elanous 0.2.41 → 0.2.43

package/src/harness/dispatch-backpressure.ts

@@ -9,6 +9,18 @@ import { leaseKubectl, measurePoolLease, recommendConcurrency } from '../task-or
 import { parsePodPool, resolvePodPoolSpec } from '../task-orchestrator/surfaces/pod-pool.js';
 import { listCodexAccountsInStore } from '../oauth/codex-account-store.js';
 import { defaultSshRunner, resolveParentHosts, type SshRunner } from '../task-agent/parent-host.js';
+import { debug } from '../debug/log.js';
+import type { LiveSupplySnapshot } from '../live-supply/snapshot.js';
+
+// Backpressure is a synchronous CLI command. Load supply only when that command runs so its
+// collector graph does not enter the static TUI startup path.
+function supplyReader(): typeof import('../live-supply/snapshot.js') {
+  return require('../live-supply/snapshot.js') as typeof import('../live-supply/snapshot.js');
+}
+
+function observeSupply(event: string, data: Record<string, unknown>): void {
+  try { debug.log('live-supply', event, data); } catch { /* observation never changes admission */ }
+}
 
 export const BUILD_STOP = 4;
 export const BUILD_SLOW = 2;
@@ -126,8 +138,49 @@ function readPodRecommendation(): number | null {
   const measure = measurePoolLease(members, { measureUsage: true, skipDnsProbe: true });
   let accounts = -1;
   try { accounts = listCodexAccountsInStore().length; } catch { /* Accounts are only observed, not a limit. */ }
-  return recommendConcurrency(measure, { capacity: members.reduce((sum, member) => sum + member.capacity, 0),
+  const direct = recommendConcurrency(measure, { capacity: members.reduce((sum, member) => sum + member.capacity, 0),
     accounts, perAccount: config.pod?.lease?.perAccount ?? 4 }).recommended;
+  return narrowPodRecommendationFromSupply(direct, members, supplyReader().loadLiveSupplySnapshot());
+}
+
+/** Pool supply can only reduce a direct recommendation when every member matches the current spec. */
+export function narrowPodRecommendationFromSupply(
+  direct: number | null,
+  members: readonly { context: string; capacity: number }[],
+  snapshot: LiveSupplySnapshot | null,
+  nowMs = Date.now(),
+): number | null {
+  const supply = supplyReader().freshSupplyAxis(snapshot, 'pool', nowMs);
+  if (supply.status !== 'fresh') {
+    observeSupply('snapshot-unavailable', { site: 'harness-backpressure', axis: 'pool', reason: supply.reason });
+    return direct;
+  }
+  // A pool sample can only narrow current admission, never override memory/DNS policy or raise its result.
+  if (!Array.isArray(supply.value?.members)) {
+    observeSupply('snapshot-unavailable', { site: 'harness-backpressure', axis: 'pool', reason: 'malformed' });
+    return direct;
+  }
+  const sampleRows = supply.value.members;
+  const sampled = new Map(sampleRows
+    .filter(member => member && typeof member.context === 'string')
+    .map(member => [member.context, member]));
+  if (sampled.size !== sampleRows.length || sampled.size !== members.length
+    || new Set(members.map(member => member.context)).size !== members.length) {
+    observeSupply('snapshot-unavailable', { site: 'harness-backpressure', axis: 'pool', reason: 'pool-spec-mismatch' });
+    return direct;
+  }
+  const cap = members.reduce<number | null>((sum, member) => {
+    const seen = sampled.get(member.context);
+    if (sum === null || !seen || seen.capacity !== member.capacity || typeof seen.occupied !== 'number'
+      || !Number.isSafeInteger(seen.occupied) || seen.occupied < 0) return null;
+    return sum + Math.max(0, member.capacity - seen.occupied);
+  }, 0);
+  if (cap === null) {
+    observeSupply('snapshot-unavailable', { site: 'harness-backpressure', axis: 'pool', reason: 'pool-spec-mismatch' });
+    return direct;
+  }
+  observeSupply('snapshot-consumed', { site: 'harness-backpressure', axis: 'pool', sequence: supply.sequence, cap });
+  return direct === null ? null : Math.min(direct, cap);
 }
 
