-nP","-t","-iTCP:"+str(s.getsockname()[1]),"-sTCP:LISTEN"],capture_output=True,text=True); s.close(); sys.exit(0 if r.returncode == 0 and r.stdout.strip() == str(os.getpid()) else "lsof control listener unreadable: "+r.stderr.strip())' || exit 1
+port_detail=$(lsof -nP -t -iTCP:31416 -sTCP:LISTEN 2>&1); port_rc=$?
+if [ "$port_rc" -ne 1 ] || [ -n "$port_detail" ]; then echo "port=31416 occupied or unreadable: $port_detail (lsof=$port_rc)" >&2; exit 1; fi
+python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1", 31416)); s.close(); print("port=31416 available")'`;
+// The drill uses short SSH aliases; host-local hq.hostName may use either the short or full name.
+const hostNamesFor = (host: string): string[] => host === 'node-b' ? ['node-b', 'MacStudioB1']
+  : host === 'mbp' ? ['mbp', 'MacBookProM5'] : [host];
+const checks: Array<[string, string]> = [
+  ['PWA build', `test -f "$HOME/.local/share/elanous/current/node_modules/elanous/apps/pwa/out/index.html" && echo 'index.html present'`],
+  ['MCP list', `set -o pipefail; codex mcp list --json | python3 -c 'import json,sys; data=json.load(sys.stdin); print("MCP entries="+str(len(data)))'`],
+  ['installed hq', `${cli} hq promote --help >/dev/null && python3 -c 'import json,pathlib; p=pathlib.Path.home()/".elanous-hqcfg/config.json"; print("host="+json.loads(p.read_text())["hq"]["hostName"])'`],
+];
+const stages: Array<[string, string]> = [
+  ['standby checksums', `cd ${install} && bun -e 'import("node:fs/promises").then(async ({ readlink }) => { const root = process.env.HOME + "/.elanous-standby"; const generations = { core: await readlink(root + "/core/latest"), big: await readlink(root + "/big/latest") }; const { verifyStandby } = await import("./scripts/hq/standby-verify.ts"); const result = await verifyStandby({ root, tiers: ["core", "big"], generations }); console.log(JSON.stringify(result)); if (!result.ok) process.exitCode = 1 }).catch(error => { console.error(error); process.exitCode = 1 })'`],
+  ['copy to promotion universe', `python3 - <<'PY'
+import hashlib, json, os, pathlib, shutil, tempfile
+home = pathlib.Path.home()
+standby = home / '.elanous-standby'
+target = home / '.elanous-hqstate'
+parent = target.parent
+stage = pathlib.Path(tempfile.mkdtemp(prefix='.elanous-hqstate-promote-', dir=parent))
+backup = None
+try:
+    copied = 0
+    for tier in ('core', 'big'):
+        generation = os.environ['HQ_PROMOTE_' + tier.upper()]
+        source = standby / tier / generation
+        if not source.is_dir() or source.is_symlink():
+            raise ValueError('missing or symlinked pinned generation: ' + tier)
+        manifest_bytes = (source / 'MANIFEST.json').read_bytes()
+        expected_manifest = os.environ['HQ_PROMOTE_' + tier.upper() + '_MANIFEST_SHA256']
+        if hashlib.sha256(manifest_bytes).hexdigest() != expected_manifest:
+            raise ValueError('verified manifest changed: ' + tier)
+        manifest = json.loads(manifest_bytes)
+        if manifest['tier'] != tier or manifest['generation'] != generation:
+            raise ValueError('generation changed: ' + tier)
+        for entry in manifest['entries']:
+            name = entry['path']
+            rel = pathlib.PurePosixPath(name)
+            if not name or rel.is_absolute() or '..' in rel.parts or name.startswith('./') or chr(92) in name or name in ('MANIFEST.json', 'SHA256SUMS'):
+                raise ValueError('invalid manifest path: ' + name)
+            src = source
+            for part in rel.parts:
+                src = src / part
+                if src.is_symlink():
+                    raise ValueError('symlinked source: ' + name)
+            if not src.is_file():
+                raise ValueError('missing source: ' + name)
+            dest = stage / name
+            if dest.parent.is_symlink():
+                raise ValueError('symlinked destination parent: ' + name)
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            if dest.is_symlink():
+                raise ValueError('symlinked destination: ' + name)
+            shutil.copy2(src, dest)
+            digest = hashlib.sha256(dest.read_bytes()).hexdigest()
+            if digest != entry['sha256']:
+                raise ValueError('checksum changed during copy: ' + name)
+            copied += 1
+        if hashlib.sha256((source / 'MANIFEST.json').read_bytes()).hexdigest() != expected_manifest:
