elanous 0.2.38 → 0.2.40

package/src/self-implement/gate-remote.ts

@@ -97,6 +97,7 @@ export function remoteSelfGateArgv(input: {
   shardConcurrency?: number;
   fixedShardDistribution?: boolean;
   includeImporters?: boolean;
+  noInherit?: boolean;
   artifactDir?: string;
 }, sha: (ref: string) => string): string[] {
   const shards = input.shards ?? (input.includeImporters ? 2 : undefined);
@@ -106,6 +107,7 @@ export function remoteSelfGateArgv(input: {
     ...(input.shardConcurrency !== undefined ? ['--shard-concurrency', String(input.shardConcurrency)] : []),
     ...(input.fixedShardDistribution ? ['--fixed-shard-distribution'] : []),
     ...(input.includeImporters ? ['--include-importers'] : []),
+    ...(input.noInherit ? ['--no-inherit'] : []),
     ...(input.artifactDir ? ['--artifact-dir', input.artifactDir] : [])];
 }
 
@@ -131,6 +133,8 @@ export function decideGateDispatch(input: { flags: Pick<GateRemoteFlags, 'remote
 
 export const SLOT_DIR = '/tmp/elanous-gate-remote-slots';
 const BUSY = '__GATE_REMOTE_BUSY';
+const HEARTBEAT = '__GATE_REMOTE_HEARTBEAT=';
+const REMOTE_RUN_LIMIT_SECONDS = 105 * 60;
 
 /** Shell lines that run "$W/run.sh" under the first free of `cap` slot locks, or print the busy marker and exit 98.
  *  run.sh must create "$W/started" first: that is how a lock refusal is told apart from the run's own exit code. */
@@ -138,14 +142,14 @@ export type SlotLockTool = 'flock' | 'lockf';
 const SLOT_LOCK = { flock: 'flock -n', lockf: 'lockf -k -s -t 0' } as const;
 
 /** `tools` is the preference order (default: Linux flock, then BSD/macOS lockf); a test can pin one path. */
-function hostSlotScriptWithSlot(cap: number, dir: string, tools: readonly SlotLockTool[], passSlot: boolean): string[] {
+function hostSlotScriptWithSlot(cap: number, dir: string, tools: readonly SlotLockTool[], passSlot: boolean, supervised = false): string[] {
   const n = Math.min(MAX_HOST_CAP, Math.max(1, Math.floor(cap)));
   const pick = tools.map((tool, i) => `${i ? 'elif' : 'if'} command -v ${tool} >/dev/null 2>&1; then GL="${SLOT_LOCK[tool]}"; `).join('');
   return [
     `GS=${quote(dir)}; mkdir -p "$GS" || infra slots`,
     `${pick}else infra lock-tool; fi`,
     'load1() { if [ -r /proc/loadavg ]; then awk \'NR==1 {print $1}\' /proc/loadavg; elif command -v sysctl >/dev/null 2>&1; then sysctl -n vm.loadavg 2>/dev/null | awk \'{gsub(/[{}]/, ""); print $1}\'; else echo unknown; fi; }',
-    `n=1; while [ $n -le ${n} ]; do $GL "$GS/slot$n" ${passSlot ? 'env GATE_REMOTE_SLOT="$n" ' : ''}sh "$W/run.sh"; s=$?; [ -f "$W/started" ] && exit $s; n=$((n+1)); done`,
+    `n=1; while [ $n -le ${n} ]; do $GL "$GS/slot$n" ${passSlot ? 'env GATE_REMOTE_SLOT="$n" ' : ''}sh "$W/${supervised ? 'supervise.sh' : 'run.sh'}"; s=$?; ${supervised ? '[ -f "$W/supervisor-timeout" ] && infra run-timeout; [ -f "$W/supervisor-infra" ] && infra supervisor-lost; ' : ''}[ -f "$W/started" ] && exit $s; n=$((n+1)); done`,
     `echo "${BUSY}=$((n-1));load1=$(load1)" >&2; exit 98`,
   ];
 }
@@ -154,6 +158,53 @@ export function hostSlotScript(cap: number, dir = SLOT_DIR, tools: readonly Slot
   return hostSlotScriptWithSlot(cap, dir, tools, false);
 }
 
