elanous 0.2.29 → 0.2.32

package/src/task-orchestrator/surfaces/pod-install-slots.ts

@@ -1,3 +1,5 @@
+import { spawn } from 'node:child_process';
+
 // GATE-INSTALL-CACHE (0.2.20) — a node-wide throttle for the release-gate shards' `bun install`.
 //
 // Cause, measured on the 0.2.19 gate (`elanous logs --category release-loop.gate --event pod-shard --all --include-test`):
@@ -21,8 +23,8 @@ export const POD_INSTALL_SLOTS_HOST_PATH = '/var/lib/elanous/gate-install-slots'
 export const POD_INSTALL_SLOTS_DEFAULT = 4;
 export const POD_INSTALL_SLOTS_MOUNT = '/gate-install-slots';
 
-/** hostPath volume ⊕ mount for the tokens. `DirectoryOrCreate` makes a root-owned 0755 directory, so the Pod also needs
- *  {@link podHostDirsScript} (the child runs as uid 1000). */
+/** hostPath volume ⊕ mount for the tokens. `DirectoryOrCreate` makes a root-owned 0755 directory, so the node also needs
+ *  {@link prepareHostDirsOnce} (the child runs as uid 1000). */
 export function podInstallSlotsVolume(hostPath: string = POD_INSTALL_SLOTS_HOST_PATH) {
   return {
     volume: { name: 'install-slots', hostPath: { path: hostPath, type: 'DirectoryOrCreate' } },
@@ -30,17 +32,125 @@ export function podInstallSlotsVolume(hostPath: string = POD_INSTALL_SLOTS_HOST_
   };
 }
 
-/**
- * The root shell that hands the mounted hostPath directories to the child's uid. Without it a `DirectoryOrCreate`
- * hostPath stays root:root 0755 and the child's `[ -w … ]` guard silently skips it (the Bun cache option was a no-op).
- * Never fails the Pod: an unchanged directory only means the child falls back (no cache · no throttle).
- * GATE-WARM-BOOT — it runs inside the Pod's single init container (after the isolation probe), not as a second one.
- */
+// GATE-WARM-BOOT-NO-INIT (10-15) — the root hand-over of the hostPath directories left the Pod. It was an init container
+// (`host-dirs`, then folded into `isolation-gate` by GATE-WARM-BOOT), and every init container cost a container
+// transition on a loaded k3d node (#27805 on node-b: init 2 → 354 s · init 1 → 41 s · none → 1 s to the child start).
+// The directories live on the node and outlive every Pod, so the hand-over is a node fact: done once per node from the
+// pool host (`docker exec` into each k3d node container · idempotent `mkdir -p`/`chown`/`chmod`), and the child shell only
+// reports a directory it still cannot write. Never fails the Pod: an unwritable directory means the child falls back
+// (no cache · no throttle), exactly as before when the hand-over failed.
+
+const SAFE_HOST_PATH = /^\/[A-Za-z0-9._/-]+$/;
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const HOST_DIRS_PREP_LIMIT_MS = 30_000;
+
+/** Child-shell line: report (never fail on) a mounted host directory the uid-1000 child cannot write. */
+/** Root hand-over inside the Pod — only for runs whose hostPath dirs could not be prepared on the node (no pool member ·
+ * prep failed · prep disabled). Same lines the old `isolation-gate` init ran; it never fails the Pod. */
 export function podHostDirsScript(mounts: ReadonlyArray<{ mountPath: string }>): string {
   const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
   return `for d in ${paths}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || echo "[host-dirs] could not prepare $d"; done; exit 0`;
 }
 