 function readLocalAdmission(query: LogQuery): readonly AdmissionRow[] {

package/src/harness/dispatch-shadow-compare.ts

@@ -0,0 +1,74 @@
+import { debug } from '../debug/log.js';
+
+/** Input contract for a dispatcher decision to be compared at the product entry. */
+export const DISPATCH_SHADOW_COMPARE_ENV = 'ELANOUS_DISPATCH_SHADOW_COMPARE';
+
+export interface DispatchShadowCompareContext {
+  requestId: string;
+  cellId: string;
+  tickId: string;
+  snapshotHash: string;
+  dispatcherAction: string;
+  dispatcherReason: string;
+  loopShadowAction: string;
+  loopShadowReason: string;
+  policyVersion: string;
+  runId: string;
+}
+
+export interface DispatchShadowCompareEntry {
+  entrance: string;
+  productEntryAction: 'queue' | 'launch-gate';
+  productEntryReason: string;
+}
+
+const CONTEXT_FIELDS = [
+  'requestId', 'cellId', 'tickId', 'snapshotHash', 'dispatcherAction', 'dispatcherReason',
+  'loopShadowAction', 'loopShadowReason', 'policyVersion', 'runId',
+] as const;
+const MAX_CONTEXT_BYTES = 2048;
+const MAX_VALUE_LENGTH = 240;
+
+function compactString(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const compact = value.replace(/[\r\n\t]+/g, ' ').trim();
+  return compact.length > 0 && compact.length <= MAX_VALUE_LENGTH ? compact : undefined;
+}
+
+/** Parse the dispatcher handoff without making malformed optional metadata affect launches. */
+export function parseDispatchShadowCompareContext(raw: string | undefined): DispatchShadowCompareContext | undefined {
+  if (!raw || Buffer.byteLength(raw, 'utf8') > MAX_CONTEXT_BYTES) return undefined;
+  let value: unknown;
+  try { value = JSON.parse(raw); } catch { return undefined; }
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;
+  const row = value as Record<string, unknown>;
+  const fields = Object.fromEntries(CONTEXT_FIELDS.map(field => [field, compactString(row[field])])) as
+    Record<(typeof CONTEXT_FIELDS)[number], string | undefined>;
+  if (CONTEXT_FIELDS.some(field => fields[field] === undefined)) return undefined;
+  if (!/^[a-f0-9]{64}$/i.test(fields.snapshotHash!)) return undefined;
+  return fields as DispatchShadowCompareContext;
+}
+
+/** One fail-soft comparison row; it only observes the product entry's selected route. */
+export function recordDispatchShadowCompare(
+  context: DispatchShadowCompareContext | undefined,
+  entry: DispatchShadowCompareEntry,
+  log: (category: string, event: string, data: unknown) => void = (category, event, data) => debug.log(category, event, data),
+): void {
+  if (!context) return;
+  try {
+    log('harness', 'dispatch.shadow.compare', {
+      ...context,
+      ...entry,
+      agreement: context.dispatcherAction === context.loopShadowAction,
+    });
+  } catch { /* Measurement must not alter the harness entry or launch decision. */ }
+}
+
+export function recordDispatchShadowCompareFromEnv(
+  raw: string | undefined,
+  entry: DispatchShadowCompareEntry,
+  log?: (category: string, event: string, data: unknown) => void,
+): void {
+  recordDispatchShadowCompare(parseDispatchShadowCompareContext(raw), entry, log);
+}