+            raise ValueError('verified manifest changed during copy: ' + tier)
+    for tier in ('core', 'big'):
+        source = standby / tier / os.environ['HQ_PROMOTE_' + tier.upper()]
+        expected_manifest = os.environ['HQ_PROMOTE_' + tier.upper() + '_MANIFEST_SHA256']
+        if hashlib.sha256((source / 'MANIFEST.json').read_bytes()).hexdigest() != expected_manifest:
+            raise ValueError('verified manifest changed before promotion: ' + tier)
+    if not (stage / 'release/features.sqlite').is_file() or not (stage / 'config.json').is_file():
+        raise ValueError('core promotion files missing')
+    if target.is_symlink() or (target.exists() and not target.is_dir()):
+        raise ValueError('promotion target is not a directory')
+    if target.exists():
+        backup = pathlib.Path(tempfile.mkdtemp(prefix='.elanous-hqstate-old-', dir=parent))
+        backup.rmdir()
+        target.rename(backup)
+    try:
+        stage.rename(target)
+    except BaseException:
+        if backup is not None:
+            backup.rename(target)
+            backup = None
+        raise
+    bytes_count = sum(p.stat().st_size for p in target.rglob('*') if p.is_file())
+    if backup is not None:
+        shutil.rmtree(backup)
+        backup = None
+    print('promotion files=' + str(copied) + ' bytes=' + str(bytes_count) + 'B')
+finally:
+    if stage.exists():
+        shutil.rmtree(stage)
+PY`],
+  ['target hq config', `python3 - <<'PY'
+import json, os, pathlib, tempfile
+source = pathlib.Path.home() / '.elanous-hqcfg/config.json'
+target = pathlib.Path.home() / '.elanous-hqstate/config.json'
+with source.open() as f: hq = json.load(f)['hq']
+with target.open() as f: config = json.load(f)
+assert isinstance(hq, dict) and hq.get('hostName') == os.environ['HQ_PROMOTE_HOST'], 'host-specific hq config mismatch'
+config['hq'] = hq
+with tempfile.NamedTemporaryFile(mode='w', dir=target.parent, prefix='config.promote-', delete=False) as f:
+    tmp = pathlib.Path(f.name)
+    json.dump(config, f)
+    f.write(chr(10))
+try:
+    os.chmod(tmp, 0o600)
+    os.replace(tmp, target)
+finally:
+    tmp.unlink(missing_ok=True)
+print('hq.hostName=' + hq['hostName'])
+PY`],
+  ['nexus health', `command -v lsof >/dev/null || { echo 'lsof unavailable: cannot identify nexus listener' >&2; exit 1; }
+${portProbe} || { echo 'port=31416 already occupied or unreadable' >&2; exit 1; }
+ELANOUS_STATE_DIR=${state} ${cli} --config-dir ${state} nexus run --port 31416 --http-host 127.0.0.1 --no-mcp --no-auto-build --no-auto-install --no-auto-restart --no-watch > "$HOME/.elanous-hqstate/nexus-promote.log" 2>&1 & pid=$!
+descendants() {
+  for child in $(pgrep -P "$1" 2>/dev/null); do descendants "$child"; echo "$child"; done
+}
+cleanup() {
+  tree=$(descendants "$pid")
+  for proc in $tree; do kill "$proc" 2>/dev/null || true; done
+  kill "$pid" 2>/dev/null || true
+  wait "$pid" 2>/dev/null || true
+  n=0
+  until ${portProbe} >/dev/null 2>&1; do
+    if [ "$n" -ge 10 ]; then echo 'port=31416 still occupied after cleanup' >&2; return 1; fi
+    n=$((n+1)); sleep 1
+  done
+  echo 'nexus stopped port=31416 released' >&2
+}
+trap 'cleanup' EXIT
+n=0
+code=000
+owner=''
+owned=0
+while [ "$n" -lt 15 ]; do
+  code=$(curl -s --max-time 2 -o /dev/null -w '%{http_code}' http://127.0.0.1:31416/v1/health) || code=000
+  listeners=$(lsof -nP -t -iTCP:31416 -sTCP:LISTEN 2> /dev/null) || listeners=''
+  owner=$(printf '%s\\n' "$listeners" | head -n 1)
+  ancestor=$owner
+  owned=0
+  while [ -n "$ancestor" ] && [ "$ancestor" != 1 ]; do
+    if [ "$ancestor" = "$pid" ]; then owned=1; break; fi
+    ancestor=$(ps -o ppid= -p "$ancestor" | tr -d '[:space:]')
+  done
+  if [ "$code" = 200 ] && [ "$owned" = 1 ] && [ "$listeners" = "$owner" ] && kill -0 "$pid" 2>/dev/null; then
+    trap - EXIT
+    echo "health=$code port=31416 pid=$pid listener_pid=$owner"; exit 0
+  fi
+  if ! kill -0 "$pid" 2>/dev/null; then break; fi
+  n=$((n+1)); sleep 2
+done
+echo "health=$code port=31416 nexus_pid=$pid listener_pid=$owner owned=$owned" >&2; exit 1`],
+  ['steward rescue', `ELANOUS_STATE_DIR=${state} ${cli} --config-dir ${state} steward mode rescue && ELANOUS_STATE_DIR=${state} ${cli} --config-dir ${state} steward mode --json`],
+];
+
+// One --apply per target host: stages run as separate ssh calls, so the lock is a directory that outlives each call.