+export function podHostDirsCheckScript(mounts: ReadonlyArray<{ mountPath: string }>): string {
+  const paths = mounts.map((mount) => `'${mount.mountPath.replace(/'/g, `'\\''`)}'`).join(' ');
+  return `for d in ${paths}; do [ -d "$d" ] && [ -w "$d" ] || echo "[host-dirs] could not prepare $d (not writable by uid $(id -u) · node not prepared)"; done`;
+}
+
+/** Host-side shell (on the pool host): hand the node directories to uid 1000 in every k3d node container of `cluster`. */
+export function podHostDirsNodeScript(o: { cluster: string; hostPaths: readonly string[] }): string {
+  if (!SAFE_NAME.test(o.cluster)) throw new Error(`invalid k3d cluster: ${o.cluster}`);
+  for (const path of o.hostPaths) if (!SAFE_HOST_PATH.test(path) || path.split('/').includes('..')) throw new Error(`invalid host dir: ${path}`);
+  const inner = `for d in ${o.hostPaths.join(' ')}; do mkdir -p "$d" && chown 1000:1000 "$d" && chmod 0775 "$d" || { echo "[host-dirs] could not prepare $d"; exit 1; }; done`;
+  return [
+    `nodes=$(docker ps --filter label=k3d.cluster=${o.cluster} --format '{{.Names}} {{.Label "k3d.role"}}' | awk '$2=="server"||$2=="agent"{print $1}')`,
+    `[ -n "$nodes" ] || { echo "[host-dirs] no k3d node for ${o.cluster}"; exit 2; }`,
+    'rc=0',
+    `for n in $nodes; do docker exec "$n" sh -c '${inner}' || rc=1; done`,
+    'exit $rc',
+  ].join('\n');
+}
+
+/** The member's current k3d server/agent container IDs, sorted — the node «generation» the hand-over memo is keyed by. */
+export function podHostDirsNodeIdsScript(cluster: string): string {
+  if (!SAFE_NAME.test(cluster)) throw new Error(`invalid k3d cluster: ${cluster}`);
+  return `docker ps --no-trunc --filter label=k3d.cluster=${cluster} --format '{{.ID}} {{.Label "k3d.role"}}' | awk '$2=="server"||$2=="agent"{print $1}' | sort | tr '\\n' ' '`;
+}
+
+export interface HostDirsPrepResult { host: string; ok: boolean; ms: number; detail?: string }
+
+type HostShell = (host: string | undefined, script: string, limitMs: number) => Promise<{ rc: number; output: string }>;
+
+/**
+ * Bounded shell on the pool host (`ssh <host>`) or this machine (no host); never throws. At `limitMs` the whole process
+ * group is killed and the call returns rc 124 at once — a stuck `docker exec` grandchild holding the pipe must not keep
+ * the caller (and the Job launch behind it) waiting for `close`.
+ */
+export function hostShellWithin(host: string | undefined, script: string, limitMs: number): Promise<{ rc: number; output: string }> {
+  const env = 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; ';
+  const [cmd, args] = host
+    ? ['ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, env + script]] as const
+    : ['bash', ['-c', env + script]] as const;
+  return new Promise((resolve) => {
+    let output = '';
+    let settled = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const finish = (rc: number, text: string) => { if (!settled) { settled = true; clearTimeout(timer); resolve({ rc, output: text }); } };
+    let child: ReturnType<typeof spawn>;
+    try { child = spawn(cmd, [...args], { stdio: ['ignore', 'pipe', 'pipe'], detached: true }); }
+    catch (error) { resolve({ rc: 2, output: String(error) }); return; }
+    timer = setTimeout(() => {
+      try { if (child.pid) process.kill(-child.pid, 'SIGKILL'); else child.kill('SIGKILL'); } catch { child.kill('SIGKILL'); }
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      finish(124, `${output}\n[host-dirs] timed out after ${limitMs} ms`);
+    }, limitMs);
+    child.stdout?.on('data', (chunk) => { output += String(chunk); });
+    child.stderr?.on('data', (chunk) => { output += String(chunk); });
+    child.on('error', (error) => finish(2, `${output}\n${String(error)}`));
+    child.on('close', (code) => finish(code ?? 2, output));
+  });
+}
+
+const prepared = new Map<string, Promise<HostDirsPrepResult>>();
+
+/**
+ * Hand `hostPaths` to uid 1000 on the member's k3d nodes once per (host, cluster, node generation, path) in this process — every shard Job
+ * on the same member awaits the same run, and a path already handed over (or in flight) is not run again even when it
+ * comes with a different companion path. A failure is not memoized (the next Job tries again) and never throws.
+ */
+export async function prepareHostDirsOnce(o: { member: { sshHost?: string; k3dCluster: string }; hostPaths: readonly string[]; shell?: HostShell; limitMs?: number }): Promise<HostDirsPrepResult> {
+  const host = o.member.sshHost;
+  const label = host ?? 'local';
+  const start = Date.now();
+  const shell = o.shell ?? hostShellWithin;
+  // Node generation (review mf): a recreated cluster or a new agent has other container IDs, so a hand-over remembered for
+  // the old node set is not reused. Unreadable IDs → no memo at all (every path runs, success is not remembered).
+  const ids = await shell(host, podHostDirsNodeIdsScript(o.member.k3dCluster), o.limitMs ?? HOST_DIRS_PREP_LIMIT_MS)
+    .catch(() => ({ rc: 2, output: '' }));
+  const generation = ids.rc === 0 && ids.output.trim() ? ids.output.trim() : null;
+  const gen = generation ?? `unknown-${start}-${Math.random()}`;
+  const keyOf = (path: string) => `${label}\0${o.member.k3dCluster}\0${gen}\0${path}`;
+  const paths = [...new Set(o.hostPaths)].sort();
+  const fresh = paths.filter((path) => !prepared.has(keyOf(path)));
+  if (fresh.length) {
+    const run = (async (): Promise<HostDirsPrepResult> => {
+      const script = podHostDirsNodeScript({ cluster: o.member.k3dCluster, hostPaths: fresh });
+      const r = await shell(host, script, o.limitMs ?? HOST_DIRS_PREP_LIMIT_MS);
+      const ms = Date.now() - start;
+      return r.rc === 0 ? { host: label, ok: true, ms } : { host: label, ok: false, ms, detail: r.output.trim().slice(-300) || `rc=${r.rc}` };
+    })().catch((error: unknown) => ({ host: label, ok: false, ms: Date.now() - start, detail: String(error).slice(0, 300) }))
+      .then((result) => { if (!result.ok || generation === null) for (const path of fresh) prepared.delete(keyOf(path)); return result; });
+    for (const path of fresh) prepared.set(keyOf(path), run);
+  }
+  const results = await Promise.all(paths.map((path) => prepared.get(keyOf(path))!));
+  const failed = results.find((result) => !result.ok);
+  return failed ?? { host: label, ok: true, ms: Date.now() - start };
+}
+
+/** Test seam — forget the per-process hand-over memo. */
+export function resetHostDirsPrepMemo(): void { prepared.clear(); }
+
 const int = (value: number, label: string) => {
   if (!Number.isSafeInteger(value) || value < 1) throw new Error(`invalid ${label}: ${value}`);
   return value;
@@ -66,7 +176,9 @@ export function installSlotScript(o: { dir?: string; slots: number; waitSeconds?
     '  if [ ! -d "$d" ] || [ ! -w "$d" ]; then echo "[gate] install-slot none (directory not writable)"; return 0; fi',
     '  while :; do',
     `    for n in $(seq 0 ${slots - 1}); do`,
-    '      if mkdir "$d/slot-$n" 2>/dev/null; then',
+    // The token is taken by bash's own noclobber create (O_EXCL), not by `mkdir`: uutils coreutils `mkdir` (0.8 · wsl gate host)
+    // let two racing callers both succeed on one path (10-16 · 3 holders on 2 slots). A directory token left by an older shell still counts as held.
+    '      if (set -C; : > "$d/slot-$n") 2>/dev/null; then',
     '        install_slot="$d/slot-$n"',
     '        echo "[gate] install-slot $n waited $(( $(date +%s) - t0 ))s"; return 0',
     '      fi',