package/src/harness/harness-cli-command.ts

@@ -56,6 +56,7 @@ import { installHarnessCliSinkHook } from './harness-cli-sink.js';
 import { addHarnessQueue, HarnessQueueDuplicateError, harnessQueueReceiptPath, listHarnessQueue, queueSeatForCwd, reconcileHarnessQueue, removeHarnessQueue, setHarnessQueuePriority, tickHarnessQueue, type HarnessQueueDeps, type QueueItem, type QueueSeat } from './harness-queue.js';
 import { writeHarnessQueueReceipt } from './harness-queue-child.js';
 import { decideBackpressure, readBackpressureSignals, type BackpressureReadDeps } from './dispatch-backpressure.js';
+import { DISPATCH_SHADOW_COMPARE_ENV, recordDispatchShadowCompareFromEnv } from './dispatch-shadow-compare.js';
 import { parseDoorSince, queryLaunchDoors, renderLaunchDoors, type DoorTable } from './launch-stamp.js';
 import { resolveHarnessSubstrate, type ResolvedHarnessSubstrate } from './harness-substrate-default.js';
 import { podChildProviderRefusal } from '../task-orchestrator/surfaces/pod-child-providers.js';
@@ -1061,6 +1062,13 @@ async function dispatchHarnessAskSay(
     const takeQueue = intakeTakesQueue(intakeLabel, intakeRoute, queueEligible);
     // 실제로 탄 간선을 전제 검사 «뒤»에 남긴다(그래프 답과 다르면 honored=false · 이유).
     recordJourneyEdge(intakeRoute, takeQueue ? 'queue' : 'launch-gate', intakeRoute.to === 'queue' && !takeQueue ? (opts.queue === false ? '--no-queue' : process.env.ELANOUS_HARNESS_QUEUE_LAUNCH ? 'queue-child' : 'no-seat') : undefined);
+    // OP TA dispatcher injects its decision snapshot. Join both policies at the product entry;
+    // this is observation only and must not change queue/direct routing.
+    recordDispatchShadowCompareFromEnv(process.env[DISPATCH_SHADOW_COMPARE_ENV], {
+      entrance: dryRunPreview.entrance,
+      productEntryAction: takeQueue ? 'queue' : 'launch-gate',
+      productEntryReason: takeQueue ? 'graph-intake-queue' : `graph-intake-${intakeRoute.to}`,
+    });
     if (directSay && opts.queue === false) {
       try { debug.log('harness.queue', 'bypass', { seat: stampedSeat ?? null, reason: '--no-queue' }); }
       catch { /* Observation must not prevent an emergency launch. */ }
@@ -1190,7 +1198,9 @@ async function dispatchHarnessAskSay(
     delete process.env[LAUNCH_DOOR_RECEIPT_ENV];
     // 주입된 문이 없으면 생산 우주의 기본 문을 쓴다(시험 환경은 관문 관례와 같이 건너뛴다 — 시험 단언이 단일문 때문에 바뀌지 않는다).
     const launchDoor = gate.launchDoor ?? (process.env.NODE_ENV === 'test' ? undefined : openLaunchRequestDoor({ source: dryRunPreview.entrance }));
-    const launchDoorRequestId = launchDoor?.requestId(identity);
+    // A hand parent already consumed a card/attempt-scoped request id. Reuse that id here;
+    // direct harness requests still derive their stable id from the authored ask.
+    const launchDoorRequestId = inheritedLaunchDoorReceipt ?? launchDoor?.requestId(identity);
     const decision = await withJourneyNode('launch-gate', journey, async () => {
       const { budget, budgetSource, snapshotAgeSec } = await resolveLaunchBudget({
         provider: opts.childLlmProvider,

package/src/harness/harness-pod-dispatch.ts

@@ -107,7 +107,29 @@ export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: str
   ];
 }
 