+/** A slot holder owns exactly one new process group. On a lost SSH shell or wall limit it signals only that group,
+ *  after checking its unreaped direct child's PGID. The heartbeat also detects a severed SSH output pipe while
+ *  a silent test is running; runOnRemote removes only these transport lines from the tool's stderr. */
+export function remoteSupervisorScript(limitSeconds = REMOTE_RUN_LIMIT_SECONDS): string {
+  const limit = Number.isSafeInteger(limitSeconds) && limitSeconds > 0 ? limitSeconds : REMOTE_RUN_LIMIT_SECONDS;
+  return [
+    '#!/bin/sh',
+    'child=',
+    'ready=0',
+    'owned_group() {',
+    '  [ -n "$child" ] && kill -0 "$child" 2>/dev/null && [ "$(ps -p "$child" -o pgid= 2>/dev/null | tr -d " ")" = "$child" ] || return 1',
+    '}',
+    'reap() {',
+    // Our direct child stays unreaped until the caller waits, so its PID/PGID cannot be reused here.
+    '  [ "$ready" -eq 1 ] && owned_group || return 0',
+    '  kill -TERM -- "-$child" 2>/dev/null || kill -TERM "-$child" 2>/dev/null || :',
+    '  sleep 2',
+    // The leader remains our unreaped child until the caller waits, so its PGID cannot be reused here. A TERM-ignoring
+    // grandchild may outlive the leader; rechecking only the leader would miss that member of the same owned group.
+    '  kill -KILL -- "-$child" 2>/dev/null || kill -KILL "-$child" 2>/dev/null || :',
+    '}',
+    'trap \'reap\' HUP INT TERM EXIT',
+    'perl -MPOSIX -e \'POSIX::setpgid(0,0) == 0 or die "setpgid: $!"; exec @ARGV\' sh "$W/run.sh" &',
+    'child=$!',
+    // Set this only after spawning the worker so the worker keeps its normal SIGPIPE behavior.
+    'trap \'\' PIPE',
+    // The SSH parent can disappear before the child has called setpgid. Wait briefly for the ownership proof first.
+    'ready=0; attempt=0',
+    'while [ "$attempt" -lt 20 ] && kill -0 "$child" 2>/dev/null; do',
+    '  if owned_group; then ready=1; break; fi',
+    '  attempt=$((attempt+1)); sleep 1',
+    'done',
+    'if [ "$ready" -eq 0 ] && kill -0 "$child" 2>/dev/null; then kill -TERM "$child" 2>/dev/null || :; wait "$child" 2>/dev/null || :; : > "$W/supervisor-infra"; exit 125; fi',
+    'started=$(date +%s)',
+    'while kill -0 "$child" 2>/dev/null; do',
+    '  if [ "$(($(date +%s) - started))" -ge ' + limit + ' ]; then reap; wait "$child" 2>/dev/null || :; : > "$W/supervisor-timeout"; exit 124; fi',
+    '  if ! kill -0 "$GATE_REMOTE_SSH_SHELL" 2>/dev/null; then reap; wait "$child" 2>/dev/null || :; : > "$W/supervisor-infra"; exit 125; fi',
+    '  if ! printf "\\n' + HEARTBEAT + '%s\\n" "$W" >&2; then reap; wait "$child" 2>/dev/null || :; : > "$W/supervisor-infra"; exit 125; fi',
+    '  sleep 5',
+    'done',
+    'wait "$child"; rc=$?',
+    'trap - HUP INT TERM EXIT',
+    'exit "$rc"',
+    '',
+  ].join('\n');
+}
+
 // ── remote execution ───────────────────────────────────────────────
 
 export interface ExecResult { rc: number | null; stdout: string; stderr: string; error?: string }
@@ -217,7 +268,7 @@ export interface PayloadFile { env: string; content: string }
 export type RemoteArgv = string[] | ((sha: (ref: string) => string) => string[]);
 