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -11,13 +11,23 @@ import { hostLeaseBaseDir, type PendingJobIdentity } from '../../pod-lease/host-
 // POD-CPU-REQUEST-RIGHTSIZE(10-09 · OP 실측): 하니스 Pod 실사용은 대부분 100m 미만(LLM 응답 대기)인데 요청 1 CPU 를
 //   잡아 node-b 32코어가 «요청 31/32»로 막혔다(실사용 4.6코어 · 14%). 요청은 실사용 근처로, 한도(4)는 그대로 — 몰릴 때는 한도까지 쓴다.
 //   게이트·pod-command 기본은 pod-command-job.ts 의 POD_COMMAND_CPU_REQUEST_DEFAULT(1)로 따로 둔다(테스트 조각은 CPU 를 실제로 쓴다).
-export const POD_CHILD_REQUESTS = { cpu: '250m', memory: '6Gi' } as const;
+// SI-TASK-ADMIT-RIGHTSIZE: one host env restores the previous 6Gi request and uncapped p95 admission.
+// An invalid override fails conservative at 6Gi rather than silently under-reserving a Pod.
+export function resolveSiTaskMemoryPolicy(override: string | undefined): { requestMemory: string; admissionCapBytes: number | null; source: string } {
+  if (override === undefined) return { requestMemory: '3Gi', admissionCapBytes: 3 * 1024 ** 3, source: 'default' };
+  if (override === '6Gi') return { requestMemory: '6Gi', admissionCapBytes: null, source: 'override' };
+  return { requestMemory: '6Gi', admissionCapBytes: null, source: 'invalid-override-fallback' };
+}
+const siMemoryPolicy = resolveSiTaskMemoryPolicy(process.env.ELANOUS_POD_SI_REQUEST_MEMORY);
+export const POD_CHILD_REQUESTS = { cpu: '250m', memory: siMemoryPolicy.requestMemory } as const;
 /** Finished harness and command Jobs release their Pod slots after 30 minutes. */
 export const POD_JOB_TTL_AFTER_FINISHED_SECONDS = 1800;
 /** 게이트가 돌 때 하니스 «한 자리»로 셈하는 CPU — 요청(250m)보다 보수적으로 1 코어를 잡아 게이트 조각의 CPU 를 지킨다(GATE-RESERVE-AUTO 셈은 그대로). */
 export const HARNESS_SLOT_CPU_BESIDE_GATE = '1';
 /** POD-ADMIT-BY-USAGE — observed usage is scaled by this before it reserves memory. */
 const POD_USAGE_HEADROOM = 1.5;
+/** New standard si-task admission only. Existing Running Pods keep their observed/requested reservation. */
+export const POD_SI_ADMISSION_CAP_BYTES = siMemoryPolicy.admissionCapBytes;
 /** POD-ADMIT-BY-USAGE — a node keeps at least this share of allocatable memory free (real usage and bookkeeping). */
 const POD_NODE_FREE_FLOOR_RATIO = 0.1;
 
@@ -220,6 +230,13 @@ function runningLimit(spec: Record<string, unknown>): number | null {
 
 /** A short-lived Pod proves cluster DNS from inside the same namespace as harness Jobs. Image pull failures are not DNS failures. */
 export type PoolDnsProbe = 'ready' | 'dns' | 'image' | 'unknown';
+/** Separate, opt-in observation. null means the probe could not measure that step. */
+export interface ExternalGitHubProbe {
+  externalDns: boolean | null;
+  githubHttps: boolean | null;
+  measuredAt: string | null;
+  reason: string | null;
+}
 const DNS_CACHE_MS = 10 * 60_000;
 const DNS_STALE_OK_MS = 30 * 60_000;
 const DNS_LOCK_WAIT_MS = 6 * 60_000;
@@ -230,6 +247,97 @@ const dnsFlock = process.platform === 'linux' || process.platform === 'darwin'
     flock: { args: ['int', 'int'], returns: 'int' },
   }).symbols.flock : null;
 
