elanous 0.2.15 → 0.2.16

package/src/session-runtime/retry-policy.ts

@@ -364,7 +364,61 @@ export function decideProviderFallback(input: {
   return { action: 'advance', nextProvider, category, attempts };
 }
 
-export type RetryAction = 'retry' | 'abort' | 'ask-user' | 'auto-undo';
+/** Consecutive overload/5xx/rate-limit outcomes that switch the child off codex
+ *  before the same provider spends its remaining retries. Other errors (400)
+ *  never count. Recovery is this many later non-overload outcomes. */
+export const OVERLOAD_FAILOVER_STREAK = 3;
+
+export type LlmCallOutcomeKind = 'ok' | 'overloaded' | '5xx' | 'rate-limit' | 'other';
+
+/** One finished LLM call. Launch failover reads only this shape. */
+export interface LlmCallOutcome {
+  readonly provider: string;
+  readonly status: number;
+  readonly kind: LlmCallOutcomeKind;
+}
+
+const CODEX_CALL_PROVIDERS = new Set(['codex', 'openai-codex']);
+
+export function llmCallOutcomeKind(status: number, message = ''): LlmCallOutcomeKind {
+  if (status >= 200 && status < 300) return 'ok';
+  const msg = message.toLowerCase();
+  if (status === 429 || msg.includes('rate limit') || msg.includes('too many requests')) return 'rate-limit';
+  if (
+    status === 500 || status === 502 || status === 503 || status === 504 ||
+    msg.includes('overloaded') || msg.includes('server_busy') || msg.includes('server_error')
+  ) {
+    return status >= 500 ? '5xx' : 'overloaded';
+  }
+  if (msg.includes('overloaded')) return 'overloaded';
+  return 'other';
+}
+
+export function isOverloadOutcomeKind(kind: LlmCallOutcomeKind): boolean {
+  return kind === 'overloaded' || kind === '5xx' || kind === 'rate-limit';
+}
+
+/** True when the newest `limit` codex outcomes are all overload-class.
+ *  A non-codex row or a non-overload row breaks the streak. Empty input is false. */
+export function codexOverloadStreakReached(
+  outcomes: readonly LlmCallOutcome[],
+  limit = OVERLOAD_FAILOVER_STREAK,
+): boolean {
+  if (limit < 1 || outcomes.length < limit) return false;
+  const tail = outcomes.slice(-limit);
+  return tail.every((row) => CODEX_CALL_PROVIDERS.has(row.provider) && isOverloadOutcomeKind(row.kind));
+}
+
+/** True when the newest `limit` outcomes are successful (any provider). */
+export function overloadRecovered(
+  outcomes: readonly LlmCallOutcome[],
+  limit = OVERLOAD_FAILOVER_STREAK,
+): boolean {
+  if (limit < 1 || outcomes.length < limit) return false;
+  return outcomes.slice(-limit).every((row) => row.kind === 'ok');
+}
+
+export type RetryAction = 'retry' | 'abort' | 'ask-user' | 'auto-undo' | 'switch-provider';
 
 export interface RetryDecision {
   action: RetryAction;
@@ -417,6 +471,16 @@ export interface RetryContext {
   /** Optional: retry-after header string from a 429 response (ms or
    *  seconds or HTTP date). decideRetry parses it. */
   retryAfter?: string;
+  /** Configured fallbacks still unused. When > 0, an overload-class
+   *  failure that has already repeated `overloadStreak` times switches
+   *  provider instead of spending another retry on the same one.
+   *  Omitted or 0 keeps the historical retry-until-exhausted behaviour. */
+  remainingFallbacks?: number;
+  /** Consecutive overload-class failures already seen for this call,
+   *  including the one under decision. Default threshold is
+   *  OVERLOAD_FAILOVER_STREAK. */
+  overloadStreak?: number;
+  overloadStreakLimit?: number;
 }
 
 /** Classify an error into a RetryCategory without making an action
@@ -519,10 +583,42 @@ export function classifyError(err: unknown): RetryCategory {
   return 'unknown';
 }
 
+function isOverloadSwitchCandidate(msg: string, code: string | null): boolean {
+  return (
+    code === '429' || code === '500' || code === '502' || code === '503' || code === '504' ||
+    msg.includes('rate limit') || msg.includes('too many requests') ||
+    msg.includes('overloaded') || msg.includes('server_busy') || msg.includes('server_error')
+  );
+}
+
+function overloadSwitchDecision(ctx: RetryContext): RetryDecision | undefined {
+  const remaining = ctx.remainingFallbacks ?? 0;
+  if (remaining <= 0) return undefined;
+  const limit = ctx.overloadStreakLimit ?? OVERLOAD_FAILOVER_STREAK;
+  const streak = ctx.overloadStreak ?? 1;
+  if (streak < limit) return undefined;
+  return {
+    action: 'switch-provider',
+    category: 'overloaded',
+    reason: `overload streak ${streak} with ${remaining} fallback(s) left; switch before spending retries`,
+  };
+}
+
 /** Pure verdict. Caller sleeps + retries or aborts per the returned
  *  action. Exponential backoff baseline: 500ms * 2^attempt, clamped
  *  to [500, 30_000]. */
 export function decideRetry(err: unknown, ctx: RetryContext): RetryDecision {
+  const msg = extractMessage(err).toLowerCase();
+  const code = extractErrorCode(err);
+
+  // Overload with a fallback still unused switches before the doom
+  // window (k === 3) turns the same 503 into auto-undo. A 400 is not
+  // a candidate. Doom still wins for every other repeated failure.
+  if (isOverloadSwitchCandidate(msg, code)) {
+    const switched = overloadSwitchDecision(ctx);
+    if (switched) return switched;
+  }
+
   // Doom-loop always wins — even a technically-retryable error
   // becomes auto-undo after N identical failures. The caller may
   // still degrade to ask-user when plan mode is active or when the
@@ -535,9 +631,6 @@ export function decideRetry(err: unknown, ctx: RetryContext): RetryDecision {
     };
   }
 
