elanous 0.2.22 → 0.2.24

package/src/harness/harness-gc.ts

@@ -0,0 +1,331 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { configuredWorktreeRoot } from '../user-config.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { acquireLockSync } from '../storage/file-lock.js';
+import { createGhRunner, execHarnessClean, gitStdout, type GitRunner, type GhRunner, type ActiveDirectoryProvider } from './harness-clean.js';
+import type { WorktreeAssessmentInput, WorktreeAssessment } from './harness-worktrees.js';
+
+export interface HarnessGcOptions {
+  repos?: string[];
+  dryRun?: boolean;
+  window?: number;
+  maxRemove?: number;
+  budgetMs?: number;
+}
+
+export interface HarnessGcDeps {
+  stateRoot?: string;
+  worktreeRoot?: string;
+  now?: () => number;
+  run?: GitRunner;
+  runGh?: GhRunner;
+  activeDirectoryProvider?: ActiveDirectoryProvider;
+  assessWorktree?: (input: WorktreeAssessmentInput) => WorktreeAssessment;
+  readWorktreeProvenance?: (path: string, run: GitRunner) => { owner: string; command: string; createdAt: string };
+}
+
+export interface HarnessGcRepo {
+  gitDir: string;
+  offset: number;
+  window: number;
+  total: number;
+  removed: number;
+  preserved: number;
+  deferred: number;
+  failed: number;
+  preservedByReason: Record<string, number>;
+  orphanScan: 'scanned' | 'unavailable' | 'not-requested';
+  unseenOutsideWindow?: number;
+  unseenOutsidePrefix?: number;
+}
+
+export interface HarnessGcResult {
+  outcome: 'ok' | 'skipped' | 'fail';
+  reason?: 'overlap' | 'no-target-repo' | 'repo-failed' | 'budget-exhausted';
+  repos: number;
+  removed: number;
+  preserved: number;
+  deferred: number;
+  failed: number;
+  unseenOutsideWindow?: number;
+  unseenOutsidePrefix?: number;
+  undiscoverable: number;
+  orphanScanUnavailable: number;
+  budgetMs: number;
+  elapsedMs: number;
+  repositories: HarnessGcRepo[];
+  repoFailures?: Array<{ gitDir: string; error: string }>;
+  /** The tick budget ran out inside a repository's queries; that repository was left unverified (cursor kept). */
+  budgetExhausted?: boolean;
+}
+
+/** Discover current linked worktrees; the tick also retains previously verified automatic targets. */
+export function discoverHarnessGcRepos(root: string, expired: () => boolean = () => false):
+  { repos: string[]; undiscoverable: number; stopped?: boolean } {
+  const repos = new Set<string>();
+  let undiscoverable = 0;
+  // The deadline is checked *between* reads (each readdir / .git read); a stopped walk leaves the rest unverified.
+  let stopped = false;
+  const halt = (): boolean => { if (!stopped && expired()) stopped = true; return stopped; };
+  const done = () => ({ repos: [...repos].sort(), undiscoverable, ...(stopped ? { stopped } : {}) });
+  const children = (path: string): string[] => readdirSync(path, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory()).map((entry) => join(path, entry.name));
+  let scopes: string[];
+  if (halt()) return done();
+  try { scopes = children(root); }
+  catch { return { repos: [], undiscoverable: 0 }; }
+  for (const scope of scopes) {
+    if (halt()) return done();
+    let parents: string[];
+    try { parents = children(scope); }
+    catch { undiscoverable++; continue; }
+    for (const parent of parents) {
+      if (!parent.endsWith('.worktrees')) continue;
+      if (halt()) return done();
+      let paths: string[];
+      try { paths = children(parent); }
+      catch { undiscoverable++; continue; }
+      for (const path of paths) {
+        if (halt()) return done();
+        try {
+          const line = readFileSync(join(path, '.git'), 'utf8').trim();
+          const match = /^gitdir:\s*(.+?)[/\\]worktrees[/\\][^/\\]+\s*$/.exec(line);
+          if (!match) { undiscoverable++; continue; }
+          const gitDir = isAbsolute(match[1]!) ? match[1]! : resolve(path, match[1]!);
+          repos.add(resolve(gitDir));
+        } catch { undiscoverable++; }
+      }
+    }
+  }
+  return done();
+}
+
+function defaultRun(args: string[]) {
+  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 20_000 });
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+
+function positive(value: number | undefined, fallback: number): number {
+  if (value === undefined) return fallback;
+  if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`invalid GC limit: ${value}`);
+  return value;
+}
+
+/** One lock guards discovery, every repository window, deletion, and cursor writes. */