+/** A disposable Pod in the Job namespace measures GitHub reachability without changing admission. */
+export function probePoolGitHub(context: string, kubectl: PoolKubectl = leaseKubectl, options: { dir?: string; now?: () => number } = {}): ExternalGitHubProbe {
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
+  const now = options.now ?? Date.now;
+  const dir = options.dir ?? hostLeaseBaseDir();
+  const key = createHash('sha256').update(context).digest('hex');
+  const cache = join(dir, `github-egress-${key}.cache`);
+  const lock = join(dir, `github-egress-${key}.flock`);
+  const cached = (): ExternalGitHubProbe | null => {
+    try {
+      const record = object(JSON.parse(readFileSync(cache, 'utf8')));
+      if (typeof record?.at !== 'number' || now() < record.at || now() - record.at >= 60_000) return null;
+      if (typeof record.measuredAt !== 'string' || ![true, false].includes(record.externalDns as boolean) ||
+          ![true, false, null].includes(record.githubHttps as boolean | null) ||
+          !(record.reason === null || typeof record.reason === 'string')) return null;
+      return { externalDns: record.externalDns as boolean, githubHttps: record.githubHttps as boolean | null,
+        measuredAt: record.measuredAt, reason: record.reason as string | null };
+    } catch { return null; }
+  };
+  const fresh = cached();
+  if (fresh) return fresh;
+  try { mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { return unknown('probe cache unavailable'); }
+  if (!dnsFlock) return unknown('probe lock unavailable');
+  let fd: number;
+  try { fd = openSync(lock, 'a', 0o600); } catch { return unknown('probe lock unavailable'); }
+  let held = false;
+  try {
+    const deadline = Date.now() + 2_000;
+    while (!held) {
+      const shared = cached();
+      if (shared) return shared;
+      if (dnsFlock(fd, 2 | 4) === 0) { held = true; break; }
+      if (Date.now() >= deadline) return unknown('probe busy');
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+    }
+    const shared = cached();
+    if (shared) return shared;
+    const result = runPoolGitHubProbe(context, kubectl, new Date(now()).toISOString());
+    if (result.measuredAt !== null) {
+      const temp = `${cache}.${randomUUID()}.tmp`;
+      try { writeFileSync(temp, JSON.stringify({ ...result, at: now() }), { mode: 0o600 }); renameSync(temp, cache); }
+      catch { try { rmSync(temp, { force: true }); } catch { /* observation remains valid without cache */ } }
+    }
+    return result;
+  } finally {
+    if (held) dnsFlock(fd, 8);
+    closeSync(fd);
+  }
+}
+
+function runPoolGitHubProbe(context: string, kubectl: PoolKubectl, measuredAt: string): ExternalGitHubProbe {
+  const name = `elanous-egress-${randomUUID().slice(0, 12)}`;
+  const base = ['--context', context, '--request-timeout=15s'];
+  const unknown = (reason: string): ExternalGitHubProbe => ({ externalDns: null, githubHttps: null, measuredAt: null, reason });
+  let created = false;
+  try {
+    const manifest = JSON.stringify({ apiVersion: 'v1', kind: 'Pod', metadata: { name, namespace: 'elanous-test', labels: { 'elanous.probe': 'github-egress' } }, spec: {
+      restartPolicy: 'Never', activeDeadlineSeconds: 35, automountServiceAccountToken: false,
+      containers: [{ name: 'probe', image: 'busybox:1.36', command: ['sh', '-c',
+        'if nslookup github.com >/dev/null 2>&1; then echo EXTERNAL_DNS_OK; if wget -q -T 8 -O /dev/null https://github.com/; then echo GITHUB_HTTPS_OK; else echo GITHUB_HTTPS_FAILED; fi; else echo EXTERNAL_DNS_FAILED; fi'],
+      resources: { requests: { cpu: '0', memory: '16Mi' }, limits: { cpu: '100m', memory: '64Mi' } } }],
+    } });
+    if (kubectl([...base, 'create', '-f', '-'], manifest).status !== 0) return unknown('probe create failed');
+    created = true;
+    const waited = kubectl([...base, '-n', 'elanous-test', 'wait', '--for=jsonpath={.status.phase}=Succeeded', `pod/${name}`, '--timeout=25s']);
+    const podResult = kubectl([...base, '-n', 'elanous-test', 'get', `pod/${name}`, '-o', 'json']);
+    if (podResult.status !== 0) return unknown('probe status unavailable');
+    const pod = object(JSON.parse(podResult.stdout));
+    const statuses = object(pod?.status)?.containerStatuses;
+    if (Array.isArray(statuses) && statuses.some((c) =>
+          ['ErrImagePull', 'ImagePullBackOff', 'InvalidImageName'].includes(String(object(object(object(c)?.state)?.waiting)?.reason))))
+      return unknown('probe image unavailable');
+    const logs = kubectl([...base, '-n', 'elanous-test', 'logs', `pod/${name}`]);
+    if (logs.status !== 0) return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+    const markers = logs.stdout.trim().split(/\r?\n/u);
+    const dnsOk = markers.includes('EXTERNAL_DNS_OK');
+    const dnsFail = markers.includes('EXTERNAL_DNS_FAILED');
+    const httpsOk = markers.includes('GITHUB_HTTPS_OK');
+    const httpsFail = markers.includes('GITHUB_HTTPS_FAILED');
+    if (dnsFail && !dnsOk && !httpsOk && !httpsFail)
+      return { externalDns: false, githubHttps: null, measuredAt, reason: 'external DNS failed' };
+    if (dnsOk && !dnsFail && httpsOk !== httpsFail)
+      return { externalDns: true, githubHttps: httpsOk, measuredAt, reason: httpsFail ? 'GitHub HTTPS failed' : null };
+    return unknown(waited.status === 0 ? 'probe output unavailable' : 'probe timeout');
+  } catch { return unknown('probe failed'); }
+  finally {
+    if (created) try { kubectl([...base, '-n', 'elanous-test', 'delete', `pod/${name}`, '--ignore-not-found=true', '--wait=false']); }
+    catch { /* best effort; Kubernetes activeDeadlineSeconds also bounds the Pod */ }
+  }
+}
+
 /** The cache and lock are shared by CLI processes, keyed by context rather than pool composition. */
 export function probePoolDns(context: string, kubectl: PoolKubectl = leaseKubectl, options: { dir?: string; now?: () => number } = {}): PoolDnsProbe {
   const dir = options.dir ?? hostLeaseBaseDir();
@@ -477,6 +585,7 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
         const leasedJobs = new Set<string>();
         const gateJobs = new Map<string, number>();
         const boundGateJobs = new Set<string>();
+        const commandJobs = new Set<string>();
         let jobsValid = true;
         for (const job of jobItems) {
           const meta = object(job.metadata);
@@ -484,6 +593,7 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
           if (object(meta.labels)?.['elanous.substrate'] !== 'pod') continue;
           if (typeof meta.name !== 'string' || !meta.name) { jobsValid = false; continue; }
           jobNames.add(meta.name);
+          if (object(meta.labels)?.['elanous.kind'] === 'command') commandJobs.add(meta.name);
           // GATE-RESERVE-AUTO: a release-gate shard Job (`gate-<uuid>`, kind=command) reserves its Pod template's CPU
           // from creation until it is terminal — also while its Pod is still Pending or not created yet.
           if (meta.name.startsWith('gate-') && object(meta.labels)?.['elanous.kind'] === 'command') {
@@ -521,7 +631,8 @@ export function measurePoolLease(members: readonly PodPoolMember[], deps: { kube
           } else reservationsValid = false;
           const ownerJob = String(labels?.['elanous.job'] ?? labels?.['job-name'] ?? '');
           const gatePod = metadata?.namespace === 'elanous-test' && gateJobs.has(ownerJob);
-          const harness = metadata?.namespace === 'elanous-test' && labels?.['elanous.probe'] !== 'dns' && !gatePod &&
+          const commandPod = labels?.['elanous.kind'] === 'command' || commandJobs.has(ownerJob);
+          const harness = metadata?.namespace === 'elanous-test' && labels?.['elanous.probe'] !== 'dns' && !gatePod && !commandPod &&
             (labels?.['elanous.substrate'] === 'pod' || jobNames.has(String(labels?.['elanous.job'] ?? '')));
           const spec = object(pod.spec);
           let limit: number | null = null;
@@ -642,7 +753,7 @@ export function recommendConcurrency(measure: PoolLeaseMeasure, options: { capac
   if (goalBytes === null || goalBytes <= 0) return { ...empty, reason: '측정 불가: perGoalMemory' };
   const admission = admissionByUsage(measure, goalBytes, options.perGoalMemory !== undefined);
   if (!measure.members.length || measure.members.some((m) => m.running === null || m.pending === null || m.unleasedRunning === null || m.allocatableMemoryBytes === null || m.memoryLimitBytes === null || m.allocatableCpuMillicores === null || m.availableMemoryByNodeBytes === null)) {
-    debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended: null, limitedBy: null, capacity: options.capacity, capacitySlots: null, memorySlots: null, running: null, pending: null });
+    debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, requestMemory: siMemoryPolicy.requestMemory, admissionCapBytes: POD_SI_ADMISSION_CAP_BYTES, policySource: siMemoryPolicy.source, recommended: null, limitedBy: null, capacity: options.capacity, capacitySlots: null, memorySlots: null, running: null, pending: null });
     return { ...empty, reason: `측정 불가: cluster${measure.members.map((m) => m.reason ? ` ${m.context}: ${m.reason}` : '').join('')}` };
   }
   if (!Number.isSafeInteger(options.capacity) || options.capacity < 0) return { ...empty, reason: '측정 불가: capacity' };
@@ -694,7 +805,7 @@ export function recommendConcurrency(measure: PoolLeaseMeasure, options: { capac
     && m.reason !== 'dns' && m.running !== null && m.pending !== null && m.running + m.pending >= m.capacity);
   const limitedBy: PoolLeaseRecommendation['limitedBy'] = memoryBound < capacitySlots ? 'memory' : defaultCapFull ? 'pool-cap' : 'capacity';
   if (unleasedRunning > 0) debug.log('pod-lease', 'unleased', { unleasedRunning, running, recommended });
-  debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, recommended, limitedBy, capacity: options.capacity, capacitySlots, memorySlots, running, pending });
+  debug.log('pod-lease', 'admit-by-usage', { samples: admission.samples, p95Bytes: admission.p95Bytes, admitBytes: admission.admitBytes, fallback: admission.fallback, requestMemory: siMemoryPolicy.requestMemory, admissionCapBytes: POD_SI_ADMISSION_CAP_BYTES, policySource: siMemoryPolicy.source, recommended, limitedBy, capacity: options.capacity, capacitySlots, memorySlots, running, pending });
   return { recommended, limitedBy, reason: measure.members.some((m) => m.reason === 'dns') ? 'dns' : null, capacitySlots, memorySlots, liteMemorySlots, placeableSlots, accountSlots, running, pending, pendingJobs, unleasedRunning, admission };
 }
 