-  const msg = extractMessage(err).toLowerCase();
-  const code = extractErrorCode(err);
-
   // Context window exhausted — never retry (the next call will also
   // be over-sized). Abort and surface the error to the caller; upstream
   // can trigger compaction.
@@ -589,8 +682,16 @@ export function decideRetry(err: unknown, ctx: RetryContext): RetryDecision {
     };
   }
 
-  // Overloaded / server busy.
-  if (msg.includes('overloaded') || msg.includes('server_busy') || code === '503') {
+  // Overloaded / server busy / 5xx.
+  if (
+    msg.includes('overloaded') ||
+    msg.includes('server_busy') ||
+    msg.includes('server_error') ||
+    code === '500' ||
+    code === '502' ||
+    code === '503' ||
+    code === '504'
+  ) {
     return {
       action: 'retry',
       delayMs: backoffMs(ctx.attempt),

package/src/steward/working-backwards.ts

@@ -57,7 +57,22 @@ export async function recordWorkingBackwardsOnCards(
       debug.log('steward.working-backwards', 'skipped-launched-before-draft', { issueId: issue.identifier });
       continue;
     }
-    const draft = await draftWorkingBackwards(issue, ask);
+    // An invalid draft for the same issue text is not re-asked every tick — each ask is a 70-100 s LLM call (10-05 ELA-29 timed the schedule stage out 3×).
+    const invalidKey = `hitl:draft-invalid-${createHash('sha256').update(JSON.stringify({ title: issue.title, body: issue.body ?? '' })).digest('hex').slice(0, 16)}`;
+    if (card.sections.some(section => section.key === invalidKey)) {
+      debug.log('steward.working-backwards', 'skipped-known-invalid', { issueId: issue.identifier });
+      throw new InvalidWorkingBackwardsDraft();
+    }
+    let draft: WorkingBackwardsDraft;
+    try { draft = await draftWorkingBackwards(issue, ask); }
+    catch (error) {
+      if (error instanceof InvalidWorkingBackwardsDraft) {
+        // The memo is best-effort — failing to write it must not replace the invalid-draft error the caller routes to hitl.
+        try { store.appendSection(card.id, { key: invalidKey, owner: 'steward', content: 'working-backwards draft invalid for this issue text — not re-asked until the issue changes' }); }
+        catch (memoError) { debug.log('steward.working-backwards', 'invalid-memo-failed', { issueId: issue.identifier, error: memoError instanceof Error ? memoError.message : String(memoError) }); }
+      }
+      throw error;
+    }
     for (const [section, content] of [['prfaq', draft.prfaq], ['manual', draft.manual]] as const) {
       const key = `${section}:${createHash('sha256').update(content).digest('hex')}`;
       if (!card.sections.some(item => item.key === key)) store.appendSection(card.id, { key, owner: 'steward', content });

package/src/task-cards/card-cli.ts

@@ -46,6 +46,31 @@ export function registerCardCommand(program: Command, deps: CardCliDeps = {}): C
       }
     });
 
+  card.command('close <id>')
+    .description('Close a task card with a reason (owner operation)')
+    .requiredOption('--reason <text>', 'One-line close reason')
+    .action((id: string, options: { reason: string }) => {
+      const store = createStore();
+      try {
+        const reason = options.reason.trim();
+        if (!reason || /[\r\n]/.test(options.reason)) throw new Error('Close reason must be one line');
+        const existing = store.getCard(id);
+        if (!existing) {
+          process.stderr.write(`Card not found: ${id}\n`);
+          process.exitCode = 1;
+          return;
+        }
+        if (existing.status === 'closed') {
+          write(`이미 닫힘: ${id}\n`);
+          return;
+        }
+        store.closeCard(id, reason);
+        write(`닫힘: ${id}\n`);
+      } finally {
+        store.close();
+      }
+    });
+
   card.command('list')
     .description('List task cards')
     .option('--open', 'Only show open cards')

package/src/task-cards/card-store.ts

@@ -32,7 +32,7 @@ export interface AppendSectionInput {
 type CardEvent =
   | { type: 'created'; id: string; goalId: string; title: string; createdAt: string }
   | { type: 'section'; key: string; owner: string; content: string; createdAt: string }
-  | { type: 'closed'; createdAt: string };
+  | { type: 'closed'; createdAt: string; reason?: string };
 
 /** RFC §3 (내부 문서 `RFC-execution-and-landing-loop-agents-parallel-first-2026-09-29`) — each card section has one owner.
  *  A key is `<section>` or `<section>:<idempotency key>`: the same section can be appended many times over a
@@ -197,13 +197,15 @@ export class CardStore {
     }).immediate();
   }
 