+export function runHarnessGcTick(opts: HarnessGcOptions = {}, deps: HarnessGcDeps = {}): HarnessGcResult {
+  const windowSize = positive(opts.window, 150);
+  const maxRemove = positive(opts.maxRemove, 30);
+  const budgetMs = positive(opts.budgetMs, 240_000);
+  const now = deps.now ?? Date.now;
+  const started = now();
+  const state = join(deps.stateRoot ?? effectiveInstanceRoot(), 'harness-gc');
+  mkdirSync(state, { recursive: true });
+  const lockPath = join(state, 'tick.lock');
+  let holder = '';
+  let release: () => void;
+  try {
+    release = acquireLockSync(lockPath, { maxTries: 2, retryBusyMs: 1, breakDeadHolder: true,
+      staleMs: Math.max(2 * budgetMs, 600_000), onWait: (value) => { holder = value; } });
+  } catch (error) {
+    if (!String(error).includes('timed out')) throw error;
+    debug.log('harness.gc', 'tick-skipped', { reason: 'overlap', holder });
+    return { outcome: 'skipped', reason: 'overlap', repos: 0, removed: 0, preserved: 0, deferred: 0, failed: 0,
+      undiscoverable: 0, orphanScanUnavailable: 0, budgetMs, elapsedMs: now() - started, repositories: [] };
+  }
+  try {
+    const runner = deps.run ?? defaultRun;
+    const cursorPath = join(state, 'cursor.json');
+    const targetsPath = join(state, 'targets.json');
+    let cursor: Record<string, number> = {};
+    let persistedTargets: string[] = [];
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(cursorPath, 'utf8'));
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) cursor = parsed as Record<string, number>;
+    } catch { /* No cursor yet, or corrupt state: start at the beginning. */ }
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(targetsPath, 'utf8'));
+      if (Array.isArray(parsed)) persistedTargets = parsed.filter((path): path is string =>
+        typeof path === 'string' && isAbsolute(path));
+    } catch { /* No persisted automatic targets yet. */ }
+    const discovery = opts.repos === undefined
+      ? discoverHarnessGcRepos(deps.worktreeRoot ?? configuredWorktreeRoot(), () => now() - started >= budgetMs)
+      : { repos: opts.repos, undiscoverable: 0 };
+    // A verified automatic target survives removal of its last linked worktree; --repo never enrolls it.
+    const candidates = opts.repos === undefined
+      ? [...new Set([...discovery.repos, ...persistedTargets])]
+      : discovery.repos;
+    const targets = new Set<string>();
+    const repoFailures: Array<{ gitDir: string; error: string }> = [];
+    let failed = 0;
+    // A discovery walk cut by the deadline: repositories it did not reach are unverified, not absent.
+    let discoveryBudgetExhausted = 'stopped' in discovery && discovery.stopped === true;
+    for (const repo of [...candidates].sort()) {
+      if (now() - started >= budgetMs) { discoveryBudgetExhausted = true; break; }
+      const common = gitStdout(['-C', repo, 'rev-parse', '--path-format=absolute', '--git-common-dir'], runner);
+      if (common.ok && common.value && isAbsolute(common.value)) {
+        const gitDir = resolve(common.value);
+        targets.add(gitDir);
+        if (!opts.dryRun && opts.repos === undefined) persistedTargets.push(gitDir);
+      } else { failed++; repoFailures.push({ gitDir: repo, error: 'git common directory unavailable' }); }
+    }
+    const repositories: HarnessGcRepo[] = [];
+    let removed = 0;
+    let preserved = 0;
+    let deferred = 0;
+    let unseenOutsideWindow: number | undefined = repoFailures.length || discoveryBudgetExhausted ? undefined : 0;
+    let unseenOutsidePrefix: number | undefined = repoFailures.length || discoveryBudgetExhausted ? undefined : 0;
+    let orphanScanUnavailable = 0;
+    let processedTargets = 0;
+    let budgetExhausted = false;
+    // maxRemove bounds deletion *attempts* (incl. partial/failed ones), not only successes.
+    let attempts = 0;
+    const overBudget = (): boolean => now() - started >= budgetMs;
+    const baseGh: GhRunner = deps.runGh ?? createGhRunner();
+    for (const gitDir of [...targets].sort()) {
+      if (overBudget()) { budgetExhausted = true; break; } // remaining repositories unprocessed — record it
+      processedTargets++;
+      const offset = Number.isSafeInteger(cursor[gitDir]) && cursor[gitDir]! >= 0 ? cursor[gitDir]! : 0;
+      // The deadline is enforced inside the clean too: once it passes, every further *read* (git query, PR lookup,
+      // safety measurement) fails fast instead of running on past the tick. Deletions are never cut mid-item —
+      // `shouldRemove` already refuses to start one after the deadline.