 /** Build the remote shell script (exported for tests). Every setup failure ends in an INFRA marker, the tool's rc in an RC marker. */
-export function remoteScript(input: { mirror: string; commit: string; fetchShas: string[]; mainSha?: string; argv: string[]; installPwa: boolean; stableCheckout?: boolean; payloadFiles?: PayloadFile[]; hostCap?: number; slotDir?: string }): string {
+export function remoteScript(input: { mirror: string; commit: string; fetchShas: string[]; mainSha?: string; argv: string[]; installPwa: boolean; stableCheckout?: boolean; payloadFiles?: PayloadFile[]; hostCap?: number; slotDir?: string; runLimitSeconds?: number }): string {
   const mirror = input.mirror.startsWith('~/') ? `"$HOME"/${quote(input.mirror.slice(2))}` : quote(input.mirror);
   const fetches = input.fetchShas.map((sha) => `refs/elanous/gate/${sha}:refs/elanous/gate/${sha}`).join(' ');
   const payloads = (input.payloadFiles ?? []).filter((file) => /^[A-Z_][A-Z0-9_]*$/.test(file.env));
@@ -280,11 +331,16 @@ export function remoteScript(input: { mirror: string; commit: string; fetchShas:
     'W=$(mktemp -d /var/tmp/elanous-gate-remote-XXXXXXXX) || infra mktemp',
     'export W',
     'trap \'rm -rf "$W"\' EXIT',
+    'command -v perl >/dev/null 2>&1 && command -v ps >/dev/null 2>&1 || infra supervisor-tool',
+    'GATE_REMOTE_SSH_SHELL=$$; export GATE_REMOTE_SSH_SHELL',
     ...payloadLines,
     `cat > "$W/run.sh" <<'${RUN}' || infra run-script`,
     ...work,
     RUN,
-    ...hostSlotScriptWithSlot(input.hostCap ?? GATE_REMOTE_DEFAULTS.hostCap, input.slotDir ?? SLOT_DIR, ['flock', 'lockf'], !!input.stableCheckout),
+    'cat > "$W/supervise.sh" <<\'__GATE_REMOTE_SUPERVISE__\' || infra supervise-script',
+    remoteSupervisorScript(input.runLimitSeconds),
+    '__GATE_REMOTE_SUPERVISE__',
+    ...hostSlotScriptWithSlot(input.hostCap ?? GATE_REMOTE_DEFAULTS.hostCap, input.slotDir ?? SLOT_DIR, ['flock', 'lockf'], !!input.stableCheckout, true),
     '}',
     '',
   ].join('\n');
@@ -340,11 +396,22 @@ export function runOnRemote(opts: RemoteRunOptions, runner: GateRemoteRunner = r
     env: { ...process.env, GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o ConnectTimeout=10', GIT_TERMINAL_PROMPT: '0' },
   });
   if (push.rc !== 0 || push.error) return { kind: 'infra', stage: 'push', rc: push.rc, stderr: push.stderr || push.error || '', reason: `push-failed rc=${push.rc}: ${(push.stderr || push.error || '').trim().split('\n').slice(-2).join(' | ')}` };
-  const script = remoteScript({ mirror: opts.mirror, commit, fetchShas: shas, mainSha, argv, installPwa: opts.installPwa ?? false, stableCheckout: opts.stableCheckout, payloadFiles: opts.payloadFiles, hostCap: opts.hostCap, slotDir: opts.slotDir });
-  const run = runner.ssh(opts.host, script, opts.timeoutMs ?? 120 * 60_000);
+  const sshTimeoutMs = opts.timeoutMs ?? 120 * 60_000;
+  const script = remoteScript({ mirror: opts.mirror, commit, fetchShas: shas, mainSha, argv, installPwa: opts.installPwa ?? false, stableCheckout: opts.stableCheckout, payloadFiles: opts.payloadFiles, hostCap: opts.hostCap, slotDir: opts.slotDir,
+    runLimitSeconds: Math.min(REMOTE_RUN_LIMIT_SECONDS, Math.max(1, Math.floor((sshTimeoutMs - 30_000) / 1000))) });
+  const run = runner.ssh(opts.host, script, sshTimeoutMs);
   // The script prints "\n<marker><rc>\n": everything before that leading newline is the tool's own stderr, byte for byte.
   const stdoutBytes = Buffer.from(run.stdout);
-  const stderrBytes = Buffer.from(run.stderr);
+  const rawStderr = Buffer.from(run.stderr);
+  // Transport heartbeats may arrive after the RC marker when a short run races the supervisor's final poll.
+  // Strip only complete, run-scoped heartbeat lines as bytes so arbitrary tool stderr stays byte-identical.
+  const heartbeatLine = /\n__GATE_REMOTE_HEARTBEAT=\/var\/tmp\/elanous-gate-remote-[A-Za-z0-9]+\n/g;
+  const heartbeatRanges = [...rawStderr.toString('latin1').matchAll(heartbeatLine)].map((match) => [match.index!, match.index! + match[0].length] as const);
+  let previous = 0;
+  const kept: Buffer[] = [];
+  for (const [from, to] of heartbeatRanges) { kept.push(rawStderr.subarray(previous, from)); previous = to; }
+  kept.push(rawStderr.subarray(previous));
+  const stderrBytes = Buffer.concat(kept);
   const stderrText = stderrBytes.toString('utf8');
   const marker = stderrBytes.lastIndexOf(Buffer.from(`\n${RC}`));
   // Busy (98) and setup failure (97) are the script's own exits, each with its marker as the last stderr line. A completed
@@ -450,6 +517,11 @@ export interface DispatchOptions {
   reportRemoteHost?: boolean;
   /** Release gate host reservations shared by self gate and changed typecheck. */
   reservationRoot?: string;
+  /** Self gate only: hosts to try when the first host holds a release reservation (default: `host-e-wsl` for
+   *  `node-b`, the same alternative the unmeasured hint names — a reservation is never a local fallback). */
+  reservationAltHosts?: string[];
+  /** Self gate only: bounded wait for the reservation release, in seconds (default: `settings.slotWaitSeconds`). */
+  reservationWaitSeconds?: number;
   runLocal: () => number | Promise<number>;
   /** Called once with the final remote outcome (never on a local decision), before its output passes through or the
    *  local fallback runs — e.g. `self gate --artifact-dir` fetches (ran) or removes (infra) the host-side artifact dir.
@@ -469,6 +541,26 @@ export interface DispatchDeps {
   write?: { out: (data: string | Uint8Array) => void; err: (data: string | Uint8Array) => void };
 }
 