-type PodDispatchDeps = { run?: (cmd: string, args: readonly string[], env: NodeJS.ProcessEnv) => number | null; readFile?: (path: string) => string; cwd?: string; spawnChild?: typeof spawn; onOutput?: (text: string) => void; recordRunLedgerEntry?: typeof appendRunLedgerEntry; nowMs?: number };
+type PodDispatchExitObservation = {
+  status: number | null;
+  parentSignalReceived: NodeJS.Signals | null;
+  parentSignalReceivedAt: string | null;
+  parentSignalLastReceived?: NodeJS.Signals | null;
+  parentSignalLastReceivedAt?: string | null;
+  signalDelivery: 'requested' | 'child-not-running' | 'kill-failed' | null;
+  signalDeliveryFor?: NodeJS.Signals | null;
+  orchestratorProcessSignal: NodeJS.Signals | null;
+  observedAt: string;
+};
+type PodDispatchRunResult = number | null | PodDispatchExitObservation;
+type PodDispatchDeps = { run?: (cmd: string, args: readonly string[], env: NodeJS.ProcessEnv) => PodDispatchRunResult; readFile?: (path: string) => string; cwd?: string; spawnChild?: typeof spawn; onOutput?: (text: string) => void; recordRunLedgerEntry?: typeof appendRunLedgerEntry; nowMs?: number };
+
+export function classifyPodDispatchSignalSource(observation: Pick<PodDispatchExitObservation, 'parentSignalReceived' | 'signalDelivery' | 'orchestratorProcessSignal' | 'status'> & Partial<Pick<PodDispatchExitObservation, 'parentSignalLastReceived' | 'signalDeliveryFor'>>): 'parent-signal-forward-requested' | 'orchestrator-process-signaled' | 'unknown-143' | 'unknown-signal-exit' | 'non-signal-exit' {
+  const lastSignal = observation.parentSignalLastReceived ?? observation.parentSignalReceived;
+  const deliveryFor = observation.signalDeliveryFor ?? lastSignal;
+  if (lastSignal && observation.signalDelivery === 'requested' && deliveryFor === lastSignal) return 'parent-signal-forward-requested';
+  if (observation.orchestratorProcessSignal) return 'orchestrator-process-signaled';
+  if (observation.status === 143) return 'unknown-143';
+  if (observation.status === 130 || observation.status === null) return 'unknown-signal-exit';
+  return 'non-signal-exit';
+}
 