+const lockDir = '"$HOME/.elanous-hq/promote.lock"';
+export const promoteLockAcquire = `mkdir -p "$HOME/.elanous-hq" && if mkdir ${lockDir} 2>/dev/null; then printf '%s %s\\n' "$PPID" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > ${lockDir}/owner; else echo "promote lock held: $(cat ${lockDir}/owner 2>/dev/null) · remove ${lockDir} only after confirming no promote is running" >&2; exit 1; fi`;
+export const promoteLockRelease = `rm -rf ${lockDir}`;
+
+export function defaultPromoteRunner(): PromoteRunner {
+  const config = getUserConfig().hq ?? {};
+  const arbiter = config.arbiter ?? 'cloud-vm';
+  const store = sshLeaseStore(arbiter, arbiter === 'local' ? localShellRunner : defaultSshRunner);
+  return {
+    lease() {
+      const { now, raw } = store.read();
+      const record = parseLease(raw);
+      return { holder: record?.holder ?? null, generation: record?.generation ?? null,
+        expired: !record || now - record.renewedAt > record.ttlSeconds };
+    },
+    run(host, script) {
+      const r = spawnSync('ssh', ['-o', 'BatchMode=yes', host, `bash -c '${script.replaceAll("'", "'\\''")}'`], { encoding: 'utf8', timeout: 120_000 });
+      return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
+    },
+  };
+}
+
+export function promoteHq(host: string, apply = false, runner: PromoteRunner = defaultPromoteRunner()): PromoteResult {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(host) || host.includes('..')) throw new Error('hq promote: invalid host');
+  const lines: PromoteLine[] = [];
+  const acceptedHostNames = hostNamesFor(host);
+  const result = (step: string, command: string, status: PromoteLine['status'], measurement: string) => {
+    lines.push({ step, status, measurement, command });
+  };
+  let preflightOk = true;
+  for (const [name, command] of checks) {
+    let r: ReturnType<PromoteRunner['run']>;
+    try { r = runner.run(host, command); } catch (error) { r = { status: null, stdout: '', stderr: String(error) }; }
+    const ok = r.status === 0 && (name !== 'installed hq' || acceptedHostNames.some(name => r.stdout.trim() === `host=${name}`));
+    if (!ok) preflightOk = false;
+    result(`preflight ${name}`, command, ok ? 'done' : 'failed', (r.status === 0 ? r.stdout : r.stderr).trim() || `exit=${r.status}`);
+  }
+  let lease: ReturnType<PromoteRunner['lease']>;
+  try { lease = runner.lease(); } catch (error) {
+    result('① lease', 'read arbiter lease', 'failed', String(error));
+    return { ok: false, apply, host, lines };
+  }
+  if (!acceptedHostNames.includes(lease.holder ?? '') || lease.expired) {
+    result('① lease', 'read arbiter lease', 'failed', `holder=${lease.holder ?? 'none'} generation=${lease.generation ?? 'none'} expired=${lease.expired}`);
+    return { ok: false, apply, host, lines };
+  }
+  result('① lease', 'read arbiter lease', 'done', `holder=${lease.holder} generation=${lease.generation} expired=false`);
+  const targetHostName = lines.find(line => line.step === 'preflight installed hq')?.measurement.trim().replace(/^host=/, '') ?? '';
+  if (!acceptedHostNames.includes(targetHostName) || targetHostName !== lease.holder) {
+    result('① lease', 'compare arbiter holder to target hq.hostName', 'failed', `holder=${lease.holder} hq.hostName=${targetHostName}`);
+    return { ok: false, apply, host, lines };
+  }
+  if (apply && !preflightOk) return { ok: false, apply, host, lines };
+  let pinned: { core: string; big: string; coreManifestSha256: string; bigManifestSha256: string } | null = null;
+  let locked = false;
+  try {
+  for (let i = 0; i < stages.length; i++) {
+    const [name, script] = stages[i];
+    const command = i === 1 && pinned
+      ? `HQ_PROMOTE_CORE=${pinned.core} HQ_PROMOTE_BIG=${pinned.big} HQ_PROMOTE_CORE_MANIFEST_SHA256=${pinned.coreManifestSha256} HQ_PROMOTE_BIG_MANIFEST_SHA256=${pinned.bigManifestSha256} ${script}`
+      : i === 2 ? `HQ_PROMOTE_HOST=${targetHostName} ${script}` : script;
+    if (apply && i > 0) {
+      try {
+        const current = runner.lease();
+        if (current.holder !== targetHostName || current.generation !== lease.generation || current.expired) {
+          result(`${'②③④⑤⑥'[i]} ${name}`, command, 'failed', `lease changed: holder=${current.holder ?? 'none'} generation=${current.generation ?? 'none'} expired=${current.expired}`);
+          return { ok: false, apply, host, lines };
+        }
+      } catch (error) {
+        result(`${'②③④⑤⑥'[i]} ${name}`, command, 'failed', `lease read failed: ${String(error)}`);