+/** Hosts a reserved self gate may fall back to: an explicit list wins, otherwise `node-b` (the only host the old
+ *  unmeasured hint named an alternative for) falls back to `host-e-wsl`. Invalid or duplicate entries are dropped. */
+export function gateReservationAlternateHosts(reservedHost: string, explicit?: string[]): string[] {
+  const candidates = explicit ?? (reservedHost === 'node-b' ? ['host-e-wsl'] : []);
+  const seen = new Set<string>([reservedHost]);
+  const hosts: string[] = [];
+  for (const candidate of candidates) {
+    if (!candidate || seen.has(candidate) || !isValidGateHost(candidate)) continue;
+    seen.add(candidate);
+    hosts.push(candidate);
+  }
+  return hosts;
+}
+
+/** Reservation diagnostics stamp — ISO 시각 printed next to the claim owner (runId). Claims written before
+ *  `reservedAt` existed fall back to the gate's own observation time. */
+export function formatReservationStamp(ms: number): string {
+  return new Date(ms).toISOString();
+}
+
 async function loadSettings(): Promise<GateRemoteSettings> {
   try {
     const { getUserConfig } = await import('../user-config.js');
@@ -498,26 +590,59 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
     return opts.runLocal();
   }
   let host = decision.host!;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
   const reservationRoot = opts.tool === 'self-gate' || opts.tool === 'ci-typecheck-changed'
     ? opts.reservationRoot ?? (deps.runner ? undefined : gateHostReservationRoot()) : undefined;
   if (reservationRoot) {
     const reservationHost = host.split('@').at(-1)!;
     const first = inspectReleaseGateHost(reservationRoot, reservationHost);
     if (first.status !== 'free') {
-      // Changed typecheck has a fixed node-b placement; a release reservation makes it unmeasured.
-      const alternate = opts.tool === 'self-gate' && reservationHost === 'node-b' ? 'node-c' : null;
-      const other = alternate ? inspectReleaseGateHost(reservationRoot, alternate) : null;
-      if (alternate && other?.status === 'free') {
-        debug.log('gate.remote', 'host-reserved-reroute', { from: host, to: alternate, reason: first.reason, status: first.status });
-        write.err(`[gate.remote] ${host} reserved (${first.reason}) — using ${alternate}\n`);
-        host = alternate;
+      // A reserved host is never a reason to run this check locally (반증: 예약 상태에서 --local 무거운 시험 금지).
+      // Self gate first tries another remote host, then waits bounded for the release, then ends unmeasured with
+      // the owner and the observation stamp.
+      const observedAt = formatReservationStamp(now());
+      const owner = first.runId || 'unknown';
+      // Owner (runId) plus 시각: the claim's own reservedAt when recorded, else the moment this gate observed it.
+      const stamp = first.reservedAt !== undefined
+        ? `reserved-at=${formatReservationStamp(first.reservedAt)}`
+        : `observed-at=${observedAt}`;
+      const alternates = opts.tool === 'self-gate'
+        ? gateReservationAlternateHosts(reservationHost, opts.reservationAltHosts) : [];
+      const alternate = alternates.find((candidate) => inspectReleaseGateHost(reservationRoot, candidate).status === 'free');
+      if (alternate) {
+        const rerouted = host.includes('@') ? `${host.slice(0, host.lastIndexOf('@'))}@${alternate}` : alternate;
+        debug.log('gate.remote', 'host-reserved-reroute', { tool: opts.tool, from: host, to: rerouted, owner, reason: first.reason, reservedAt: first.reservedAt, observedAt });
+        write.err(`[gate.remote] host-reserved: ${host} (${first.reason}) owner=${owner} ${stamp} — rerouting to ${rerouted}\n`);
+        host = rerouted;
       } else {
-        const reason = `host-reserved: ${host} (${first.reason}); alternate ${alternate ?? '(none)'} ${other?.status ?? 'unavailable'}`;
-        debug.log('gate.remote', 'host-reserved-unmeasured', { host, reason });
-        write.err(opts.tool === 'self-gate'
-          ? `[gate.remote] remote unmeasured on ${host} (stage=host-reserved, rc=unknown) — ${reason}\n`
-          : `[gate.remote] remote unmeasured — ${reason}\n`);
-        return 1;
+        const waitSeconds = opts.tool === 'self-gate' ? opts.reservationWaitSeconds ?? settings.slotWaitSeconds : 0;
+        const waitStart = now();
+        const deadline = waitStart + Math.max(0, waitSeconds) * 1000;
+        let latest = inspectReleaseGateHost(reservationRoot, reservationHost);
+        while (waitSeconds > 0 && latest.status !== 'free') {
+          const left = deadline - now();
+          if (left <= 0) break;
+          write.err(`[gate.remote] waiting for host-reserved release on ${host} — owner=${owner} ${stamp} elapsed=${Math.floor(Math.max(0, now() - waitStart) / 1000)}s/${waitSeconds}s\n`);
+          const before = now();
+          await sleep(Math.min(15_000, left));
+          if (now() <= before) break; // a frozen test clock must not spin past the bound
+          latest = inspectReleaseGateHost(reservationRoot, reservationHost);
+        }
+        const waitedMs = Math.max(0, now() - waitStart);
+        if (latest.status === 'free') {
+          debug.log('gate.remote', 'host-reserved-released', { tool: opts.tool, host, owner, waitedMs });
+          write.err(`[gate.remote] host-reserved released on ${host} after ${Math.floor(waitedMs / 1000)}s — proceeding remotely\n`);
+        } else {
+          const reason = `host-reserved: ${host} (${latest.reason})`;
+          const manualAlternative = reservationHost === 'node-b'
+            ? '; if available, non-PWA checks may explicitly select --remote host-e-wsl' : '';
+          debug.log('gate.remote', 'host-reserved-unmeasured', { host, reason, owner, reservedAt: latest.reservedAt ?? first.reservedAt, observedAt, waitedMs, alternates: alternates.length });
+          write.err(opts.tool === 'self-gate'
+            ? `[gate.remote] remote unmeasured on ${host} (stage=host-reserved, rc=unknown) — ${reason}; owner=${owner} ${stamp} waited=${Math.floor(waitedMs / 1000)}s${manualAlternative}\n`
+            : `[gate.remote] remote unmeasured — ${reason}\n`);
+          return 1;
+        }
       }
     }
   }
@@ -535,8 +660,6 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
   };
   if (opts.localOnlyReason) return fallback(opts.localOnlyReason, { stage: 'reproducibility', rc: null });
   const hostCap = gateRemoteHostCap(settings, host);
-  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
-  const now = deps.now ?? Date.now;
   const deadline = now() + settings.slotWaitSeconds * 1000;
   let waitStartedAt: number | undefined;
   const logWait = deps.log ?? ((event: string, data: Record<string, unknown>) => debug.log('gate.remote', event, data));