+      let budgetHit = false;
+      const isDeletion = (args: readonly string[]): boolean =>
+        (args.includes('worktree') && args.includes('remove')) || (args.includes('branch') && args.includes('-D'));
+      const run: GitRunner = (args) => {
+        if (!isDeletion(args) && overBudget()) { budgetHit = true; return { status: 1, stdout: '', stderr: 'harness gc tick budget exhausted' }; }
+        return runner(args[0] === '-C' ? args : ['-C', gitDir, ...args]);
+      };
+      const runGh: GhRunner = (args, options) => {
+        if (overBudget()) { budgetHit = true; return { status: 1, stdout: '', stderr: 'harness gc tick budget exhausted', error: 'budget' }; }
+        return baseGh(args, options);
+      };
+      try {
+        // gh's {owner}/{repo} placeholders refer to cwd, not this target repository.
+        const remote = gitStdout(['config', '--get', 'remote.origin.url'], run);
+        const identity = remote.ok ? /(?:github\.com[:/])([^/:]+)\/([^/]+?)(?:\.git)?\/?$/.exec(remote.value) : null;
+        if (!identity) throw new Error('target repository has no GitHub origin identity');
+        const result = execHarnessClean({ mode: 'merged', dryRun: opts.dryRun, repo: `${identity[1]}/${identity[2]}`,
+          window: { offset, size: windowSize }, forceWorktreeRemove: false, run, runGh, expired: overBudget,
+          activeDirectoryProvider: deps.activeDirectoryProvider,
+          assessWorktree: deps.assessWorktree,
+          readWorktreeProvenance: deps.readWorktreeProvenance,
+          shouldRemove: () => {
+            if (attempts >= maxRemove) return false; // count cap, not the time budget
+            if (overBudget()) { budgetExhausted = true; return false; } // deletion deferred by the time budget
+            attempts++;
+            return true;
+          } });
+        const plan = result.plan;
+        if (result.expired) budgetHit = true;
+        if (budgetHit) {
+          // Unverified, not failed: nothing is counted as preserved/failed and the cursor is kept for the next tick.
+          removed += result.removed.length;
+          failed += result.failed.length;
+          budgetExhausted = true;
+          debug.log('harness.gc', 'repo-budget-exhausted', { gitDir, removed: result.removed.length });
+          break;
+        }
+        if (plan.unavailable) {
+          repoFailures.push({ gitDir, error: 'required clean query unavailable' });
+          failed++;
+        }
+        const pending = result.deferred?.length ?? 0;
+        const byReason: Record<string, number> = {};
+        for (const item of plan.preserve) byReason[item.reason] = (byReason[item.reason] ?? 0) + 1;
+        const repo: HarnessGcRepo = {
+          gitDir, offset: result.window!.offset, window: result.window!.size, total: result.window!.total,
+          removed: result.removed.length, preserved: plan.preserve.length, deferred: pending,
+          failed: result.failed.length, preservedByReason: byReason, orphanScan: plan.orphanScan,
+          ...(plan.queryStatus?.branches && plan.queryStatus.worktrees
+            ? { unseenOutsideWindow: result.window!.unseenOutsideWindow } : {}),
+          ...(plan.queryStatus?.branches && plan.queryStatus.worktrees && plan.scope?.registeredWorktrees !== undefined
+            ? { unseenOutsidePrefix: Math.max(0, plan.scope.registeredWorktrees - plan.scope.matchedWorktrees) } : {}),
+        };
+        repositories.push(repo);
+        debug.log('harness.gc', 'repo', repo);
+        removed += repo.removed;
+        preserved += repo.preserved;
+        deferred += repo.deferred;
+        failed += repo.failed;
+        if (repo.unseenOutsideWindow === undefined) unseenOutsideWindow = undefined;
+        else if (unseenOutsideWindow !== undefined) unseenOutsideWindow += repo.unseenOutsideWindow;
+        if (repo.unseenOutsidePrefix === undefined) unseenOutsidePrefix = undefined;
+        else if (unseenOutsidePrefix !== undefined) unseenOutsidePrefix += repo.unseenOutsidePrefix;
+        if (plan.orphanScan === 'unavailable') orphanScanUnavailable++;
+        if (!opts.dryRun && repo.deferred === 0 && repo.failed === 0 && !plan.unavailable) {
+          const next = repo.offset + repo.window - repo.removed;
+          cursor[gitDir] = next >= repo.total - repo.removed ? 0 : Math.max(0, next);
+        }
+      } catch (error) {
+        if (budgetHit) {
+          budgetExhausted = true;
+          debug.log('harness.gc', 'repo-budget-exhausted', { gitDir, error: String(error) });
+          break;
+        }
+        failed++;
+        unseenOutsideWindow = undefined;
+        unseenOutsidePrefix = undefined;
+        repoFailures.push({ gitDir, error: String(error) });
+        debug.log('harness.gc', 'repo-failed', { gitDir, error: String(error) }, { level: 'error' });
+      }
+    }
+    if (processedTargets < targets.size || budgetExhausted) {
+      unseenOutsideWindow = undefined;
+      unseenOutsidePrefix = undefined;
+    }
+    if (!opts.dryRun && targets.size) {
+      const temp = join(state, `cursor.${process.pid}.tmp`);
+      writeFileSync(temp, JSON.stringify(cursor));
+      renameSync(temp, cursorPath);
+    }
+    if (!opts.dryRun && opts.repos === undefined && persistedTargets.length) {
+      const temp = join(state, `targets.${process.pid}.tmp`);
+      writeFileSync(temp, JSON.stringify([...new Set(persistedTargets)].sort()));
+      renameSync(temp, targetsPath);
+    }
+    // A tick whose budget ran out before any repository was verified did not succeed — it is «skipped», never «ok».