+        return { ok: false, apply, host, lines };
+      }
+    }
+    if (!apply && i > 0) {
+      result(`${'②③④⑤⑥'[i]} ${name}`, command, 'ready', `dry-run: would run on ${host}; no writes`);
+      continue;
+    }
+    if (apply && i === 1) {
+      // The host lock and the port probe share one call: the lock is held from before the copy until the finally below.
+      const lockedProbe = `${promoteLockAcquire} && ${portProbe}`;
+      let probe: ReturnType<PromoteRunner['run']>;
+      try { probe = runner.run(host, lockedProbe); } catch (error) { probe = { status: null, stdout: '', stderr: String(error) }; }
+      locked = !probe.stderr.includes('promote lock held');
+      if (!locked) {
+        result('③ copy to promotion universe', lockedProbe, 'failed', probe.stderr.trim());
+        return { ok: false, apply, host, lines };
+      }
+      if (probe.status !== 0 || probe.stdout.trim() !== 'port=31416 available') {
+        result('③ copy to promotion universe', portProbe, 'failed', `port=31416 occupied or unreadable before copy: ${probe.stderr.trim() || probe.stdout.trim() || `exit=${probe.status}`}`);
+        return { ok: false, apply, host, lines };
+      }
+    }
+    let r: ReturnType<PromoteRunner['run']>;
+    try { r = runner.run(host, command); } catch (error) { r = { status: null, stdout: '', stderr: String(error) }; }
+    let measurement = (r.status === 0 ? r.stdout : r.stderr).trim() || `exit=${r.status}`;
+    let ok = r.status === 0;
+    if (i === 1 && ok) ok = /promotion files=\d+ bytes=\d+B/.test(r.stdout);
+    if (i === 2 && ok) ok = r.stdout.trim() === `hq.hostName=${targetHostName}`;
+    if (i === 3 && ok) ok = /health=200 port=31416 pid=\d+ listener_pid=\d+\b/.test(r.stdout);
+    if (i === 4 && ok) ok = /"mode"\s*:\s*"rescue"/.test(r.stdout);
+    if (i === 0 && ok) {
+      try {
+        const verification = JSON.parse(r.stdout) as { ok?: boolean; tiers?: Array<{ tier: string; generation: string | null; manifestSha256: string | null; checked: number; entries: number | null }> };
+        ok = verification.ok === true && verification.tiers?.length === 2
+          && verification.tiers.map(t => t.tier).join(',') === 'core,big'
+          && verification.tiers.every(t => t.generation && /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(t.generation)
+            && typeof t.manifestSha256 === 'string' && /^[a-f0-9]{64}$/.test(t.manifestSha256)
+            && t.entries !== null && t.entries > 0 && t.checked === t.entries) === true;
+        if (ok) pinned = { core: verification.tiers![0].generation!, big: verification.tiers![1].generation!,
+          coreManifestSha256: verification.tiers![0].manifestSha256!, bigManifestSha256: verification.tiers![1].manifestSha256! };
+      } catch { ok = false; }
+      if (!ok) measurement = `checksum verification failed · ${measurement}`;
+    }
+    result(`${'②③④⑤⑥'[i]} ${name}`, command, ok ? 'done' : 'failed', measurement);
+    if (!ok) return { ok: false, apply, host, lines };
+  }
+  return { ok: preflightOk, apply, host, lines };
+  } finally {
+    if (locked) {
+      try { runner.run(host, promoteLockRelease); } catch { /* the lock names its owner for manual release */ }
+    }
+  }
+}
+
+export function formatPromote(result: PromoteResult): string {
+  return [`hq promote --to ${result.host} ${result.apply ? '--apply' : '(dry-run)'}`,
+    ...result.lines.map(line => `${line.step}: ${line.status} · ${line.measurement}${line.status === 'ready' ? ` · ${line.command}` : ''}`)].join('\n');
+}

package/src/index.ts

@@ -63,6 +63,8 @@ import { registerUsageCommand } from './cli/usage-cli.js';
 import { registerLiveCommands } from './cli/live-cli.js';
 import { registerResearchCommand } from './cli/research-cli.js';
 import { registerReleaseCommands } from './cli/release-cli.js';
+import { registerFreezeCommands } from './cli/freeze-cli.js';
+import { registerFlowCommands } from './cli/flow-cli.js';
 import { registerModelWatchCommand } from './cli/model-watch-cli.js';
 import { registerIntakeCommands } from './cli/intake-cli.js';
 import { registerTasksCommands } from './cli/tasks-cli.js';
@@ -869,6 +871,8 @@ registerUsageCommand(program);
 registerLiveCommands(program);
 registerResearchCommand(program);
 registerReleaseCommands(program);
+registerFreezeCommands(program);
+registerFlowCommands(program);
 // HQ-HB · HQ-FENCE (10-04): one writer across mbp · node-b · cloud-vm — lease on the arbiter, 2-of-3 quorum, generation fencing.