package/src/self-implement/goal-author-clarification.ts

@@ -50,6 +50,8 @@ export type GoalAuthorClarificationAnswerSource = 'injected' | 'recommended' | '
 export interface GoalAuthorClarificationProvenance {
   source: GoalAuthorClarificationAnswerSource;
   evidence?: string[];
+  assumption?: string;
+  assumptionSource?: 'resolver' | 'policy-default' | 'recommended';
 }
 
 export interface GoalAuthorClarificationResponse {
@@ -81,7 +83,7 @@ export interface GoalAuthorSelfResolutionContext {
 }
 
 export type GoalAuthorSelfResolution =
-  | { answer: string; evidence: readonly string[]; declined?: undefined }
+  | { answer: string; evidence: readonly string[]; assumption?: string; declined?: undefined }
   | { answer?: undefined; evidence?: undefined; declined?: boolean };
 
 export interface GoalAuthorClarificationResolutionDeps {
@@ -125,8 +127,8 @@ function truncateAsk(ask: string): string {
 function selfResolutionPrompt(context: GoalAuthorSelfResolutionContext): string {
   return [
     'Answer this goal-author clarification using only the supplied repository evidence.',
-    'Do not delegate to an implementation agent. If the evidence cannot justify one single-line answer, return {"answer":null}.',
-    'Return JSON only: {"answer":"..."} or {"answer":null}.',
+    'Do not delegate to an implementation agent. Choose the best supported candidate and state the assumption that makes it the best fit. If the evidence cannot justify one answer, return {"answer":null}.',
+    'Return JSON only: {"answer":"...","assumption":"..."} or {"answer":null}.',
     ...(context.ask?.trim() ? [`Request being authored:\n${truncateAsk(context.ask.trim())}`] : []),
     `Question: ${context.question}`,
     `Options: ${context.options.join(' | ') || '(free input)'}`,
@@ -195,22 +197,31 @@ export async function defaultGoalAuthorSelfResolve(
     return context.questionId === 'preservation_contract' ? { declined: true } : {};
   }
   const controller = new AbortController();
+  const prompt = selfResolutionPrompt(context);
+  let rejectTimeout!: (reason: Error) => void;
+  const timeoutPromise = new Promise<never>((_, reject) => { rejectTimeout = reject; });
   const timeout = setTimeout(
-    () => controller.abort(new Error(SELF_RESOLUTION_TIMEOUT_MESSAGE)),
+    () => {
+      const error = new Error(SELF_RESOLUTION_TIMEOUT_MESSAGE);
+      controller.abort(error);
+      rejectTimeout(error);
+    },
     selfResolutionTimeoutMs(deps.timeoutMs),
   );
-  const prompt = selfResolutionPrompt(context);
   const onUsage = (usage: LLMUsage) => { usages.push(usage); };
   try {
-    const result = await (deps.stream ?? (async (input, signal, reportUsage) => {
-      const { streamLLM } = await import('../llm.js');
-      return streamLLM([{ role: 'user', content: input }], () => {}, {
-        model: process.env.ELANOUS_GOAL_AUTHOR_MODEL || tierModel('better'),
-        reasoningEffort: 'high',
-        signal,
-        onUsage: reportUsage,
-      });
-    }))(prompt, controller.signal, onUsage);
+    const result = await Promise.race([
+      (deps.stream ?? (async (input, signal, reportUsage) => {
+        const { streamLLM } = await import('../llm.js');
+        return streamLLM([{ role: 'user', content: input }], () => {}, {
+          model: process.env.ELANOUS_GOAL_AUTHOR_MODEL || tierModel('better'),
+          reasoningEffort: 'high',
+          signal,
+          onUsage: reportUsage,
+        });
+      }))(prompt, controller.signal, onUsage),
+      timeoutPromise,
+    ]);
     let parsed: unknown;
     try {
       parsed = JSON.parse(result);
@@ -222,11 +233,15 @@ export async function defaultGoalAuthorSelfResolve(
       ? (parsed as { answer?: unknown }).answer
       : undefined;
     if (typeof answer === 'string') {
+      const assumptionValue = (parsed as { assumption?: unknown }).assumption;
+      const assumption = typeof assumptionValue === 'string' && assumptionValue.trim()
+        ? assumptionValue.trim()
+        : undefined;
       observeSelfResolve('self-resolve-answered', context, startedAt, {
         answerLength: answer.length,
         usage: deriveUsage(usages),
       });
-      return { answer, evidence: context.evidence };
+      return { answer, evidence: context.evidence, ...(assumption ? { assumption } : {}) };
     }
     observeSelfResolve('self-resolve-unanswered', context, startedAt, {
       reason: answer === null ? 'declined' : 'shape-mismatch',
@@ -281,7 +296,11 @@ function responseFor(clarification: IntakeClarification, observe = false, selfRe
     ...deferredResponse(clarification),
     answer: automaticAnswer,
     status: 'ANSWERED',
-    provenance: { source: 'recommended' },
+    provenance: {
+      source: 'recommended',
+      assumption: '저작기가 표시한 단일 recommended 후보를 우선 선택하는 정책을 적용한다',
+      assumptionSource: 'recommended',
+    },
   };
 }
 