@@ -714,7 +825,8 @@ function admissionByUsage(measure: PoolLeaseMeasure, goalBytes: number, explicit
       : live.some((m) => m.harnessUsageBytes == null) ? (live.map((m) => m.harnessUsageBytes == null ? `${m.context}: ${m.usageReason ?? 'usage not measured'}` : '').filter(Boolean).join('; '))
         : p95Bytes === null ? 'no Running harness Pod usage samples'
           : null;
-  const admitBytes = fallback !== null || p95Bytes === null ? goalBytes
-    : Math.min(goalBytes, Math.max(requestBytes, Math.ceil(p95Bytes * POD_USAGE_HEADROOM)));
+  const observedBytes = p95Bytes === null ? null : Math.ceil(p95Bytes * POD_USAGE_HEADROOM);
+  const admitBytes = fallback !== null || observedBytes === null ? goalBytes
+    : Math.min(goalBytes, Math.max(requestBytes, POD_SI_ADMISSION_CAP_BYTES === null ? observedBytes : Math.min(observedBytes, POD_SI_ADMISSION_CAP_BYTES)));
   return { samples: samples.length, p95Bytes, admitBytes, fallback };
 }

package/src/task-orchestrator/surfaces/pod-ledger-events.ts

@@ -41,7 +41,7 @@ export function ledgerLineToLogEvent(line: string, runId: string): {
   const sources = [entry, details].filter((source): source is Record<string, unknown> => source !== undefined);
   const knownSecrets = secretValues(entry);
   const containsCredential = (value: string) => SECRET_VALUE.test(value) || knownSecrets.some((secret) => value.includes(secret));
-  if (containsCredential(entry.event) || !EVENT_ALLOWED.test(entry.event)) return undefined;
+  if (containsCredential(entry.event) || (!EVENT_ALLOWED.test(entry.event) && entry.event !== 'ask-auto-target-candidates' && entry.event !== 'ask-auto-reauthor')) return undefined;
 
   const data: Record<string, unknown> = { runId };
   let fields = 0;