+    const outcome = (targets.size === 0 && !discoveryBudgetExhausted) || failed > 0 ? 'fail'
+      : repositories.length === 0 ? 'skipped' : 'ok';
+    const summary: HarnessGcResult = { outcome,
+      ...(outcome === 'fail' ? { reason: targets.size === 0 ? 'no-target-repo' as const : 'repo-failed' as const }
+        : outcome === 'skipped' ? { reason: 'budget-exhausted' as const } : {}),
+      repos: repositories.length, removed, preserved, deferred, failed,
+      ...(unseenOutsideWindow === undefined ? {} : { unseenOutsideWindow }),
+      ...(unseenOutsidePrefix === undefined ? {} : { unseenOutsidePrefix }),
+      undiscoverable: discovery.undiscoverable, orphanScanUnavailable, budgetMs,
+      elapsedMs: now() - started, repositories,
+      ...(repoFailures.length ? { repoFailures } : {}),
+      ...(budgetExhausted || discoveryBudgetExhausted ? { budgetExhausted: true } : {}) };
+    debug.log('harness.gc', 'tick', summary);
+    return summary;
+  } finally { release(); }
+}
+
+function cliArgs(args: string[]): HarnessGcOptions {
+  const opts: HarnessGcOptions = {};
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--json') continue;
+    if (arg === '--dry-run') { opts.dryRun = true; continue; }
+    if (arg === '--repo') { (opts.repos ??= []).push(args[++i] ?? ''); continue; }
+    const key = arg === '--window' ? 'window' : arg === '--max-remove' ? 'maxRemove' : arg === '--budget-ms' ? 'budgetMs' : null;
+    if (!key) throw new Error(`unknown GC option: ${arg}`);
+    opts[key] = Number(args[++i]);
+  }
+  if (opts.repos?.some((repo) => !repo)) throw new Error('--repo needs a path');
+  return opts;
+}
+
+if (import.meta.main) {
+  try {
+    const result = runHarnessGcTick(cliArgs(process.argv.slice(2)));
+    console.log(JSON.stringify(result));
+    if (result.outcome === 'fail') process.exitCode = 1;
+  } catch (error) {
+    console.log(JSON.stringify({ outcome: 'fail', reason: String(error) }));
+    process.exitCode = 1;
+  }
+}

package/src/harness/harness-seams.ts

@@ -34,7 +34,8 @@ import { getHarnessSpace, resolveRunIdentity } from './harness-space.js';
 import type { AutonomyRiskHit, HarnessGroundingRef } from '../self-implement/context-capsule.js';
 import { AUTO_REVIEW_LABEL, resolveAutoReviewLabels } from '../self-implement/context-capsule.js';
 import { verbatimOriginalAsk } from '../self-implement/goal-author.js';
-import { isSupervisorDecisionSection, splitGoalSections, supervisorGoalDigest } from '../self-implement/goal-digest.js';
+import { extractHarnessReviewAcceptance } from '../self-implement/goal-digest.js';
+export { extractHarnessReviewAcceptance } from '../self-implement/goal-digest.js';
 
 const AUTOREVIEW_SENTENCE_LIMIT = 240;
 const SECURITY_RISK_REASON = '보안/인증 정보';
@@ -222,25 +223,6 @@ async function buildPrBody(
   } catch { return heuristic(); }
 }
 
-/** 골 문서에서 `판정 신호` 절만 뽑아 리뷰 acceptance 로 쓴다. 계보 = self-implement seams. */
-export function extractHarnessReviewAcceptance(goalDocument: string | undefined): { goal: string | undefined; acceptance: string | undefined } {
-  let goal: string | undefined;
-  try {
-    goal = goalDocument?.trim() || undefined;
-  } catch {
-    return { goal: undefined, acceptance: undefined };
-  }
-  if (!goal) return { goal: undefined, acceptance: undefined };
-  try {
-    const acceptance = splitGoalSections(supervisorGoalDigest(goal, 3000).text)
-      .find((section) => isSupervisorDecisionSection(section.title) && section.title.includes('판정 신호'))