 const hqCmd = program.command('hq').description('본부 임대 — 하트비트·중재·단일 작성자 래퍼');
 async function hqSink(): Promise<void> {
@@ -897,6 +901,19 @@ hqCmd.command('lease').argument('<action>', 'acquire|renew|status|release')
       if (!result.ok) process.exitCode = 2;
     } catch (error) { if (error instanceof CliUserError) throw error; console.error(`hq lease: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
   });
+hqCmd.command('promote').description('HQ 승격 런북 (기본 dry-run · --apply 일 때만 변경)')
+  .requiredOption('--to <host>', '승격 대상 호스트')
+  .option('--apply', '대기 사본을 승격 우주에 반영하고 넥서스·rescue 실행')
+  .option('--json', 'JSON 출력')
+  .action(async (opts: { to: string; apply?: boolean; json?: boolean }) => {
+    try {
+      const { promoteHq, formatPromote } = await import('./hq/promote.js');
+      const result = promoteHq(opts.to, opts.apply === true);
+      if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+      else console.log(formatPromote(result));
+      if (!result.ok) process.exitCode = 1;
+    } catch (error) { console.error(`hq promote: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+  });
 hqCmd.command('heartbeat').description('보유자는 갱신 · 아니면 대기(보유자에 닿는지 중재자에 보고)').option('--json', 'JSON 출력')
   .action(async (opts: { json?: boolean }) => {
     try {
@@ -3034,6 +3051,8 @@ export async function runHarnessOrchestrateExecution(
     prior,
     goals,
     pid,
+    ...(['OP', 'TC', 'MK', 'UX'].includes(process.env.ELANOUS_HARNESS_SEAT ?? '')
+      ? { seat: process.env.ELANOUS_HARNESS_SEAT as SelfDevRunState['seat'] } : {}),
     runIdSource,
     now,
     onPersistenceFailure: reportPersistenceFailure,
@@ -3151,7 +3170,7 @@ contextCmd.command('condense')
       if (!/^[1-9]\d*h$/.test(opts.since)) throw new Error('--since requires positive hours, e.g. 24h');
       const { runContextCondense } = await import('./context-bus/condense.js');
       const report = await runContextCondense({ hours: Number(opts.since.slice(0, -1)), apply: opts.apply === true });
-      await writeStdoutJson(JSON.stringify({ since: report.since, until: report.until, cards: report.cards, conflicts: report.conflicts, skipped: report.skipped, folded: report.folded, ...(report.applied ? { applied: report.applied } : {}) }) + '\n');
+      await writeStdoutJson(JSON.stringify({ since: report.since, until: report.until, cards: report.cards, conflicts: report.conflicts, skipped: report.skipped, folded: report.folded, droppedHarnessChild: report.droppedHarnessChild, funnel: report.funnel, ...(report.applied ? { applied: report.applied } : {}) }) + '\n');
       if (!opts.json) await writeStdoutFully(report.markdown);
     } catch (error) {
       console.error(`context condense: ${error instanceof Error ? error.message : String(error)}`);
@@ -4300,6 +4319,35 @@ selfCmd
     } catch (e) { console.error(`⛔ ${(e as Error).message}`); process.exitCode = 1; }
   });
 
+export async function announceLaunchQuotaPolicy(input: {
+  runId: string;
+  current: import('./oauth/codex-quota-policy.js').ResolvedCodexQuotaPolicy;
+  universe: { kind: 'prod' | 'test'; root: string };
+  production?: import('./oauth/codex-quota-policy.js').ResolvedCodexQuotaPolicy;