-  closeCard(id: string): TaskCard {
+  closeCard(id: string, reason?: string): TaskCard {
+    if (reason !== undefined && !reason.trim()) throw new Error('Close reason is required');
     return this.db.transaction(() => {
       this.reconcile();
       const card = this.readCard(id);
       if (!card) throw new Error(`Card not found: ${id}`);
       if (card.status === 'closed') return card;
-      this.append(id, { type: 'closed', createdAt: new Date().toISOString() });
+      this.append(id, { type: 'closed', createdAt: new Date().toISOString(),
+        ...(reason === undefined ? {} : { reason: redactSecrets(reason.trim()) }) });
       return { ...card, status: 'closed' as const };
     }).immediate();
   }

package/src/task-orchestrator/surfaces/pod-ledger-collect.ts

@@ -3,6 +3,7 @@ import { gunzipSync } from 'node:zlib';
 import { debug } from '../../debug/log.js';
 import { runLedgerDir, runLedgerPath } from '../../self-implement/run-ledger.js';
 import { ledgerLineToLogEvent } from './pod-ledger-events.js';
+import { defaultPodReemit } from './pod-ledger-prod-sink.js';
 
 type Ledger = { runId: string; jsonl: string };
 type Incomplete = { runId: string; reason: string };
@@ -94,7 +95,7 @@ export function parsePodLedgerChunks(logs: string): ParseResult {
  *  except a ledger that THIS run's live follower created (`replace`): that one is a partial copy and the final is complete. */
 export function collectPodLedgers(
   logs: string,
-  { dir = runLedgerDir(), log = (c, e, d) => debug.log(c, e, d), emit = (c, e, d) => debug.log(c, e, d), replace = new Set<string>() }: {
+  { dir = runLedgerDir(), log = defaultPodReemit(), emit = defaultPodReemit(), replace = new Set<string>() }: {
     dir?: string;
     log?: (category: string, event: string, data: Record<string, unknown>) => void;
     emit?: Emit;
@@ -146,8 +147,8 @@ export function createPodLedgerFollower(opts: {
   onStall?: (message: string) => void;
 }): { poll(): void; readonly owned: boolean } {
   const dir = opts.dir ?? runLedgerDir();
-  const log = opts.log ?? ((c, e, d) => debug.log(c, e, d));
-  const emit: Emit = opts.emit ?? ((c, e, d) => debug.log(c, e, d));
+  const log = opts.log ?? defaultPodReemit();
+  const emit: Emit = opts.emit ?? defaultPodReemit();
   const now = opts.now ?? Date.now;
   const stallMinutes = opts.stallMinutes ?? 30;
   if (!Number.isFinite(stallMinutes) || stallMinutes <= 0) throw new RangeError('stallMinutes must be positive');

package/src/task-orchestrator/surfaces/pod-ledger-prod-sink.ts

@@ -0,0 +1,75 @@
+import { debug } from '../../debug/log.js';
+import { LogStore, logsDbPath } from '../../mss/logging/log-store.js';
+
+type Emit = (category: string, event: string, data: Record<string, unknown>) => void;
+type Store = Pick<LogStore, 'insertBatch'>;
+
+/** 발사한 부모(`harness say --config-dir …`)가 정한 집의 logs.db — 부모가 자식 `self orchestrate` 에 env 로 넘긴다. */
+export const POD_REEMIT_LOGS_DB_ENV = 'ELANOUS_POD_REEMIT_LOGS_DB';
+export function launchHomeLogsDb(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  return env[POD_REEMIT_LOGS_DB_ENV]?.trim() || undefined;
+}
+
+let cached: { path: string; store: Store } | null = null;
+let announced = '';
+
+/**
+ * POD-OBS(10-06 · 0.2.16 P0 · OP 사양): Pod 자식 원장 «재방출»만 부모가 발사 때 정한 집(A)의 logs.db 로 보낸다.
+ * 자식 orchestrate 는 트리 파생 test 우주(B)에서 돌아, 지금은 재방출이 B 에만 쌓였다(24h `ledger-collected` 운영 2 vs 다른 우주 250).
+ * 자식 우주 원장·격리는 그대로 둔다. A 를 못 열면 조용히 버리지 않고 B 로 떨어뜨리며 경고한다.
+ * env 가 없거나(옛 발사) A == B 이거나 시험 프로세스면 null → 호출측이 지금처럼 B 에만 쓴다.
+ */
+export function operationalReemit(opts: {
+  currentDb?: string;
+  operationalDb?: string;
+  open?: (path: string) => Store;
+  testProcess?: boolean;
+  fallback?: Emit;
+} = {}): Emit | null {
+  const operationalDb = opts.operationalDb ?? launchHomeLogsDb();
+  if (!operationalDb) return null;
+  const currentDb = opts.currentDb ?? logsDbPath();
+  const testProcess = opts.testProcess ?? (process.env.NODE_ENV === 'test' || !!process.env.ELANOUS_TEST_HOME);
+  if (testProcess && !opts.open) return null;
+  if (currentDb === operationalDb) return null;
+  const open = opts.open ?? ((path: string) => new LogStore(path, { instance: 'prod' }));
+  const fallback: Emit = opts.fallback ?? ((c, e, d) => debug.log(c, e, d));
+  const write = (category: string, event: string, data: Record<string, unknown>): void => {
+    if (!cached || cached.path !== operationalDb || opts.open) cached = { path: operationalDb, store: open(operationalDb) };
+    cached.store.insertBatch([{ rec: { ts: new Date().toISOString(), category, event, data }, surface: 'pod-reemit' }]);
+  };
+  let warned = false;
+  return (category, event, data) => {
+    try {
+      if (announced !== `${currentDb}->${operationalDb}` || opts.open) {
+        // 어느 우주로 보냈는지 한 줄(A 에) — 조회자가 «B 에 왜 없나»를 여기서 본다.
+        write('self-implement.pod', 'reemit-target', { targetUniverse: operationalDb, childUniverse: currentDb });
+        announced = `${currentDb}->${operationalDb}`;
+      }
+      write(category, event, data);
+    } catch (error) {
+      fallback(category, event, data);
+      if (warned) return;
+      // 경고는 싱크(발사 하나)당 한 번 — 줄마다 찍으면 경고가 원장을 덮는다.
+      warned = true;
+      try {
+        fallback('self-implement.pod', 'reemit-target-unavailable', {
+          targetUniverse: operationalDb, childUniverse: currentDb, reason: error instanceof Error ? error.message : String(error),
+        });
+      } catch { /* nothing */ }
+    }
+  };
+}
+
+let shared: { key: string; emit: Emit } | null = null;
+
+/** 재방출 기본 경로: 집(A)이 정해져 있으면 A 에만, 아니면 지금처럼 지금 우주(B)의 debug.log.
+ *  프로세스(발사)당 싱크 하나 — collector 의 `log`·`emit`, follower 가 같은 싱크를 써서 경고·대상 줄이 한 번이다. */
+export function defaultPodReemit(): Emit {
+  const key = `${launchHomeLogsDb() ?? ''}->${logsDbPath()}`;
+  if (shared?.key === key) return shared.emit;
+  const operational = operationalReemit();
+  const emit: Emit = operational ?? ((category, event, data) => { debug.log(category, event, data); });
+  shared = { key, emit };
+  return emit;
+}