-      ?.body.trim() || undefined;
-    return { goal, acceptance };
-  } catch {
-    return { goal, acceptance: undefined };
-  }
-}
-
 function reviewAcceptanceObservation(goal: string | undefined, acceptance: string | undefined): { goalLoaded: boolean; acceptanceChars: number } {
   return { goalLoaded: Boolean(goal), acceptanceChars: acceptance?.length ?? 0 };
 }

package/src/harness/harness-stop.ts

@@ -299,8 +299,10 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
   const targets = dryRun ? [] : contexts && contexts.length > 0 ? [...contexts] : deps.kubeContexts();
   let jobsDeleted = 0;
   for (const context of targets) {
-    const r = deps.kubectl(['--context', context, '-n', deps.namespace, 'delete', 'job', '-l', `elanous.run=${runId}`, '--wait=false']);
-    if (r.status === 0) jobsDeleted += r.stdout.split('\n').filter((line) => line.startsWith('job.batch/')).length;
+    // `-o name` → «job.batch/<name>» 한 줄씩. 맨 출력은 «job.batch "<name>" deleted» 라 «job.batch/» 로만 세면
+    //   지워도 늘 0 이었다(10-11 · 여섯 번 «0개 지움» 뒤 Pod Terminating). 두 꼴을 다 센다.
+    const r = deps.kubectl(['--context', context, '-n', deps.namespace, 'delete', 'job', '-l', `elanous.run=${runId}`, '--wait=false', '-o', 'name']);
+    if (r.status === 0) jobsDeleted += r.stdout.split('\n').filter((line) => /^job\.batch(?:\/|\s+")/.test(line.trim())).length;
     else debug.log('harness.stop', 'job-delete-failed', { runId, context, error: r.stderr.slice(0, 200) }, { level: 'warn' });
   }
   const result: HarnessStopResult = { runId, ...(given !== runId ? { givenRunId: given } : {}), process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, contexts: targets };

package/src/harness/harness-substrate-default.ts

@@ -1,5 +1,79 @@
 import { spawnSync } from 'node:child_process';
-import type { UserConfig } from '../user-config.js';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from '../instance/resolve.js';
+import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
+import { buildUserConfig, getUserConfig, type UserConfig } from '../user-config.js';
+import { resolveCodexQuotaPolicy } from '../oauth/codex-quota-policy.js';
+import { debug } from '../debug/log.js';
+import type { PoolLeaseRecommendation } from '../task-orchestrator/surfaces/pod-lease.js';
+import type { PodPoolMember, PoolKubectl } from '../task-orchestrator/surfaces/pod-pool.js';
+
+/** Key-order-insensitive JSON so equal per-account caps written in another order do not warn. */
+function stableJson(value: unknown): string {
+  return JSON.stringify(value, (_key, v: unknown) => v && typeof v === 'object' && !Array.isArray(v)
+    ? Object.fromEntries(Object.entries(v as Record<string, unknown>).sort(([a], [b]) => a.localeCompare(b)))
+    : v);
+}
+
+function readOperationalLaunchConfig(path: string): UserConfig | null {
+  let text: string;
+  try { text = readFileSync(path, 'utf8'); }
+  catch (err) {
+    // Only a missing file (fresh install, CI, isolated fixtures) means «no operational policy»; permission or I/O errors refuse.
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw new Error(`launch policy: 운영 config 를 읽을 수 없다 — ${path}`);
+  }
+  let raw: unknown;
+  try { raw = JSON.parse(text); }
+  catch { throw new Error(`launch policy: 운영 config 를 읽을 수 없다 — ${path}`); }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error(`launch policy: 운영 config 형식이 잘못됐다 — ${path}`);
+  return buildUserConfig(path);
+}
+
+/** Launch policy belongs to the host, not to the materialized config in a derived worktree.