package/src/task-orchestrator/surfaces/pod-lifecycle-stages.ts

@@ -0,0 +1,169 @@
+/**
+ * POD-LIFECYCLE-STAGES (P0 · Pod 재사용 기준선) — Pod 하나가 끝날 때 «어느 단계에 시간이 갔나»를 한 줄로 낸다.
+ *
+ * 계약: category `pod.lifecycle` · event `stages` ·
+ *   data `{ runId, podJob, host, kind, stages: [{ stage, start, end, clock }], outcome, missing }`.
+ *   - 시각은 epoch ms 하나로 통일한다(Pod 시계의 초 값은 ×1000).
+ *   - `clock` 은 그 값이 어느 시계에서 왔나 — `host`(이 프로세스) · `k8s`(API 서버 시각) · `pod`(Pod 안 `date +%s`) · `mixed`.
+ *   - ⛔ «0초»와 «못 잼»을 섞지 않는다: 시작·끝 둘 다 잰 단계만 `stages` 에 들어가고, 나머지는 이름만 `missing` 에 간다.
+ *     끝이 시작보다 앞서면(시계가 어긋났다) 그 단계도 지어내지 않고 `missing` 이다.
+ *
+ * 관측만 한다 — 판정·rc·파일을 바꾸지 않고, 내보내기가 실패해도 삼킨다.
+ */
+import { debug } from '../../debug/log.js';
+
+export const POD_LIFECYCLE_STAGES = ['create', 'schedule', 'clone', 'mirror', 'deps', 'test', 'delete'] as const;
+/** si-task Pod 은 시험이 아니라 `self implement`(또는 harness ask/say) 본체를 돈다 — 그 칸은 `test` 가 아니라 `run` 이다. */
+export const SI_TASK_POD_LIFECYCLE_STAGES = ['create', 'schedule', 'clone', 'mirror', 'deps', 'run', 'delete'] as const;
+export type PodLifecycleStageName = typeof POD_LIFECYCLE_STAGES[number] | typeof SI_TASK_POD_LIFECYCLE_STAGES[number];
+export type PodLifecycleClock = 'host' | 'k8s' | 'pod' | 'mixed';
+export type PodLifecycleKind = 'gate' | 'si-task';
+
+export interface PodLifecycleStage { stage: PodLifecycleStageName; start: number; end: number; clock: PodLifecycleClock }
+
+export interface PodLifecycleEvent {
+  runId: string | null;
+  podJob: string | null;
+  host: string | null;
+  kind: PodLifecycleKind;
+  stages: PodLifecycleStage[];
+  outcome: string;
+  missing: PodLifecycleStageName[];
+  [extra: string]: unknown;
+}
+
+type Measured = Partial<Record<PodLifecycleStageName, { start?: number; end?: number; clock: PodLifecycleClock }>>;
+
+/** ISO 문자열 → epoch ms (못 읽으면 undefined — 지어내지 않는다). */
+export function isoMs(value: string | undefined): number | undefined {
+  if (typeof value !== 'string') return undefined;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) ? ms : undefined;
+}
+
+/** Pod 시계의 epoch 초 → ms. */
+function podSecondsMs(value: number | undefined): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value * 1000 : undefined;
+}
+
+/** 잰 것만 stages 로, 나머지는 missing 으로 — 계약의 단계 순서대로. */
+export function splitPodLifecycleStages(measured: Measured, order: readonly PodLifecycleStageName[] = POD_LIFECYCLE_STAGES): { stages: PodLifecycleStage[]; missing: PodLifecycleStageName[] } {
+  const stages: PodLifecycleStage[] = [];
+  const missing: PodLifecycleStageName[] = [];
+  for (const name of order) {
+    const item = measured[name];
+    if (item && item.start !== undefined && item.end !== undefined && item.end >= item.start) stages.push({ stage: name, start: item.start, end: item.end, clock: item.clock });
+    else missing.push(name);
+  }
+  return { stages, missing };
+}
+
+/**
+ * gate shard Pod — `pod-N.json` 에 쓰는 바로 그 값(phaseTimes · podStages · podLifecycle)에서 단계를 고른다.
+ * - create   = 풀 자리 배정(없으면 입장 끝 · host) → Pod 생성(k8s)
+ * - schedule = Pod 생성 → PodScheduled (k8s)
+ * - clone    = 자식 컨테이너 PID 1(prep-start) → 셸 첫 줄(clone-end) (pod)
+ * - deps     = deps-start → deps-end (pod) · test = test-start → test-end (pod)
+ * - mirror · delete = gate 는 Pod 별로 재지 않는다 → 늘 missing.
+ */
+export function gatePodLifecycleStages(input: {
+  phaseTimes?: Readonly<Record<string, string>>;
+  podStages?: Readonly<Record<string, number>>;
+  podLifecycle?: Readonly<Record<string, string>>;
+}): { stages: PodLifecycleStage[]; missing: PodLifecycleStageName[] } {
+  const phase = input.phaseTimes ?? {};
+  const pod = input.podStages ?? {};
+  const k8s = input.podLifecycle ?? {};
+  return splitPodLifecycleStages({
+    create: { start: isoMs(phase.poolPlaced) ?? isoMs(phase.admissionEnd), end: isoMs(k8s.podCreated), clock: 'mixed' },
+    schedule: { start: isoMs(k8s.podCreated), end: isoMs(k8s.podScheduled), clock: 'k8s' },
+    clone: { start: podSecondsMs(pod['prep-start']), end: podSecondsMs(pod['clone-end']), clock: 'pod' },
+    deps: { start: podSecondsMs(pod['deps-start']), end: podSecondsMs(pod['deps-end']), clock: 'pod' },
+    test: { start: podSecondsMs(pod['test-start']), end: podSecondsMs(pod['test-end']), clock: 'pod' },
+  });
+}
+
+/** gate shard 의 끝 — 판정 코드와 같은 순서(잡 실패 → 정지 → 시간 초과 → 판정 없음 → rc). */