+}): Promise<{ line: string; warning?: string; quotaPolicy: {
+  policy: import('./oauth/codex-quota-policy.js').CodexQuotaPolicy;
+  source: import('./oauth/codex-quota-policy.js').ResolvedCodexQuotaPolicy['source'];
+  universeKind: 'prod' | 'test';
+} }> {
+  const { describeLaunchQuotaPolicy } = await import('./oauth/codex-quota-policy.js');
+  const { appendRunLedgerEntry } = await import('./self-implement/run-ledger.js');
+  const described = describeLaunchQuotaPolicy(input);
+  const data = { policy: input.current.policy, source: input.current.source, universe: input.universe,
+    ...(described.warning ? { warning: described.warning } : {}) };
+  try {
+    appendRunLedgerEntry({ runId: input.runId, timestamp: new Date().toISOString(), event: 'launch-quota-policy', data });
+  } catch (error) {
+    debug.log('pod.quota-policy', 'ledger-unavailable', { runId: input.runId, error: String(error) }, { level: 'warn' });
+    throw new Error(`pod launch quota policy ledger write failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  debug.log('pod.quota-policy', 'announced', data);
+  return { ...described, quotaPolicy: { policy: input.current.policy, source: input.current.source, universeKind: input.universe.kind } };
+}
+
+export function withLaunchQuotaPolicy<T extends object>(results: readonly T[], quotaPolicy: Awaited<ReturnType<typeof announceLaunchQuotaPolicy>>['quotaPolicy'] | undefined): (T & { quotaPolicy?: Awaited<ReturnType<typeof announceLaunchQuotaPolicy>>['quotaPolicy'] })[] {
+  return quotaPolicy ? results.map((result) => ({ ...result, quotaPolicy })) : [...results];
+}
+
 // self orchestrate — 병렬 self-dev(S1·2026-07-21) — N개 독립 goal 을 각자 `elanous self implement` 서브프로세스로
 //   TOX 디스패처 위에서 동시성캡 병렬 실행. 각 잡=자기 프로세스=자기 harness-space(병렬안전). 엔진(그래프/
 //   디스패처)은 기존 재사용·새 조각=self-implement surface 어댑터. [[PLAN-parallel-self-dev-orchestrator-2026-07-21]].
@@ -4458,6 +4506,8 @@ const selfOrchestrateCmd = selfCmd
         prior,
         goals,
         pid: process.pid,
+        ...(['OP', 'TC', 'MK', 'UX'].includes(process.env.ELANOUS_HARNESS_SEAT ?? '')
+          ? { seat: process.env.ELANOUS_HARNESS_SEAT as SelfDevRunState['seat'] } : {}),
         runIdSource,
         now: () => Date.now(),
       });
@@ -4492,6 +4542,7 @@ const selfOrchestrateCmd = selfCmd
       //   coordinator 해석(decompose·run-identity·checkpoint·board)은 액션에 유지·감독 콜백은 runtime 으로 주입.
       // ☸️ 실행 칸 — pod 면 self-implement 자식을 k8s Job 으로(계약 동일 · 슈퍼바이저 무수정).
       const substrate = (opts as { substrate?: string }).substrate ?? 'local';
+      let launchQuotaPolicy: Awaited<ReturnType<typeof announceLaunchQuotaPolicy>>['quotaPolicy'] | undefined;
       let podSpawn: import('./task-orchestrator/surfaces/self-implement.js').SelfImplementJobSpawn | undefined;
       let podTargets: { context: string; namespace: string }[] | undefined;
       if (substrate === 'pod') {
@@ -4574,30 +4625,39 @@ const selfOrchestrateCmd = selfCmd
           const resolvedQuota = resolveCodexQuotaPolicy(getUserConfig().llm);
           const quotaPolicy = resolvedQuota.policy;
           // POL1 — say which policy this launch uses and where it came from; warn when a test universe disagrees with production.