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -8,7 +8,7 @@
  *   - 컨텍스트  kubectl 컨텍스트 이름(이 맥의 kubeconfig)
  *   - @ssh호스트 원격 클러스터면 그 기계 — 이미지 판 대조·반입(`docker load` ⊕ `k3d image import`)에 쓴다
  *   - 상한      이 노드에 동시에 둘 Job 수(기본 2)
- * Job 마다 앞 순위부터 «진행 중 < 상한»인 노드를 고른다. 다 차면 자리가 날 때까지 기다린다.
+ * Job 마다 «빈 자리 비율»이 가장 큰 노드를 고른다(동률은 앞 순위 · 측정 실패 노드는 측정된 노드가 다 찼을 때만). 다 차면 자리가 날 때까지 기다린다.
  * 노드 선택의 진행 중 수는 로컬 프로세스 기준이다. 발사 허가는 별도의 lease 측정으로
  * 다른 호스트의 Running/Pending 및 메모리 예약까지 고려한다.
  * 풀을 안 주면 종전처럼 «현재 컨텍스트» 하나다(동작 불변).
@@ -271,7 +271,9 @@ export class PodPoolScheduler {
     return this.admission.snapshot();
   }
   /**
-   * Pick the member with the most free slots: capacity − measured cluster occupancy − this process's inflight.
+   * Pick the member with the largest free share: (capacity − measured cluster occupancy − this process's inflight) / capacity.
+   * POOL-SPREAD (10-06): comparing absolute free slots always picked the big member (node-b 25 vs node-c 4), so the small
+   * member idled until the big one was full. Comparing the free share fills members in proportion to their capacity.
    * A member whose occupancy could not be read falls back to inflight-only (never treated as zero occupied).
    * Ties keep the configured member order. Returns null when every readable member is full.
    */
@@ -284,7 +286,12 @@ export class PodPoolScheduler {
     }
     const free: Record<string, number> = {};
     const measured: Record<string, boolean> = {};
-    let best: { member: PodPoolMember; slots: number } | null = null;
+    let best: { member: PodPoolMember; slots: number; measured: boolean } | null = null;
+    // A measured member always beats an unmeasured one (its share would read 100% and draw every Job to a node
+    // that did not answer); unmeasured members compete only when no measured member has a free slot.
+    const better = (cand: { member: PodPoolMember; slots: number; measured: boolean }) => !best
+      || (cand.measured !== best.measured ? cand.measured
+        : cand.slots / cand.member.capacity > best.slots / best.member.capacity);
     for (const m of this.members) {
       const inflight = this.inflight.get(m.context) ?? 0;
       const row = reading[m.context];
@@ -294,11 +301,13 @@ export class PodPoolScheduler {
       const slots = m.capacity - occupied - inflight;
       free[m.context] = slots;
       if (slots <= 0) continue;
-      if (!best || slots > best.slots) best = { member: m, slots };
+      const cand = { member: m, slots, measured: ok };
+      if (better(cand)) best = cand;
     }
     if (!best) return null;
     this.inflight.set(best.member.context, (this.inflight.get(best.member.context) ?? 0) + 1);
-    debug.log('pod.pool', 'member-selected', { member: best.member.context, free, measured });
+    const share = Object.fromEntries(this.members.map((m) => [m.context, Math.round(Math.max(0, free[m.context] ?? 0) / m.capacity * 100) / 100]));
+    debug.log('pod.pool', 'member-selected', { member: best.member.context, free, measured, share });
     return best.member;
   }
   release(member: PodPoolMember): void {

package/src/task-orchestrator/surfaces/pod-source-receive.ts

@@ -1,8 +1,10 @@
 /** Pod Job 원천 단계 — default clone · 커밋 · PR · 호스트 번들.
  *  sha·PR·커밋은 형식 검사 전에 스크립트에 넣지 않는다(셸 주입 차단). */
 