+ * Explicit test/config universes remain isolated; this only applies to tree-derived launches. */
+export function harnessLaunchPolicyConfig(options: {
+  derived?: UserConfig;
+  operationalRoot?: string;
+  derivedRoot?: string;
+  warn?: (line: string) => void;
+  /** Reads the operational config at `path`; injected by tests so they never touch the host's real config. */
+  readOperational?: (path: string) => UserConfig | null;
+} = {}): UserConfig {
+  const derived = options.derived ?? getUserConfig();
+  const operationalRoot = options.operationalRoot ?? prodInstanceRoot();
+  const derivedRoot = options.derivedRoot ?? effectiveInstanceRoot();
+  const isDerived = options.derivedRoot !== undefined
+    ? derivedRoot !== operationalRoot
+    : derivedRoot !== operationalRoot && !getElanousConfigDirOverride() && (
+      process.env.ELANOUS_STATE_DIR_SOURCE === 'derived'
+      || derivedRoot === treeDerivedRootFor(process.cwd())
+    );
+  if (!isDerived) return derived;
+  const path = join(operationalRoot, 'config.json');
+  const operational = (options.readOperational ?? readOperationalLaunchConfig)(path);
+  if (!operational) {
+    (options.warn ?? console.error)(`⚠️ launch policy: 운영 config 가 없다 (${path}) — 이 우주의 정책으로 발사`);
+    return derived;
+  }
+  const policy = (config: UserConfig) => ({
+    quota: resolveCodexQuotaPolicy(config.llm).policy,
+    accountLimits: config.llm?.codexAccountRotationThresholdPercentByAccount,
+    fallbackChain: config.llm?.fallbackChain,
+    childLlm: config.tools?.selfImplement?.childLlm,
+    budgetGate: config.harness?.budgetGate,
+    podPool: config.harness?.podPool ?? config.pod?.pool,
+    grokApiKeyOptIn: config.harness?.pod?.grokApiKeyOptIn === true,
+  });
+  const actual = policy(derived);
+  const expected = policy(operational);
+  if (derived.llm?.codexQuotaPolicy === undefined && derived.llm?.codexCreditsAllowed === undefined
+    || stableJson(actual) !== stableJson(expected)) {
+    (options.warn ?? console.error)('⚠️ launch policy: 파생 시험 우주 정책이 없거나 운영과 다르다 — 운영 정책으로 발사');
+  }
+  return operational;
+}
 
 export type HarnessSubstrate = 'local' | 'pod';
 export interface ResolvedHarnessSubstrate {
@@ -8,22 +82,154 @@ export interface ResolvedHarnessSubstrate {
   source: 'flag' | 'config' | 'default';
 }
 
-/** Only inspect the current context when no explicit pool is available. Never turn a failed Pod selection into local. */
+/** Conservative local headroom for one standard harness goal (the Pod lease's default per-goal size). */
+export const AUTO_LOCAL_MIN_AVAILABLE_MEMORY_BYTES = 16 * 1024 ** 3;
+
+export interface AutoSubstrateSignals {
+  /** A blocked memory admission has recommended=0 and limitedBy=memory; unknown is not blocked. */
+  podAdmission: Pick<PoolLeaseRecommendation, 'recommended' | 'limitedBy'> | null;
+  load1: number | null;
+  cores: number | null;
+  availableMemoryBytes: number | null;
+  localLaneOpen: boolean;
+}
+
+export interface AutoSubstrateDecision {
+  substrate: HarnessSubstrate;
+  reason: string;
+}
+
+export interface NextLocalLaneCapInput {
+  current: number;
+  wanted: number;
+  lastRaisedAtMs: number | null;
+  nowMs: number;
+  load1: number | null;
+  cores: number | null;
+}
+
+export interface NextLocalLaneCapDecision {
+  cap: number;
+  action: 'raise' | 'hold' | 'lower';
+  reason: string;
+}
+
+/** Decide one conservative local-lane cap adjustment from the current observations. */
+export function nextLocalLaneCap({ current, wanted, lastRaisedAtMs, nowMs, load1, cores }: NextLocalLaneCapInput): NextLocalLaneCapDecision {
+  let decision: NextLocalLaneCapDecision;
+  if (load1 === null || cores === null || !Number.isFinite(load1) || !Number.isFinite(cores) || load1 < 0 || cores <= 0) {
+    decision = { cap: current, action: 'hold', reason: 'load-unreadable' };
+  } else if (load1 >= cores) {