-          try {
-            const { effectiveInstanceRoot, prodInstanceRoot } = await import('./instance/resolve.js');
-            const { describeLaunchQuotaPolicy } = await import('./oauth/codex-quota-policy.js');
-            const root = effectiveInstanceRoot();
-            const kind = root === prodInstanceRoot() ? 'prod' as const : 'test' as const;
-            let production: ReturnType<typeof resolveCodexQuotaPolicy> | undefined;
-            if (kind === 'test') {
-              try {
-                const { readFileSync } = await import('node:fs');
-                const prodLlm = (JSON.parse(readFileSync(`${prodInstanceRoot()}/config.json`, 'utf8')) as { llm?: Record<string, unknown> }).llm;
-                production = resolveCodexQuotaPolicy(prodLlm);
-              } catch { /* no production config on this machine */ }
+          const { effectiveInstanceRoot, prodInstanceRoot } = await import('./instance/resolve.js');
+          const root = effectiveInstanceRoot();
+          const kind = root === prodInstanceRoot() ? 'prod' as const : 'test' as const;
+          let production: ReturnType<typeof resolveCodexQuotaPolicy> | undefined;
+          if (kind === 'test') {
+            try {
+              const { readFileSync } = await import('node:fs');
+              const prodLlm = (JSON.parse(readFileSync(`${prodInstanceRoot()}/config.json`, 'utf8')) as { llm?: Record<string, unknown> }).llm;
+              production = resolveCodexQuotaPolicy(prodLlm);
+            } catch { /* no production config on this machine */ }
+          }
+          const described = await announceLaunchQuotaPolicy({ runId, current: resolvedQuota, universe: { kind, root }, ...(production ? { production } : {}) });
+          launchQuotaPolicy = described.quotaPolicy;
+          debug.log('self-implement.pod', 'quota-policy', { policy: resolvedQuota.policy, source: resolvedQuota.source, universe: kind, productionPolicy: production?.policy ?? null });
+          if (!opts.json) { ui.info(described.line); if (described.warning) ui.warn(described.warning); }
+          // GROK-OPTIONAL (10-05): an expiring grok subscription the host cannot refresh is dropped from the chain here,
+          // so the launch goes on with codex instead of dying later in hostGrokCredentials.
+          let grokSubscriptionUsable = credential?.kind === 'subscription';
+          if (grokSubscriptionUsable && codexPolicyAllowsFallback(quotaPolicy)) {
+            const { podGrokSubscriptionUsable, podGrokSkippedLine } = await import('./task-orchestrator/surfaces/self-implement-pod.js');
+            const grokCheck = podGrokSubscriptionUsable();
+            if (!grokCheck.usable) {
+              grokSubscriptionUsable = false;
+              if (!opts.json) ui.warn(podGrokSkippedLine(grokCheck));
             }
-            const described = describeLaunchQuotaPolicy({ current: resolvedQuota, universe: { kind, root }, ...(production ? { production } : {}) });
-            debug.log('self-implement.pod', 'quota-policy', { policy: resolvedQuota.policy, source: resolvedQuota.source, universe: kind, productionPolicy: production?.policy ?? null });
-            if (!opts.json) { ui.info(described.line); if (described.warning) ui.warn(described.warning); }
-          } catch { /* the line is advice; the launch goes on */ }
+          }
           const plan = planPodProvider({
             codexCandidates: inspectCodexRotation().candidates,
             // Per-account caps (대표 default:97) override the Pod default cap — without them default was dropped at 60%.
             thresholdPercentByAccount: getUserConfig().llm?.codexAccountRotationThresholdPercentByAccount,
             // 대표 한도 정책 한 값(`llm.codexQuotaPolicy`) — 크레딧·폴백을 같이 정한다.
             creditsAllowed: codexPolicyAllowsCredits(quotaPolicy),
-            grokSubscription: codexPolicyAllowsFallback(quotaPolicy) && credential?.kind === 'subscription',
+            grokSubscription: codexPolicyAllowsFallback(quotaPolicy) && grokSubscriptionUsable,
             grokApiKey: codexPolicyAllowsFallback(quotaPolicy) && credential?.kind === 'api_key',
             grokApiKeyOptIn,
           });
@@ -4714,7 +4774,7 @@ const selfOrchestrateCmd = selfCmd
           debug.log('self-dev.reduce', 'orchestrate-reduce', { runId, shards: shards.length, kind: r.kind });
         }
       }
-      if (opts.json) { await writeStdoutJson(JSON.stringify(results) + '\n'); await reportRun(results); return; }
+      if (opts.json) { await writeStdoutJson(JSON.stringify(withLaunchQuotaPolicy(results, launchQuotaPolicy)) + '\n'); await reportRun(results); return; }