+import { execFileSync } from 'node:child_process';
+
 export type PodSource =
-  | { kind: 'default' }
+  | { kind: 'default'; base?: string }
   | { kind: 'commit'; sha: string }
   | { kind: 'pr'; number: number }
   | { kind: 'bundle'; bundlePath: string; sha256: string; sizeBytes: number; headCommit: string };
@@ -29,6 +31,27 @@ function assertSize(value: number): number {
   return value;
 }
 
+/** Check the requested branch on origin before creating a Pod Job, not in the launched job. */
+function assertRemoteBase(repoUrl: string, base: string): void {
+  if (base.startsWith('-') || base === 'HEAD') throw new Error(`invalid Pod base ref: ${base}`);
+  try {
+    execFileSync('git', ['check-ref-format', '--branch', base], { stdio: 'pipe' });
+  } catch {
+    throw new Error(`invalid Pod base ref: ${base}`);
+  }
+  try {
+    const advertised = execFileSync('git', ['ls-remote', '--exit-code', '--heads', repoUrl, `refs/heads/${base}`], {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+    const [sha, ref] = advertised.split('\t');
+    if (!/^[0-9a-f]{40,64}$/.test(sha ?? '') || ref !== `refs/heads/${base}`) {
+      throw new Error('origin did not advertise the requested branch');
+    }
+  } catch {
+    throw new Error(`Pod base ref not found on origin: ${base}`);
+  }
+}
+
 /** Job 스크립트의 원천 단계. 성공 갈래는 `ELANOUS_POD_SOURCE <kind> <HEAD>` 로 끝난다. */
 export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath = '/host-mirror'): string {
   const quotedUrl = `'${repoUrl.replace(/'/g, `'\\''`)}'`;
@@ -48,6 +71,19 @@ export function podSourceScript(source: PodSource, repoUrl: string, mirrorPath =
     'cd repo || exit 5',
   ];
   if (source.kind === 'default') {
+    if (source.base && source.base !== 'main') {
+      assertRemoteBase(repoUrl, source.base);
+      const base = source.base;
+      const quote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+      const quotedTrackingRef = quote(`refs/remotes/origin/${base}`);
+      return [
+        ...start,
+        `git fetch --depth 50 origin ${quote(`+refs/heads/${base}:refs/remotes/origin/${base}`)} || exit 5`,
+        `git checkout -q -B ${quote(base)} ${quotedTrackingRef} || exit 5`,
+        'head=$(git rev-parse HEAD)',
+        "printf 'ELANOUS_POD_SOURCE default %s\\n' \"$head\"",
+      ].join('\n');
+    }
     return [
       ...start,
       'if [ "$source_via" = mirror ]; then',

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -38,7 +38,10 @@ export const POD_JOB_DEADLINE_SECONDS = 10_800;
 /** 자식 컨테이너 «요청» — 🩸 2026-09-27: limits 만 두면 k8s 가 requests=limits(cpu 4)로 잡아, 32코어 노드에
  *  «자리 요청»이 88% 차서 잡이 Pending 인데 실사용은 14%였다(풀 25 자리 중 ~8 만 떴다). 상한(limits)은 그대로 두고
  *  예약만 실사용에 맞춘다. */
-export const POD_CHILD_REQUESTS = { cpu: '1', memory: '4Gi' } as const;
+// POD-DIET (10-06 03:47~05:18 · node-b goal Pods · 89 one-minute samples · 42 Pods): per-Pod observed max median 4.6Gi ·
+// p75 6.2Gi · p90 11.7Gi — 23/42 went above the old 4Gi request, so the scheduler over-packed. 6Gi ≈ p75; limits stay.
+// Node allocatable ≈ 343Gi ≫ 25 × 6Gi. One-minute samples can miss the true peak (lower bound).
+export const POD_CHILD_REQUESTS = { cpu: '1', memory: '6Gi' } as const;
 import type { PodPoolMember, PodPoolScheduler } from './pod-pool.js';
 import { measurePoolLease, recommendConcurrency, POD_HOST_LEASE_ANNOTATION, LEASE_KUBECTL_MAX_BUFFER } from './pod-lease.js';
 import { ACTUAL_SUBSTRATE_ENV, RUN_CONTRACT_ENV, carryRunContract, completionFloorFor } from '../../self-implement/graph-run-contract.js';
@@ -63,6 +66,7 @@ import { declaredGoalType, type GoalType as DeclaredGoalType } from '../../self-
 import { readPodMemoryAdvice, type PodMemoryAdvice } from '../../cli/pod-memory-advice.js';
 import { getUserConfig } from '../../user-config.js';
 import { extractPodFailureReason } from './pod-failure-reason.js';
+import { OLD_DOOR_STAMP_ENV } from '../../self-dev/old-door.js';
 
 export type Kubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };
 