+    decision = { cap: Math.max(0, current - 5), action: 'lower', reason: 'local-load-overloaded' };
+  } else if (!Number.isFinite(current) || !Number.isFinite(wanted) || !Number.isFinite(nowMs)) {
+    decision = { cap: current, action: 'hold', reason: 'cap-or-time-unreadable' };
+  } else if (wanted <= current) {
+    decision = { cap: current, action: 'hold', reason: 'no-increase-requested' };
+  } else if (load1 >= cores / 2) {
+    decision = { cap: current, action: 'hold', reason: 'local-load-not-spare' };
+  } else if (lastRaisedAtMs !== null && (!Number.isFinite(lastRaisedAtMs) || nowMs - lastRaisedAtMs < 15 * 60 * 1000)) {
+    decision = { cap: current, action: 'hold', reason: 'raise-cooldown' };
+  } else {
+    decision = { cap: Math.min(wanted, current + 5), action: 'raise', reason: 'local-load-spare' };
+  }
+  debug.log('harness.guardian', 'lane-step', { current, wanted, lastRaisedAtMs, nowMs, load1, cores, ...decision });
+  return decision;
+}
+
+/** Pure routing judgment. Missing/invalid observations are not evidence that the host has room. */
+export function routeAutoSubstrate(signals: AutoSubstrateSignals): AutoSubstrateDecision {
+  const { podAdmission, load1, cores, availableMemoryBytes, localLaneOpen } = signals;
+  if (podAdmission === null || podAdmission.recommended === null || podAdmission.limitedBy === null)
+    return { substrate: 'pod', reason: 'pod-admission-unobserved' };
+  if (podAdmission.recommended !== 0 || podAdmission.limitedBy !== 'memory')
+    return { substrate: 'pod', reason: 'pod-admission-not-memory-blocked' };
+  if (!localLaneOpen) return { substrate: 'pod', reason: 'local-lane-closed' };
+  if (cores === null || !Number.isFinite(cores) || cores <= 0 || load1 === null || !Number.isFinite(load1) || load1 < 0 || load1 >= cores / 2)
+    return { substrate: 'pod', reason: 'local-load-not-spare' };
+  if (availableMemoryBytes === null || !Number.isFinite(availableMemoryBytes) || availableMemoryBytes < AUTO_LOCAL_MIN_AVAILABLE_MEMORY_BYTES)
+    return { substrate: 'pod', reason: 'local-memory-not-spare' };
+  return { substrate: 'local', reason: 'pod-memory-blocked-local-spare' };
+}
+
+/**
+ * POD-POOL-UNCAPPED-SPEC — the pre-launch pool check of an «implicit» Pod pool (the current kube context),
+ * reported in context names. `unmeasured` = kubectl itself could not run, so nothing was measured:
+ * «unknown» is not «unfit» (same rule as LAUNCH-STALL's unreadable member memory).
+ */
+export interface HarnessPoolCheck {
+  ok: boolean;
+  ready: string[];
+  dropped: { context: string; reason: string }[];
+  unmeasured?: string | null;
+}
+
+/** `checkPodPool` over one pool spec — a kube context that cannot answer before launch is refused, not silently kept. */
+export function checkHarnessPodPool(pool: string, run?: PoolKubectl): HarnessPoolCheck {
+  // Lazy require: the Pod surface pulls `bun:ffi`, and only a Pod launch without an explicit pool needs it.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const surface = require('../task-orchestrator/surfaces/pod-pool.js') as typeof import('../task-orchestrator/surfaces/pod-pool.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const leaseKubectl = run ?? (require('../task-orchestrator/surfaces/pod-lease.js') as typeof import('../task-orchestrator/surfaces/pod-lease.js')).leaseKubectl;
+  let members: PodPoolMember[];
+  try { members = surface.parsePodPool(pool); }
+  catch (error) {
+    return { ok: false, ready: [], dropped: [{ context: pool, reason: error instanceof Error ? error.message : String(error) }] };
+  }
+  let calls = 0;
+  let unrunnable = 0;
+  const kubectl: PoolKubectl = (args, input) => {
+    const r = leaseKubectl(args, input);
+    calls++;
+    // Only «kubectl is not installed» (spawn ENOENT) is no verdict about the cluster. A kubectl that started but
+    // timed out (status null · ETIMEDOUT) is a cluster that did not answer — that stays a measured refusal.