 /** Default Pod source clones origin HEAD. Never infer its file occupation from an unrelated worktree. */
 function defaultPodSourceHeadAt(root: string): string | undefined {
@@ -294,39 +316,83 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     childLlmProvider: input.childLlmProvider ?? null, childLlmModel: input.childLlmModel ?? null,
     goalChars, ...(input.entrance === 'cli-harness-ask' ? { goalPath: input.input } : {}),
   });
-  const run = deps.run ?? ((cmd: string, a: readonly string[], childEnv: NodeJS.ProcessEnv) => new Promise<number>((resolveStatus) => {
+  const run = deps.run ?? ((cmd: string, a: readonly string[], childEnv: NodeJS.ProcessEnv) => new Promise<PodDispatchExitObservation>((resolveStatus) => {
     const ownsOutput = Boolean(deps.onOutput);
     const child = (deps.spawnChild ?? spawn)(cmd, [...a], {
-      stdio: ownsOutput ? ['ignore', 'pipe', 'pipe'] : 'inherit',
-      env: childEnv,
+      stdio: ownsOutput ? ['ignore', 'pipe', 'pipe'] : 'inherit', env: childEnv,
     });
     child.stdout?.setEncoding('utf8');
     child.stdout?.on('data', (chunk: string) => { process.stdout.write(chunk); deps.onOutput?.(chunk); });
     if (ownsOutput) forwardChildStderr(child.stderr);
-    let forwarded: NodeJS.Signals | undefined;
+    let parentSignalReceived: NodeJS.Signals | undefined;
+    let parentSignalReceivedAt: string | undefined;
+    let parentSignalLastReceived: NodeJS.Signals | undefined;
+    let parentSignalLastReceivedAt: string | undefined;
+    let signalDelivery: PodDispatchExitObservation['signalDelivery'];
+    let signalDeliveryFor: NodeJS.Signals | undefined;
     const forward = (signal: NodeJS.Signals) => {
-      forwarded = signal;
-      if (child.exitCode === null && child.signalCode === null) child.kill(signal);
+      const receivedAt = new Date().toISOString();
+      parentSignalReceived ??= signal;
+      parentSignalReceivedAt ??= receivedAt;
+      parentSignalLastReceived = signal;
+      parentSignalLastReceivedAt = receivedAt;
+      signalDeliveryFor = signal;
+      if (child.exitCode !== null || child.signalCode !== null) {
+        signalDelivery = 'child-not-running';
+        return;
+      }
+      try { signalDelivery = child.kill(signal) ? 'requested' : 'kill-failed'; }
+      catch { signalDelivery = 'kill-failed'; }
     };
     const onTerm = () => forward('SIGTERM');
     const onInt = () => forward('SIGINT');
     process.on('SIGTERM', onTerm);
     process.on('SIGINT', onInt);
     const cleanup = () => { process.off('SIGTERM', onTerm); process.off('SIGINT', onInt); };
-    child.once('error', () => { cleanup(); resolveStatus(1); });
-    child.once('close', (code, signal) => { cleanup(); resolveStatus(code ?? ((signal ?? forwarded) === 'SIGINT' ? 130 : 143)); });
+    child.once('error', () => {
+      cleanup();
+      resolveStatus({ status: 1, parentSignalReceived: parentSignalReceived ?? null, parentSignalReceivedAt: parentSignalReceivedAt ?? null,
+        parentSignalLastReceived: parentSignalLastReceived ?? null, parentSignalLastReceivedAt: parentSignalLastReceivedAt ?? null,
+        signalDelivery: signalDelivery ?? null, signalDeliveryFor: signalDeliveryFor ?? null,
+        orchestratorProcessSignal: null, observedAt: new Date().toISOString() });
+    });
+    child.once('close', (code, signal) => {
+      cleanup();
+      resolveStatus({
+        status: code ?? ((signal ?? parentSignalReceived) === 'SIGINT' ? 130 : 143),
+        parentSignalReceived: parentSignalReceived ?? null,
+        parentSignalReceivedAt: parentSignalReceivedAt ?? null,
+        parentSignalLastReceived: parentSignalLastReceived ?? null,
+        parentSignalLastReceivedAt: parentSignalLastReceivedAt ?? null,
+        signalDelivery: signalDelivery ?? null,
+        signalDeliveryFor: signalDeliveryFor ?? null,
+        orchestratorProcessSignal: signal ?? null,
+        observedAt: new Date().toISOString(),
+      });
+    });
   }));
+  const recordExit = (result: PodDispatchRunResult): number => {
+    const observation = typeof result === 'number' || result === null
+      ? { status: result, parentSignalReceived: null, parentSignalReceivedAt: null, parentSignalLastReceived: null, parentSignalLastReceivedAt: null,
+        signalDelivery: null, signalDeliveryFor: null, orchestratorProcessSignal: null, observedAt: new Date().toISOString() }
+      : result;
+    debug.log('harness.substrate', 'dispatch-pod-exit', {
+      entrance: input.entrance,
+      reporterSeat: input.seat ?? process.env.ELANOUS_HARNESS_SEAT ?? null,
+      reporterCommand: input.entrance === 'cli-harness-ask' ? 'harness ask' : 'harness say',
+      ...observation, signalSource: classifyPodDispatchSignalSource(observation),
+    });
+    return observation.status ?? 1;
+  };
   const cleanup = () => { if (tempDir) rmSync(tempDir, { recursive: true, force: true }); };
   try {
     const status = run(process.execPath, args, env);
-    if (typeof status === 'number' || status === null) {
+    if (typeof status === 'number' || status === null || !('then' in status)) {
       cleanup();
-      debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status });
-      return status ?? 1;
+      return recordExit(status);
     }
-    return status.then((code) => {
-      debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status: code });
-      return code;
+    return status.then((result) => {
+      return recordExit(result);
     }).finally(cleanup);
   } catch (error) {
     cleanup();