@@ -70,7 +74,9 @@ export type Kubectl = (args: readonly string[], input?: string) => { status: num
 // still the credential source for gh and setup-git's helper. Install it privately
 // on that failure; rename keeps concurrent readers from seeing a partial token.
 const APP_GH_CONFIG_PATH = '$HOME/.config/gh';
-const APP_GH_AUTH_SCRIPT = 'const fs=require("node:fs"),path=require("node:path"),crypto=require("node:crypto");const token=fs.readFileSync(0,"utf8").trim();if(!/^[A-Za-z0-9_]+$/.test(token))process.exit(1);const dir=process.env.GH_CONFIG_DIR||path.join(process.env.HOME,".config/gh");fs.mkdirSync(dir,{recursive:true,mode:0o700});const dest=path.join(dir,"hosts.yml"),temp=path.join(dir,".hosts.yml."+crypto.randomUUID());try{fs.writeFileSync(temp,"github.com:\\n    oauth_token: "+token+"\\n    git_protocol: https\\n",{mode:0o600,flag:"wx"});fs.renameSync(temp,dest);fs.chmodSync(dest,0o600)}finally{try{fs.unlinkSync(temp)}catch{}}';
+// PODCRED2 (10-05) — GitHub App installation tokens now carry `.` and `-` (390 chars on node-b); the old
+// `[A-Za-z0-9_]+` check rejected every real token, so any transient `gh auth login` failure became exit 7.
+export const APP_GH_AUTH_SCRIPT = 'const fs=require("node:fs"),path=require("node:path"),crypto=require("node:crypto");const token=fs.readFileSync(0,"utf8").replace(/\\r?\\n$/,"");if(!/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/.test(token))process.exit(1);const dir=process.env.GH_CONFIG_DIR||path.join(process.env.HOME,".config/gh");fs.mkdirSync(dir,{recursive:true,mode:0o700});const dest=path.join(dir,"hosts.yml"),temp=path.join(dir,".hosts.yml."+crypto.randomUUID());try{fs.writeFileSync(temp,"github.com:\\n    oauth_token: "+token+"\\n    git_protocol: https\\n",{mode:0o600,flag:"wx"});fs.renameSync(temp,dest);fs.chmodSync(dest,0o600)}finally{try{fs.unlinkSync(temp)}catch{}}';
 const APP_GH_AUTH_COMMAND = `bun -e '${APP_GH_AUTH_SCRIPT}'`;
 const APP_GH_EXEC = `unset GH_TOKEN GITHUB_TOKEN; GH_CONFIG_DIR="${APP_GH_CONFIG_PATH}" exec "$@"`;
 
@@ -594,14 +600,15 @@ export function podChildLlmArgs(options: Pick<PodSpawnOptions, 'provider' | 'chi
   return ['--child-llm-provider', provider, ...(model ? ['--child-llm-model', model] : [])];
 }
 