@@ -331,11 +350,17 @@ export async function resolveGoalAuthorClarification(
     if (!answer || /[\r\n]/.test(answer) || evidence.length === 0) {
       return deterministic;
     }
+    const resolverAssumption = 'assumption' in resolution ? resolution.assumption?.trim() : undefined;
+    const assumption = resolverAssumption
+      || `정책 가정(resolver가 별도 가정을 생략함): 제공 근거와 요청에 가장 맞는 후보를 선택한다 (${answer})`;
     const response: GoalAuthorClarificationResponse = {
       ...deferredResponse(clarification),
       answer,
       status: 'ANSWERED',
-      provenance: { source: 'self-authored', evidence },
+      provenance: {
+        source: 'self-authored', evidence, assumption,
+        assumptionSource: resolverAssumption ? 'resolver' : 'policy-default',
+      },
     };
     observeGoalAuthor('goal-author.clarify', 'self-answered', {
       questionId: clarification.questionId,
@@ -407,31 +432,58 @@ function parseRecord(raw: string): SerializedGoalAuthorClarification | null {
       && Array.isArray(provenance.evidence)
       && provenance.evidence.length > 0
       && provenance.evidence.every((item) => typeof item === 'string' && item.length > 0);
+    const selfAuthoredAssumption = typeof provenance?.assumption === 'string' && provenance.assumption.trim()
+      ? provenance.assumption.trim()
+      : undefined;
     const response = isSelfAuthored
       ? {
         ...deferredResponse(value.clarification),
         answer: value.response.answer!,
         status: 'ANSWERED' as const,
-        provenance: { source: 'self-authored' as const, evidence: provenance.evidence },
+        provenance: {
+          source: 'self-authored' as const,
+          evidence: provenance.evidence,
+          ...(selfAuthoredAssumption ? { assumption: selfAuthoredAssumption } : {}),
+          ...(provenance.assumptionSource === 'resolver' || provenance.assumptionSource === 'policy-default'
+            ? { assumptionSource: provenance.assumptionSource }
+            : {}),
+        },
       }
       : expected;
     const responseProvenance = response.provenance;
     const serializedProvenance = value.response.provenance;
     const expectedProvenanceKeys = responseProvenance === undefined
       ? []
-      : responseProvenance.evidence === undefined ? ['source'] : ['evidence', 'source'];
+      : [
+        ...(responseProvenance.assumption === undefined ? [] : ['assumption']),
+        ...(responseProvenance.assumptionSource === undefined ? [] : ['assumptionSource']),
+        ...(responseProvenance.evidence === undefined ? [] : ['evidence']),
+        'source',
+      ];
     const serializedProvenanceKeys = serializedProvenance === undefined
       ? []
       : Object.keys(serializedProvenance).sort();
+    // Older serialized goal rows predate assumption provenance. Keep accepting those rows while
+    // still validating every field they actually contain; parsing upgrades them to the current
+    // deterministic response shape above.
+    const legacyAssumptionKeys = responseProvenance?.source === 'recommended'
+      ? ['assumption', 'assumptionSource']
+      : [];
+    const provenanceKeysMatch = (serializedProvenanceKeys.length === expectedProvenanceKeys.length
+      && expectedProvenanceKeys.every((key) => serializedProvenanceKeys.includes(key)))
+      || (legacyAssumptionKeys.length > 0
+        && expectedProvenanceKeys.filter((key) => !legacyAssumptionKeys.includes(key)).every((key) => serializedProvenanceKeys.includes(key))
+        && serializedProvenanceKeys.every((key) => expectedProvenanceKeys.includes(key)));
     const provenanceMatches = (serializedProvenance === undefined) === (responseProvenance === undefined)
-      && serializedProvenanceKeys.length === expectedProvenanceKeys.length
-      && serializedProvenanceKeys.every((key, index) => key === expectedProvenanceKeys[index])
+      && provenanceKeysMatch
       && serializedProvenance?.source === responseProvenance?.source
       && (responseProvenance?.evidence === undefined
         ? serializedProvenance?.evidence === undefined
         : Array.isArray(serializedProvenance?.evidence)
           && serializedProvenance.evidence.length === responseProvenance.evidence.length
-          && serializedProvenance.evidence.every((item, index) => item === responseProvenance.evidence?.[index]));
+          && serializedProvenance.evidence.every((item, index) => item === responseProvenance.evidence?.[index]))
+      && (serializedProvenance?.assumption === undefined || serializedProvenance.assumption === responseProvenance?.assumption)
+      && (serializedProvenance?.assumptionSource === undefined || serializedProvenance.assumptionSource === responseProvenance?.assumptionSource);
     if (value.response.questionId !== response.questionId
       || value.response.answer !== response.answer
       || value.response.status !== response.status
@@ -469,6 +521,21 @@ export interface GoalDocumentClarification {
   provenanceLines?: number[];
 }
 