+    if (r.status === null && /\bENOENT\b/.test(r.stderr)) unrunnable++;
+    return r;
+  };
+  const checked = surface.checkPodPool(members, kubectl);
+  if (!checked.ok && calls > 0 && unrunnable === calls) return { ok: true, ready: [], dropped: checked.dropped, unmeasured: 'kubectl 을 실행할 수 없다' };
+  return { ok: checked.ok, ready: checked.ready.map((m) => m.context), dropped: checked.dropped };
+}
+
+/** Only inspect the current context when no explicit pool is available. Never turn an explicit Pod selection into local. */
 export function resolveHarnessSubstrate({ flag, config, env, currentContext = () => {
   const result = spawnSync('kubectl', ['config', 'current-context'], { encoding: 'utf8', timeout: 5000 });
   return result.status === 0 ? result.stdout?.trim() : undefined;
-} }: {
-  flag?: { substrate?: HarnessSubstrate; podPool?: string };
+}, autoSignals, poolCheck = checkHarnessPodPool }: {
+  flag?: { substrate?: HarnessSubstrate | 'auto'; podPool?: string };
   config?: Pick<UserConfig, 'harness' | 'pod'>;
   env?: NodeJS.ProcessEnv;
   currentContext?: () => string | undefined;
+  /** Signals must come from the launch host and Pod admission, not a worktree's cached config. */
+  autoSignals?: AutoSubstrateSignals;
+  /** POD-POOL-UNCAPPED-SPEC — pre-launch check of the implicit kube context; tests inject it instead of shelling out. */
+  poolCheck?: (pool: string) => HarnessPoolCheck;
 }): ResolvedHarnessSubstrate {
-  const substrate = flag?.substrate ?? config?.harness?.substrate ?? 'local';
-  if (substrate !== 'local' && substrate !== 'pod') throw new Error('harness.substrate: local 또는 pod 만 허용한다');
+  const requested = flag?.substrate ?? config?.harness?.substrate ?? 'local';
+  if (requested !== 'local' && requested !== 'pod' && requested !== 'auto') throw new Error('harness.substrate: local, pod 또는 auto 만 허용한다');
   const source = flag?.substrate ? 'flag' : config?.harness?.substrate ? 'config' : 'default';
+  // Missing signals mean admission was not observed, not that the Pod has room.
+  const decision = requested === 'auto' ? routeAutoSubstrate(autoSignals ?? {
+    podAdmission: null, load1: null, cores: null, availableMemoryBytes: null, localLaneOpen: false,
+  }) : null;
+  const substrate: HarnessSubstrate = requested === 'auto' ? decision!.substrate : requested;
+  if (decision) debug.log('harness.substrate', 'route', { substrate, reason: decision.reason, source });
   if (substrate === 'local') return { substrate, pool: null, source };
-  const pool = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim() || currentContext()?.trim();
-  if (!pool) throw new Error('harness.substrate=pod: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 `--substrate local` 로 명시하라');
+  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
+  const pool = explicit || currentContext()?.trim();
+  if (!pool) throw new Error(`harness.substrate=${decision ? `auto→pod(${decision.reason})` : 'pod'}: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
+  // POD-POOL-UNCAPPED-SPEC — an explicit pool is the operator's own statement and gets `checkPodPool` at the launch
+  //   site (`src/index.ts` self orchestrate · `src/loops/orchestrator/tick.ts` · `pod-command-job.ts`). The implicit
+  //   kube context had no such gate: a context whose cluster is gone, or whose `elanous-test` namespace is missing,
+  //   sailed through here and then sat on `recommended=0` for 35 minutes (10-10 probe, 6 runs). Check before launch.
+  if (!explicit) {
+    const checked = poolCheck(pool);
+    debug.log('harness.substrate', 'pool-check', { pool, origin: 'current-context', ok: checked.ok, ready: checked.ready, dropped: checked.dropped, unmeasured: checked.unmeasured ?? null });
+    if (!checked.ok) {
+      const why = checked.dropped.map((d) => `${d.context}: ${d.reason}`).join(' · ') || '노드가 하나도 준비되지 않았다';
+      throw new Error(`harness.substrate=pod: 현재 컨텍스트 「${pool}」 이 발사 전 풀 점검을 넘지 못했다 — ${why} · 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
+    }
+    if (checked.unmeasured) debug.log('harness.substrate', 'pool-check-unmeasured', { pool, reason: checked.unmeasured }, { level: 'warn' });
+  }
   return { substrate, pool, source };
 }
 

package/src/harness/launch-registry.ts

@@ -19,6 +19,10 @@ export interface LaunchBinding {
   readonly goalPath?: string;
   /** The `self-dev-runs` directory that holds this run's `pid.json` — tells a stop which universe launched it. */
   readonly runsDir?: string;
+  /** `ELANOUS_POD_NAME` at launch — a Pod child's run (TA backfill skips it like the launch-time hook does). */
+  readonly podName?: string;
+  /** `ELANOUS_TASK_CARD_ID` at launch — a handed run that already owns a card (TA backfill skips it). */
+  readonly taskCardId?: string;
 }
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -72,6 +76,8 @@ export function readLaunchBinding(runId: string, dir = launchRegistryDir()): Lau
       ...(typeof value.argv0 === 'string' ? { argv0: value.argv0 } : {}),
       ...(typeof value.goalPath === 'string' && isAbsolute(value.goalPath) ? { goalPath: value.goalPath } : {}),
       ...(typeof value.runsDir === 'string' && isAbsolute(value.runsDir) ? { runsDir: value.runsDir } : {}),
+      ...(typeof value.podName === 'string' && value.podName ? { podName: value.podName } : {}),
+      ...(typeof value.taskCardId === 'string' && value.taskCardId ? { taskCardId: value.taskCardId } : {}),
     };
   } catch { return null; }
 }