-export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; memoryRequest?: string; goalDoc?: string; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number; /** Which goal execution and attempt this Job is — a resumed host verifies it before following the Job (POD9). */ execution?: { key: string; attempt: number }; hostLeaseAdmitted?: boolean }): Record<string, unknown> {
+export function podJobManifest(o: { name: string; namespace: string; image: string; /** 레지스트리 이미지면 IfNotPresent(노드가 pull) · 반입 이미지면 Never. */ imagePullPolicy?: 'Never' | 'IfNotPresent'; repoUrl: string; source?: PodSource; hostMirror?: string; args: readonly string[]; passEnv: readonly string[]; deadlineSeconds: number; runId?: string; parentRunId?: string; armEnv?: Readonly<Record<string, string>>; hostId?: string; imageCommit?: string | null; skillEnvs?: readonly string[]; memoryLimit?: string; memoryRequest?: string; goalDoc?: string; /** AUTHOR-POD2 — run `harness say` on /creds/feature inside the Pod (authoring happens off the host). */ authorSentence?: boolean; grokCredential?: 'subscription' | 'api_key'; codexAccounts?: readonly string[]; appCredential?: boolean; /** Test seam — default POD_GH_STALE_SECONDS. */ githubStaleSeconds?: number; /** Which goal execution and attempt this Job is — a resumed host verifies it before following the Job (POD9). */ execution?: { key: string; attempt: number }; hostLeaseAdmitted?: boolean }): Record<string, unknown> {
   const quoted = o.args.map((a) => `'${a.replace(/'/g, `'\\''`)}'`).join(' ');
   const goalPath = o.goalDoc ? `'${(o.goalDoc.startsWith('-') ? `./${o.goalDoc}` : o.goalDoc).replace(/'/g, `'\\''`)}'` : undefined;
-  const askBaseIndex = o.goalDoc ? o.args.indexOf('--base') : -1;
+  const delegated = Boolean(o.goalDoc) || o.authorSentence === true;
+  const askBaseIndex = delegated ? o.args.indexOf('--base') : -1;
   const quotedAsk = (askBaseIndex >= 0 && o.args[askBaseIndex + 1]
     ? ` '--base' '${o.args[askBaseIndex + 1]!.replace(/'/g, `'\\''`)}'`
-    : '') + (o.goalDoc && o.args.includes('--merge-by-host') ? ' --merge-by-host' : o.goalDoc && o.args.includes('--open-pr') && !o.args.includes('--auto-merge') ? ' --no-auto-merge' : '')
-    + (o.goalDoc && o.args.includes('--no-supervise') ? ' --no-supervise' : '');
+    : '') + (delegated && o.args.includes('--merge-by-host') ? ' --merge-by-host' : delegated && o.args.includes('--open-pr') && !o.args.includes('--auto-merge') ? ' --no-auto-merge' : '')
+    + (delegated && o.args.includes('--no-supervise') ? ' --no-supervise' : '');
   const script = [
     'set -u',
     o.grokCredential === 'subscription'
@@ -609,7 +616,7 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
       : o.grokCredential === 'api_key'
         ? 'mkdir -p ~/.grok && install -m 600 /creds/grok-api-key ~/.grok/api-key && export XAI_API_KEY="$(cat ~/.grok/api-key)" && export ELANOUS_LLM_PROVIDER=grok'
         : o.codexAccounts ? podCodexAccountScript(o.codexAccounts) : `mkdir -p ~/.elanous ~/.codex && cp /creds/elanous-auth.json ~/.elanous/auth.json && cp /creds/codex-auth.json ~/.codex/auth.json && chmod 600 ~/.elanous/auth.json ~/.codex/auth.json\n${podQuotaPolicyExport()}`,
-    o.appCredential ? `unset GH_TOKEN GITHUB_TOKEN; export GH_CONFIG_DIR="${APP_GH_CONFIG_PATH}"; mkdir -p "$GH_CONFIG_DIR" && chmod 700 "$GH_CONFIG_DIR" && { gh auth login --with-token < /creds/gh-token >/dev/null 2>&1 || ${APP_GH_AUTH_COMMAND} < /creds/gh-token; } && chmod 600 "$GH_CONFIG_DIR/hosts.yml" && chmod 700 "$GH_CONFIG_DIR" || exit 7` : 'export GH_TOKEN="$(cat /creds/gh-token)"',
+    o.appCredential ? `unset GH_TOKEN GITHUB_TOKEN; export GH_CONFIG_DIR="${APP_GH_CONFIG_PATH}"; mkdir -p "$GH_CONFIG_DIR" && chmod 700 "$GH_CONFIG_DIR" && { (umask 077; gh auth login --with-token < /creds/gh-token >"$HOME/.gh-login.log" 2>&1) || ${APP_GH_AUTH_COMMAND} < /creds/gh-token; } && chmod 600 "$GH_CONFIG_DIR/hosts.yml" && chmod 700 "$GH_CONFIG_DIR" || { echo "[pod] gh-login-failed: $(head -c 300 "$HOME/.gh-login.log" 2>/dev/null | tr '\\n' ' ' | sed -E 's/(gh[a-z]_|github_pat_)[A-Za-z0-9_.-]+/\\1***/g')"; exit 7; }` : 'export GH_TOKEN="$(cat /creds/gh-token)"',
     // 🔑 스킬 키(.env) — 이미지엔 없다. 이 런의 Secret 에서 각 스킬 폴더로 0600 복사(값은 로그에 안 나온다).
     ...(o.skillEnvs?.length ? [`for n in ${o.skillEnvs.join(' ')}; do [ -d ~/.claude/skills/$n ] && install -m 600 /creds/skillenv-$n ~/.claude/skills/$n/.env; done; echo "[pod] skill env: ${o.skillEnvs.join(',')}"`] : []),
     'git config --global user.name "elanous pod child" && git config --global user.email "noreply@anthropic.com" && gh auth setup-git',
@@ -622,9 +629,11 @@ export function podJobManifest(o: { name: string; namespace: string; image: stri
     `(while :; do { mem=$(if [ -r /sys/fs/cgroup/memory.current ]; then cat /sys/fs/cgroup/memory.current; elif [ -r /sys/fs/cgroup/memory/memory.usage_in_bytes ]; then cat /sys/fs/cgroup/memory/memory.usage_in_bytes; else printf -- -; fi); top=$(ps -eo rss=,comm=,args= --sort=-rss | head -5 | awk 'function encode(s) { gsub(/%/, "%25", s); gsub(/:/, "%3A", s); gsub(/ /, "%20", s); gsub(/\\t/, "%09", s); return s } { rss=$1; name=$2; sub(/^[[:space:]]*[0-9]+[[:space:]]+[^[:space:]]+[[:space:]]*/, ""); n=split($0, a, /[[:space:]]+/); cmd="<redacted>"; if (name=="sleep" && a[2]=="30") cmd="sleep 30" (n>2 ? " <redacted>" : ""); else if (name=="bun") { cmd="bun <redacted>"; if (a[2]=="test") cmd="bun test <redacted>"; else if (a[2]=="run") cmd="bun run <redacted>"; else if ((a[2]=="x" || a[2]=="exec") && a[3]=="tsc") cmd="bun x tsc <redacted>" } else if (name=="tsc") cmd="tsc <redacted>"; else if (name=="elanous") { cmd="elanous <redacted>"; if (a[2]=="self") cmd="elanous self <redacted>"; else if (a[2]=="harness") cmd="elanous harness <redacted>" } else if (name=="node") cmd="node <redacted>"; if (name=="sleep" && cmd=="<redacted>") cmd="sleep <redacted>"; else if (cmd=="<redacted>" && name!="bash" && name!="sh") name="other"; printf " %s:%s:%s", rss, encode(name), encode(substr(cmd,1,120)) }'); printf "ELANOUS_MEM %s %s%s\\n" "$(date +%s)" "$mem" "$top"; } || true; sleep 15 || break; done) & mem_sampler_pid=$!`,
     ...(o.appCredential ? [podGithubWatchdogScript(o.githubStaleSeconds ?? POD_GH_STALE_SECONDS)] : []),
     // 마지막 줄 JSON 이 «맨 끝»이어야 한다(parseSelfImplementJson) — rollup 은 그 앞에.
-    goalPath
+    o.authorSentence
+      ? `echo "ELANOUS_AUTHOR_ON_POD started host=$(hostname) at=$(date -u +%Y-%m-%dT%H:%M:%SZ)"; author_t0=$(date +%s); elanous harness say --substrate local --json${quotedAsk} -- "$(cat /creds/feature)" > /tmp/si.out 2>&1; rc=$?; echo "ELANOUS_AUTHOR_ON_POD finished host=$(hostname) rc=$rc seconds=$(( $(date +%s) - author_t0 ))"; bun -e 'const fs=require("fs");const p="/tmp/si.out";const s=fs.readFileSync(p,"utf8");const line=s.trimEnd().split("\\n").at(-1);try{const o=JSON.parse(line);if(o.kind==="self"&&o.result&&typeof o.result==="object")fs.appendFileSync(p,"\\n"+JSON.stringify({...o.result,...(typeof o.ok==="boolean"?{ok:o.ok}:{})})+"\\n")}catch{}'`
+      : goalPath
       ? `elanous harness ask ${goalPath} --json${quotedAsk} > /tmp/si.out 2>&1; rc=$?; bun -e 'const fs=require("fs");const p="/tmp/si.out";const s=fs.readFileSync(p,"utf8");const line=s.trimEnd().split("\\n").at(-1);try{const o=JSON.parse(line);if(o.kind==="self"&&o.result&&typeof o.result==="object")fs.appendFileSync(p,"\\n"+JSON.stringify({...o.result,...(typeof o.ok==="boolean"?{ok:o.ok}:{})})+"\\n")}catch{}'`
-      : `elanous self implement "$(cat /creds/feature)" --json ${quoted} > /tmp/si.out 2>&1; rc=$?`,
+      : `export ${OLD_DOOR_STAMP_ENV}=self-implement; elanous self implement "$(cat /creds/feature)" --json ${quoted} > /tmp/si.out 2>&1; rc=$?`,
     'cat /tmp/si.out',
     '[ -f scripts/usage-rollup.ts ] && bun scripts/usage-rollup.ts --since 12h || echo "ELANOUS_USAGE_ROLLUP {\"measured\":false,\"reason\":\"no rollup script\"}"',
     // A long run's log export can pass the 5MB artifact limit; skipping it whole left no window into why a
@@ -1224,7 +1233,7 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         debug.log('self-implement.pod', 'memory-request', { spaceId: input.spaceId, job: name,
           tier: oomRetried ? retryTier : memoryTier, reason: oomRetried ? 'OOMKilled' : memoryReason,
           memoryLimit, memoryRequest });
-        const job = podJobManifest({ name, namespace, image: jobImage, ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), args, passEnv: jobPassEnv, deadlineSeconds: options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS, ...(goalDoc ? { goalDoc } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, memoryRequest, imageCommit: options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
+        const job = podJobManifest({ name, namespace, image: jobImage, ...(member?.imageRef ? { imagePullPolicy: 'IfNotPresent' as const } : {}), repoUrl, ...(options.source ? { source: options.source } : {}), ...(hostMirror ? { hostMirror } : {}), args, passEnv: jobPassEnv, deadlineSeconds: options.deadlineSeconds ?? POD_JOB_DEADLINE_SECONDS, ...(goalDoc ? { goalDoc } : env.ELANOUS_POD_AUTHOR_ON_POD === '1' && !shard ? { authorSentence: true } : {}), runId: launchRunId, ...(parentRunId ? { parentRunId } : {}), ...(jobArmEnv ? { armEnv: jobArmEnv } : {}), hostId: resolveHostId(env), skillEnvs: Object.keys(skillEnvs), memoryLimit, memoryRequest, imageCommit: options.imageCommit !== undefined ? options.imageCommit : options.kubectl ? null : podImageFreshness({ image }).imageCommit, ...(grok ? { grokCredential: 'grokAuth' in creds && creds.grokAuth ? 'subscription' as const : 'api_key' as const } : {}), ...(codexAccounts ? { codexAccounts } : {}), ...(hostRefresh ? { appCredential: true } : {}), execution: { key: executionKey, attempt: oomRetried ? 2 : 1 }, hostLeaseAdmitted: !!releaseAdmission });   // kubectl 주입(=시험)이면 docker 를 부르지 않는다
         const a = kubectl(['apply', '-f', '-'], JSON.stringify(job));
         if (a.status !== 0) { cleanupSecret(); return { exitCode: 1, output: a.stderr, error: { code: 'pod-apply', message: a.stderr.trim() } }; }
         releaseAdmission?.applied?.(name, context, namespace);