+export function gatePodOutcome(o: { jobFailed: boolean; stalled: boolean; timedOut: boolean; rc: number | undefined }): string {
+  if (o.jobFailed) return 'job-failed';
+  if (o.stalled) return 'stall';
+  if (o.timedOut) return 'timeout';
+  if (o.rc === undefined) return 'no-verdict';
+  return o.rc === 0 ? 'pass' : 'fail';
+}
+
+export function gatePodLifecycleEvent(input: {
+  runId?: string | null;
+  podJob?: string | null;
+  host?: string | null;
+  shard: string;
+  attemptId?: string;
+  phaseTimes?: Readonly<Record<string, string>>;
+  podStages?: Readonly<Record<string, number>>;
+  podLifecycle?: Readonly<Record<string, string>>;
+  outcome: string;
+}): PodLifecycleEvent {
+  const { stages, missing } = gatePodLifecycleStages(input);
+  return { runId: input.runId ?? null, podJob: input.podJob ?? null, host: input.host ?? null, kind: 'gate', stages, outcome: input.outcome, missing,
+    shard: input.shard, ...(input.attemptId ? { attemptId: input.attemptId } : {}) };
+}
+
+/** si-task Pod 셸이 찍는 단계 표지 — `ELANOUS_POD_STAGE <stage> <start|end> <epoch초>` (Pod 시계 · `date +%s`). */
+/** Pod 셸이 실제로 표지를 찍는 단계만 — deps 는 si-task Job 에 설치 단계가 없어 읽지도 않는다(늘 missing). */
+const SI_TASK_MARKED_STAGES = ['clone', 'mirror', 'run'] as const;
+export type SiTaskMarkedStage = typeof SI_TASK_MARKED_STAGES[number];
+
+/** Pod 셸 한 줄 — 단계 경계에서 Pod 시계(초)를 찍는다. 실패해도 셸을 끊지 않는다(`|| true`). */
+export function siTaskPodStageShell(stage: SiTaskMarkedStage, edge: 'start' | 'end'): string {
+  return `printf 'ELANOUS_POD_STAGE ${stage} ${edge} %s\\n' "$(date +%s)" || true`;
+}
+const SI_TASK_STAGE_LINE = /^ELANOUS_POD_STAGE (clone|mirror|run) (start|end) (\d{1,12})\r?$/gm;
+
+/**
+ * Job 로그에서 단계 표지를 읽는다 → `{ 'clone-start': 초, 'clone-end': 초, … }` (gate 의 podStages 와 같은 꼴).
+ * 같은 표지가 두 번 나오면 «첫» 값 — 셸 표지는 모두 자식 출력(`cat /tmp/si.out`)보다 앞에 찍히므로, 자식이 같은 모양의 줄을
+ * 내도 셸 값을 덮지 못한다(리뷰 should-fix). 모르는 단계·꼴은 버린다(지어내지 않는다).
+ */
+export function parseSiTaskPodStages(logs: string | undefined): Record<string, number> {
+  const out: Record<string, number> = {};
+  if (!logs) return out;
+  for (const match of logs.matchAll(SI_TASK_STAGE_LINE)) {
+    const key = `${match[1]}-${match[2]}`;
+    if (!(key in out)) out[key] = Number(match[3]);
+  }
+  return out;
+}
+
+/**
+ * si-task Pod — Pod 셸이 찍은 단계 표지(`parseSiTaskPodStages`)로 clone · mirror · deps · run 을 채운다(pod 시계).
+ * - clone  = 소스 받기(`podSourceScript`) 시작 → 그 스크립트 전체가 끝난 뒤(`cd repo` 포함 · 어느 줄에서든 exit 하면 끝이 없다 → missing)
+ * - mirror = 호스트 미러 `clone --shared` 시도 → 성공(미러를 건너뛰면 끝이 없다 → missing)
+ * - deps   = si-task Job 셸엔 의존성 설치 단계가 없다 → 표지를 읽지 않는다(`deps` 표지 줄이 있어도 늘 missing)
+ * - run    = 본체(`self implement` · `harness ask`/`say`) 띄움 → `wait` 가 돌아옴(SIGTERM 이면 끝이 없다 → missing)
+ * - create · schedule · delete = 호스트가 잴 값이 없다 → missing.
+ * 호스트가 지켜본 구간은 단계가 아닌 `watch`(host 시계)로 따로 싣는다 — 단계로 지어내지 않는다.
+ */
+export function siTaskPodLifecycleEvent(input: {
+  runId?: string | null;
+  podJob: string;
+  host?: string | null;
+  watchStart?: number;
+  watchEnd?: number;
+  podStages?: Readonly<Record<string, number>>;
+  outcome: string;
+}): PodLifecycleEvent {
+  const pod = input.podStages ?? {};
+  const measured: Measured = {};
+  for (const name of SI_TASK_MARKED_STAGES) measured[name] = { start: podSecondsMs(pod[`${name}-start`]), end: podSecondsMs(pod[`${name}-end`]), clock: 'pod' };
+  const { stages, missing } = splitPodLifecycleStages(measured, SI_TASK_POD_LIFECYCLE_STAGES);
+  const watched = input.watchStart !== undefined && input.watchEnd !== undefined && Number.isFinite(input.watchStart) && Number.isFinite(input.watchEnd) && input.watchEnd >= input.watchStart;
+  return { runId: input.runId ?? null, podJob: input.podJob, host: input.host ?? null, kind: 'si-task', stages, outcome: input.outcome, missing,
+    ...(watched ? { watch: { start: input.watchStart, end: input.watchEnd, clock: 'host' as const } } : {}) };
+}
+
+export type PodLifecycleLog = (category: string, event: string, data: Record<string, unknown>) => void;
+
+/** 한 줄 낸다 — 관측은 fail-soft(판정 경로를 절대 깨지 않는다). */
+export function emitPodLifecycle(event: PodLifecycleEvent, log: PodLifecycleLog = (category, name, data) => debug.log(category, name, data)): void {
+  try { log('pod.lifecycle', 'stages', event); } catch { /* observation is fail-soft */ }
+}