       const done = results.filter((r) => r.status === 'done').length;
       const promoted = results.filter((r) => r.prUrl).length;
       const incomplete = results.length - done;
@@ -6811,7 +6871,8 @@ const selfDevCmd = program
         const { dispatchHarnessOnPod } = await import('./harness/harness-pod-dispatch.js');
         const { devAskPodDispatchInput } = await import('./harness/harness-substrate-default.js');
         const { classifyHarnessPodExit, harnessPodRunId, recordClassifiedHarnessPodExit, warnRecentIncidentBurst } = await import('./harness/harness-cli-command.js');
-        warnRecentIncidentBurst();
+        warnRecentIncidentBurst(undefined, undefined, undefined,
+          { entrance: 'cli-dev-ask', seat: opts.seat });
         let podOutput = '';
         let podRunId: string | undefined;
         const previousLeaseId = process.env.ELANOUS_POD_RESERVED_LEASE;
@@ -6831,7 +6892,8 @@ const selfDevCmd = program
         }
         if (status !== 0) {
           const classified = classifyHarnessPodExit({ status }, podOutput, { ...(podRunId ? { runId: podRunId } : {}) });
-          recordClassifiedHarnessPodExit(podRunId ?? harnessPodRunId(podOutput), classified.reason, status);
+          recordClassifiedHarnessPodExit(podRunId ?? harnessPodRunId(podOutput), classified.reason, status,
+            { entrance: 'cli-dev-ask', seat: opts.seat, output: podOutput });
           for (const line of classified.lines) console.error(line);
         }
         completionGuard.conclude();

package/src/intake-plane/linear-wish.ts

@@ -6,24 +6,51 @@ import { createWishCard } from './wish-card.js';
 
 export const LINEAR_WISH_KEY_MISSING = 'Linear 키가 없습니다 — elanous connector linear 로 먼저 등록하세요';
 
-export async function scanLinearWishes({ teamKey, label = 'wish', store, deps = {} }: {
-  teamKey: string;
-  label?: string;
-  store: CardStore;
-  deps?: {
-    getApiKey?: () => Promise<string | undefined>;
-    fetchIssues?: typeof fetchLinearIssues;
-  };
-}): Promise<{ added: number; duplicate: number; failed: number }> {
+type LinearWishDeps = {
+  getApiKey?: () => Promise<string | undefined>;
+  fetchIssues?: typeof fetchLinearIssues;
+};
+
+async function readLinearWishes(teamKey: string, options: { labelOrPrefix?: string; excludeLabel?: string }, deps: LinearWishDeps) {
   const apiKey = await (deps.getApiKey ?? (() => getSecretAsync('connector.linear.apiKey')))();
   if (!apiKey?.trim()) throw new Error(LINEAR_WISH_KEY_MISSING);
-  let issues: Awaited<ReturnType<typeof fetchLinearIssues>>;
   try {
-    issues = await (deps.fetchIssues ?? fetchLinearIssues)({ apiKey, teamKey, labelOrPrefix: label });
+    return await (deps.fetchIssues ?? fetchLinearIssues)({ apiKey, teamKey, ...options });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(message.replaceAll(apiKey, '[redacted]'));
   }
+}
+
+export interface LinearWishSuggestion { identifier: string; title: string; reason: string }
+
+const WISH_PHRASES = [
+  { pattern: /해\s*줘(?:요|라)?/, reason: '요청' },
+  { pattern: /만들어(?:\s*줘(?:요)?)?/, reason: '제작' },
+  { pattern: /원해(?:요)?/, reason: '희망' },
+  { pattern: /있으면\s*좋겠다/, reason: '희망' },
+];
+
+export async function suggestLinearWishes({ teamKey, deps = {} }: {
+  teamKey: string;
+  deps?: LinearWishDeps;
+}): Promise<LinearWishSuggestion[]> {
+  const issues = await readLinearWishes(teamKey, { excludeLabel: 'wish' }, deps);
+  return issues.flatMap(issue => {
+    const match = WISH_PHRASES.find(({ pattern }) => pattern.test(`${issue.title}\n${issue.body}`));
+    return match && issue.identifier
+      ? [{ identifier: issue.identifier, title: Array.from(issue.title).slice(0, 40).join(''), reason: match.reason }]
+      : [];
+  });
+}
+
+export async function scanLinearWishes({ teamKey, label = 'wish', store, deps = {} }: {
+  teamKey: string;
+  label?: string;
+  store: CardStore;
+  deps?: LinearWishDeps;
+}): Promise<{ added: number; duplicate: number; failed: number }> {
+  const issues = await readLinearWishes(teamKey, { labelOrPrefix: label }, deps);
   let added = 0;
   let duplicate = 0;
   let failed = 0;
@@ -32,6 +59,7 @@ export async function scanLinearWishes({ teamKey, label = 'wish', store, deps =
       const result = createWishCard({
         text: `${issue.title}\n\n${issue.body}\n\n${issue.url}`,
         source: 'linear', ref: issue.identifier ?? '',
+        replyTo: { surface: 'linear', issueId: issue.ref },
       }, store);
       if (result.created) added++;
       else duplicate++;