+export type GoalClarificationDecisionCategory = 'money' | 'security' | 'irreversible';
+
+/** Only questions that could authorize money, security, or irreversible external effects need a decision card. */
+export function goalClarificationDecisionCategory(
+  clarification: Pick<GoalDocumentClarification, 'header' | 'question' | 'options'>,
+): GoalClarificationDecisionCategory | undefined {
+  const text = [clarification.header, clarification.question, ...clarification.options.flatMap((option) => [option.label, option.description])]
+    .join(' ')
+    .toLocaleLowerCase();
+  if (/\b(payment|purchase|spend|budget|credit|charge|price|cost|paid)\b|결제|구매|지출|예산|크레딧|과금|가격|비용/.test(text)) return 'money';
+  if (/\b(security|credential|token|secret|password|authorization|authentication|permission|access control)\b|보안|자격 증명|토큰|비밀키|비밀번호|인가|인증|권한/.test(text)) return 'security';
+  if (/\b(publish|publication|deploy|send|delete|release|irreversible|external side effect|production)\b|발행|게시|배포|전송|삭제|릴리스|되돌릴 수 없|외부 효과|운영 환경/.test(text)) return 'irreversible';
+  return undefined;
+}
+
 interface GoalAuthorClarificationSeed {
   ask: string;
   parent: GoalAuthorParent;
@@ -576,6 +643,17 @@ export function parseGoalDocumentClarifications(document: string): GoalDocumentC
         readingOptions = false;
         continue;
       }
+      const provenanceAssumption = /^  - provenance\.assumption: (.*)$/.exec(line);
+      if (provenanceAssumption) {
+        provenanceLines.push(index);
+        readingOptions = false;
+        continue;
+      }
+      if (/^  - provenance\.assumption-source: (resolver|policy-default|recommended)$/.test(line)) {
+        provenanceLines.push(index);
+        readingOptions = false;
+        continue;
+      }
       if (/^  - evidence: /.test(line)) {
         provenanceLines.push(index);
         readingOptions = false;
@@ -747,6 +825,7 @@ export async function selfAnswerGoalDocumentClarifications(
     evidence?: readonly string[];
     resolver?: GoalClarificationSelfResolver;
     runId?: string;
+    skipQuestionIds?: ReadonlySet<string>;
   },
 ): Promise<{ document: string; asked: number; answered: number; unanswered: number; newlyAnswered: number }> {
   const clarifications = parseGoalDocumentClarifications(document);
@@ -761,7 +840,7 @@ export async function selfAnswerGoalDocumentClarifications(
   const evidence = options.evidence ?? document.split(/\r?\n/)
     .filter((line) => /^(?:\s*- (?:\[code:|\[document:|TRACED PATHS|evidence:|Evidence:)|\s*-?\s*`?(?:src|test|scripts)\/[^\s`]+:\d+)/i.test(line))
     .slice(0, 40);
-  for (const item of pending) {
+  for (const item of pending.filter((entry) => !options.skipQuestionIds?.has(entry.questionId))) {
     if (parseGoalDocumentClarifications(updated).filter((entry) => entry.questionId === item.questionId).length !== 1) continue;
     let response: Awaited<ReturnType<typeof resolveGoalAuthorClarification>>;
     let declined = false;
@@ -789,7 +868,9 @@ export async function selfAnswerGoalDocumentClarifications(
     if (response.answer === null && item.questionId === 'preservation_contract'
       && declined) {
       const fallback = preservationDefault(options.ask ?? document);
-      response = { ...response, answer: fallback.answer, status: 'ANSWERED', provenance: { source: 'default' } };
+      response = { ...response, answer: fallback.answer, status: 'ANSWERED', provenance: {
+        source: 'default', assumption: '기존 공개 동작 보존을 기본 가정으로 적용한다', assumptionSource: 'policy-default',
+      } };
       defaultExportCount = fallback.exportCount;
     }
     if (response.answer === null || (response.provenance?.source !== 'self-authored' && response.provenance?.source !== 'default')
@@ -806,6 +887,8 @@ export async function selfAnswerGoalDocumentClarifications(
       lines[answerLine] = `  - answer: ${response.answer}`;
       lines.splice(answerLine + 1, 0,
         `  - provenance.source: ${answerSource}`,
+        ...(response.provenance.assumption ? [`  - provenance.assumption: ${response.provenance.assumption.replace(/[\r\n]/g, ' ')}`] : []),
+        ...(response.provenance.assumptionSource ? [`  - provenance.assumption-source: ${response.provenance.assumptionSource}`] : []),
         ...(response.provenance.evidence ?? []).map((entry) => `  - evidence: ${entry.replace(/[\r\n]/g, ' ')}`));
       updateWhatToBuildRenderAnswers(lines, item.questionId, response.answer);
       if (hasWhatToBuildUnansweredRenderAnswer(lines, item.questionId)) continue;
@@ -836,6 +919,77 @@ export async function selfAnswerGoalDocumentClarifications(
   return { document: updated, asked, answered, unanswered, newlyAnswered };
 }
 