package/src/task-orchestrator/surfaces/self-implement.ts

@@ -19,6 +19,7 @@
  * Cf. PLAN-parallel-self-dev-orchestrator-2026-07-21.
  */
 import { lstatSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { oldDoorInternalEnv } from '../../self-dev/old-door.js';
 import { selfDevRunsDir } from '../../self-dev/run-store.js';
 import { debug } from '../../debug/log.js';
 import { join, resolve } from 'node:path';
@@ -356,6 +357,7 @@ export function defaultSelfImplementSpawn(): SelfImplementJobSpawn {
             ...childNestEnv(),
             ...harnessSpaceEnv('self-implement', input.spaceId),
             ...executorRoleEnv(),   // ⭐ 세포 role 분화 — 자식은 executor(실행자)로 자기인지.
+            ...oldDoorInternalEnv('self-implement'),
           },
           stdio: ['ignore', 'pipe', 'pipe'],
         });

package/src/telegram-commands.ts

@@ -233,6 +233,11 @@ export function parseTelegramSlash(text: string, commands: TgSlashCommand[]): Tg
  *  caller (handleIncoming) can send it directly without going through
  *  dispatchTelegramSlash when it already has the parse result. */
 export function buildUnknownSlashReply(name: string, commands: TgSlashCommand[]): string {
+  const unsupported = buildBotSlashCatalog({
+    surface: 'telegram', coreCommands: SLASH_COMMANDS, maturity: FEATURE_MATURITY,
+    handledCommands: commands,
+  }).unsupportedReply(name);
+  if (unsupported) return unsupported;
   const names = commands.map(c => `/${c.name}`).join(' ');
   return `Unknown command: /${name}\nAvailable: ${names}`;
 }