package/src/task-orchestrator/surfaces/pod-mirror-seed.ts

@@ -72,5 +72,32 @@ export function seedMirrorOnce(o: { host: string; commit: string; cwd: string; p
   return pending;
 }
 
+/**
+ * SI-SEED-DEFAULT — a default-source si-task Job (main HEAD, or `--base <branch>`) has no pinned sha, so the host resolves
+ * the branch tip once (`git ls-remote`, bounded) and makes sure the seeding tree has that commit (a bounded fetch of that
+ * one sha when it does not — objects only, no ref is moved). Never throws: a miss returns `reason` and the caller skips
+ * the seed (best effort — the Job keeps its GitHub path).
+ */
+export async function resolveDefaultSourceHead(o: { repoUrl: string; base?: string; cwd: string; git?: Push; limitMs?: number }): Promise<{ sha?: string; reason?: string }> {
+  const git = o.git ?? gitWithin;
+  const limitMs = o.limitMs ?? 30_000;
+  const base = o.base || 'main';
+  if (base.startsWith('-') || !/^[\w./-]+$/.test(base) || o.repoUrl.startsWith('-')) return { reason: 'invalid-ref' };
+  try {
+    const listed = await git(['ls-remote', '--', o.repoUrl, `refs/heads/${base}`], o.cwd, limitMs);
+    if (listed.rc !== 0) return { reason: 'ls-remote-failed' };
+    // Only the exact ref asked for — never the first `refs/heads/*` line (a branch named `a/refs/heads/main` must not pass).
+    const want = `refs/heads/${base}`;
+    const sha = listed.output.split(/\r?\n/).map((line) => line.split('\t')).find(([hash, ref]) => ref === want && /^[0-9a-f]{40}$/.test(hash ?? ''))?.[0];
+    if (!sha) return { reason: 'ls-remote-no-sha' };
+    if ((await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0) return { sha };
+    const fetched = await git(['fetch', '--quiet', '--no-write-fetch-head', '--', o.repoUrl, sha], o.cwd, GATE_MIRROR_SEED_LIMIT_MS);
+    if (fetched.rc !== 0) return { reason: 'commit-fetch-failed' };
+    return (await git(['cat-file', '-e', `${sha}^{commit}`], o.cwd, limitMs)).rc === 0 ? { sha } : { reason: 'commit-not-local' };
+  } catch {
+    return { reason: 'resolve-threw' };
+  }
+}
+
 /** Test seam — forget the per-process seed memo. */
 export function resetMirrorSeedMemo(): void { seeded.clear(); }

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -474,7 +474,7 @@ export class PodPoolScheduler {
    * member the 0.2.15 gate launched its shards one at a time.
    * Ties keep the configured member order. Returns null when every readable member is full.
    */
-  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; onPlacement?: (placement: PodPlacement) => void } = {}): Promise<PodPoolMember | null> {
+  async tryAcquire(skip?: ReadonlySet<string>, onEmpty?: (reason: string) => void, mode: { selfCapped?: boolean; kind?: PodPlacementKind | null; onPlacement?: (placement: PodPlacement) => void; signal?: AbortSignal } = {}): Promise<PodPoolMember | null> {
     const selfCapped = mode.selfCapped === true;
     const kind = mode.kind ?? null;
     // POOL-LITE: lite goals try the small member first, implementation goals the big one; full → overflow by free share.
@@ -487,6 +487,8 @@ export class PodPoolScheduler {
       const reason = error instanceof Error ? error.message : String(error);
       reading = Object.fromEntries(this.members.map((m) => [m.context, { occupied: null, reason }]));
     }
+    // A caller may abandon a slow occupancy read. Never acquire its lease after cancellation.
+    if (mode.signal?.aborted) throw mode.signal.reason ?? new Error('pod pool acquisition aborted');
     const free: Record<string, number> = {};
     const measured: Record<string, boolean> = {};
     let best: { member: PodPoolMember; slots: number; measured: boolean; preferred: boolean } | null = null;

package/src/task-orchestrator/surfaces/pod-result-marker-wait.ts

@@ -0,0 +1,33 @@
+// TA-POD-WARMBOOT-PARITY (10-15) — the Pod result marker (GATE-POD-RESULT-MARKER · #27815) for Jobs that do not go
+// through runPodCommand (the si-task Job in self-implement-pod.ts).
+//
+// S: runPodCommand prints `\n<marker> <launch> rc=<n>\n` as the child's last line and ends its wait on it when the Job
+//    condition lags (k3d). The si-task Job builds its own manifest and waits only on the condition.
+// A: reuse the marker format and split from pod-command-job.ts (no second format), and keep the one-poll judgement
+//    («no condition yet → read the tail → this launch's marker? → rc») as a pure function here.
+// ⚠️ pod-command-job.ts imports self-implement-pod.ts statically, so self-implement-pod.ts loads this module with a
+//    dynamic import only (a static import back would hit the TDZ of the cycle).
+// Later (after T1): runPodCommand's own loop can call podResultMarkerRc too.
+import { podResultMarker, splitPodResultMarker } from './pod-command-job.js';
+
+
+/** The child's final shell line: prints this launch's marker with the child rc (same bytes runPodCommand's child prints).
+ *  null when the token is not a plain id (`[A-Za-z0-9_.:-]+`) — the Job then runs without a marker (condition path only). */
+export function podResultMarkerShellLine(token: string): string | null {
+  if (!/^[\w.:-]+$/.test(token)) return null;
+  return `printf '\\n%s rc=%s\\n' '${podResultMarker(token)}' "$rc"`;
+}
+
+/**
+ * One poll, condition not there yet: the `kubectl logs … --tail=2` result → this launch's rc, or null.
+ * A failed read (Pod pending · init container), another launch's marker, or a bare marker word is null (keep waiting).
+ */
+export function podResultMarkerRc(tail: { status: number | null; stdout: string }, token: string): number | null {
+  if (tail.status !== 0) return null;
+  return splitPodResultMarker(tail.stdout.startsWith('\n') ? tail.stdout : `\n${tail.stdout}`, token).rc;
+}
+
+/** Remove this launch's marker tail from the child logs before they are parsed (other bytes unchanged). */
+export function stripPodResultMarker(logs: string, token: string): string {
+  return splitPodResultMarker(logs, token).logs;
+}