+/** SelfImplement boundary: resolve pending questions itself and record a bounded policy assumption if that fails.
+ *  Interactive callers must not turn an authoring clarification into a human popup. */
+export async function selfAnswerOrAssumeGoalDocumentClarifications(
+  document: string,
+  options: Parameters<typeof selfAnswerGoalDocumentClarifications>[1],
+): Promise<Awaited<ReturnType<typeof selfAnswerGoalDocumentClarifications>> & {
+  assumed: number;
+  decisionRequired: Array<{ questionId: string; header: string; question: string; category: GoalClarificationDecisionCategory }>;
+}> {
+  const safetyQuestions = parseGoalDocumentClarifications(document).filter((entry) => !entry.answered)
+    .map((entry) => ({ entry, category: goalClarificationDecisionCategory(entry) }))
+    .filter((item): item is { entry: GoalDocumentClarification; category: GoalClarificationDecisionCategory } => item.category !== undefined);
+  const attempted = await selfAnswerGoalDocumentClarifications(document, {
+    ...options,
+    skipQuestionIds: new Set(safetyQuestions.map((item) => item.entry.questionId)),
+  });
+  let updated = attempted.document;
+  let assumed = 0;
+  const decisionRequired: Array<{ questionId: string; header: string; question: string; category: GoalClarificationDecisionCategory }> =
+    safetyQuestions.map(({ entry, category }) => ({ questionId: entry.questionId, header: entry.header, question: entry.question, category }));
+  for (const item of parseGoalDocumentClarifications(updated).filter((entry) => !entry.answered)) {
+    const category = goalClarificationDecisionCategory(item);
+    if (category) continue;
+    const offered = item.options.filter((option) => option.label.trim() && !/[\r\n]/.test(option.label));
+    const useOfferedOption = !item.includeOther && offered.length > 0;
+    const answer = useOfferedOption
+      ? offered[0]!.label.trim()
+      : '근거가 부족하므로 요청에 명시된 범위만 진행한다고 가정한다';
+    const assumption = useOfferedOption
+      ? '자가 해소가 답을 내지 못해 자유 답변 없이 제시된 첫 후보를 정책 가정으로 선택했다'
+      : '자가 해소가 답을 내지 못해 추가 범위를 만들지 않고 요청에 명시된 범위만 진행한다고 가정했다';
+    try {
+      const current = findUnansweredGoalDocumentClarification(updated, item.questionId);
+      const lines = updated.split(/\r?\n/);
+      const provenanceLines = current.provenanceLines ?? [];
+      for (const line of [...provenanceLines].sort((left, right) => right - left)) lines.splice(line, 1);
+      const answerLine = current.answerLine - provenanceLines.filter((line) => line < current.answerLine).length;
+      lines[answerLine] = `  - answer: ${answer}`;
+      lines.splice(answerLine + 1, 0,
+        '  - provenance.source: default',
+        `  - provenance.assumption: ${assumption}`,
+        '  - provenance.assumption-source: policy-default',
+      );
+      updateWhatToBuildRenderAnswers(lines, item.questionId, answer);
+      if (hasWhatToBuildUnansweredRenderAnswer(lines, item.questionId)) continue;
+      const candidate = lines.join(updated.includes('\r\n') ? '\r\n' : '\n');
+      if (!parseGoalDocumentClarifications(candidate).some((entry) => entry.questionId === item.questionId
+        && entry.answered && entry.answer === answer && entry.provenanceSource === 'default')) continue;
+      updated = candidate;
+      assumed += 1;
+      observeGoalAuthor('goal-author.clarify', 'self-answer-assumed', {
+        runId: options.runId ?? process.env.ELANOUS_RUN_ID,
+        questionId: item.questionId,
+        assumptionSource: 'policy-default',
+        selectedOfferedOption: useOfferedOption,
+      });
+    } catch {
+      // Keep the pending question visible to the caller as a no-launch reason; never dispatch it to a popup.
+    }
+  }
+  return {
+    ...attempted,
+    document: updated,
+    answered: attempted.answered + assumed,
+    unanswered: Math.max(0, attempted.unanswered - assumed),
+    newlyAnswered: attempted.newlyAnswered + assumed,
+    assumed,
+    decisionRequired,
+  };
+}
+
 
 export type ClarificationIntakeMode = 'none' | 'deferred-noninteractive' | 'ask';