package/src/harness/harness-stop.ts

@@ -16,12 +16,14 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { debug } from '../debug/log.js';
+import { incidentLastLines } from './harness-incidents.js';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { launchBindingRunIds, launchRegistryDir, readLaunchBinding } from './launch-registry.js';
 import { loadRunLedger, resolveFederatedRunLedgerDirectories, runLedgerDir } from '../self-implement/run-ledger.js';
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
 const FULL_RUN_ID = /^run-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const STOP_POD_OBSERVATION_BUDGET_MS = 4_000;
 
 export class AmbiguousHarnessStopRunIdError extends Error {
   constructor(given: string, candidates: readonly string[]) {
@@ -151,12 +153,14 @@ export interface HarnessStopDeps {
   kill: (pid: number, signal: NodeJS.Signals) => void;
   sleep: (ms: number) => Promise<void>;
   kubeContexts: () => string[];
-  kubectl: (args: readonly string[]) => { status: number | null; stdout: string; stderr: string };
+  kubectl: (args: readonly string[], timeoutMs?: number) => { status: number | null; stdout: string; stderr: string };
   namespace: string;
   graceMs: number;
+  observePodsBeforeDelete?: (runId: string, context: string, label: HarnessStopJobMatchedBy, budget: HarnessStopObservationBudget) => void;
 }
 
 export type HarnessStopJobMatchedBy = 'elanous.run' | 'elanous.child-run';
+type HarnessStopObservationBudget = { startedAt: number | null; budgetMs: number; observedPods: number };
 
 /**
  * 문맥 하나의 Pod Job 삭제 결과(HARNESS-STOP-POD-LABEL) — «0개 지움» 의 종류를 가른다.
@@ -218,12 +222,130 @@ export function psProcessStartMs(pid: number): number | null {
 
 export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {}, opts: { launchRegistryDir?: string } = {}): HarnessStopDeps {
   const registry = opts.launchRegistryDir ?? launchRegistryDir();
+  const namespace = overrides.namespace ?? 'elanous-test';
+  const graceMs = overrides.graceMs ?? 10_000;
   const env = { ...process.env };
   for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
-  const kubectl = (args: readonly string[]) => {
-    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, env, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  const kubectl = (args: readonly string[], timeoutMs = 15_000) => {
+    const r = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: timeoutMs, env, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
   };
+  const runKubectl = overrides.kubectl ?? kubectl;
+  const maxObservedPods = 2;
+  const listTimeoutMs = 1_500;
+  const logTimeoutMs = 750;
+  const observePodsBeforeDelete = (runId: string, context: string, label: HarnessStopJobMatchedBy, budget: HarnessStopObservationBudget): void => {
+    const requestedAt = new Date().toISOString();
+    const reporterSeat = process.env.ELANOUS_HARNESS_SEAT ?? null;
+    budget.startedAt ??= performance.now();
+    const remainingMs = () => Math.max(0, budget.budgetMs - (performance.now() - budget.startedAt!));
+    const emit = (data: Record<string, unknown>) => debug.log('harness.stop', 'job-termination-predelete', {
+      runId, context, matchedBy: label, requestedAt, reporter: 'harness-stop', reporterSeat, reporterCommand: 'harness stop', ...data,
+    });
+    if (remainingMs() <= 0) {
+      emit({ status: 'budget-exhausted', pods: [], omittedPods: null, observationBudgetMs: budget.budgetMs });
+      return;
+    }
+    try {
+      const listed = runKubectl(['--context', context, '-n', namespace, 'get', 'pods', '-l', `${label}=${runId}`, '-o', 'json'], Math.min(listTimeoutMs, remainingMs()));
+      let pods: unknown[] = [];
+      let listStatus: 'observed' | 'unavailable' | 'invalid' = 'observed';
+      if (listed.status !== 0) listStatus = 'unavailable';
+      else {
+        try {
+          const parsed = JSON.parse(listed.stdout) as { items?: unknown };
+          if (!Array.isArray(parsed.items)) listStatus = 'invalid';
+          else pods = parsed.items;
+        } catch { listStatus = 'invalid'; }
+      }
+      const selectedPods = pods.slice(0, Math.max(0, maxObservedPods - budget.observedPods));
+      budget.observedPods += selectedPods.length;
+      const evidence = selectedPods.map((raw) => {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { status: 'invalid-pod-record' };
+        const pod = raw as {
+          metadata?: { name?: unknown; labels?: unknown; ownerReferences?: unknown };
+          spec?: { nodeName?: unknown; activeDeadlineSeconds?: unknown; containers?: unknown };
+          status?: { phase?: unknown; reason?: unknown; message?: unknown; startTime?: unknown; conditions?: unknown; containerStatuses?: unknown };
+        };
+        const meta = pod.metadata && typeof pod.metadata === 'object' ? pod.metadata : {};
+        const spec = pod.spec && typeof pod.spec === 'object' ? pod.spec : {};
+        const status = pod.status && typeof pod.status === 'object' ? pod.status : {};
+        const arraysValid = (meta.ownerReferences === undefined || Array.isArray(meta.ownerReferences))
+          && (spec.containers === undefined || Array.isArray(spec.containers))
+          && (status.conditions === undefined || Array.isArray(status.conditions))
+          && (status.containerStatuses === undefined || Array.isArray(status.containerStatuses));
+        if (!arraysValid) return { status: 'invalid-pod-record' };
+        const name = typeof meta.name === 'string' ? meta.name : null;
+        const deadlineSeconds = typeof spec.activeDeadlineSeconds === 'number' && Number.isFinite(spec.activeDeadlineSeconds) && spec.activeDeadlineSeconds >= 0 ? spec.activeDeadlineSeconds : null;
+        const startedAt = typeof status.startTime === 'string' ? status.startTime : null;
+        let deadlineAt: string | null = null;
+        if (deadlineSeconds !== null && startedAt) {
+          const startMs = Date.parse(startedAt);
+          const deadlineMs = startMs + deadlineSeconds * 1000;
+          if (Number.isFinite(startMs) && Number.isFinite(deadlineMs)) {
+            try { deadlineAt = new Date(deadlineMs).toISOString(); } catch { deadlineAt = null; }
+          }
+        }
+        let tail: string[] | null = null;
+        let tailStatus: 'observed' | 'unavailable' | 'not-requested' | 'budget-exhausted' = 'not-requested';
+        if (name && remainingMs() > 0) {
+          const logs = runKubectl(['--context', context, '-n', namespace, 'logs', `pod/${name}`, '-c', 'child', '--tail=20'], Math.min(logTimeoutMs, remainingMs()));
+          if (logs.status === 0) { tail = incidentLastLines(logs.stdout); tailStatus = 'observed'; }
+          else { tail = incidentLastLines(logs.stderr); tailStatus = 'unavailable'; }
+        } else if (name) tailStatus = 'budget-exhausted';
+        const owners = Array.isArray(meta.ownerReferences) ? (meta.ownerReferences as Array<{ kind?: unknown; name?: unknown }>).slice(0, 20) : [];
+        const labels = meta.labels && typeof meta.labels === 'object' ? meta.labels as Record<string, unknown> : {};
+        const containers = Array.isArray(spec.containers) ? (spec.containers as Array<{ name?: unknown; image?: unknown; imagePullPolicy?: unknown }>).slice(0, 20) : [];
+        const conditions = Array.isArray(status.conditions) ? (status.conditions as Array<{ type?: unknown; status?: unknown; reason?: unknown; message?: unknown; lastTransitionTime?: unknown }>).slice(0, 20) : [];
+        const containerStatuses = Array.isArray(status.containerStatuses) ? (status.containerStatuses as Array<{ name?: unknown; imageID?: unknown; state?: unknown }>).slice(0, 20) : [];
+        return {
+          pod: name,
+          job: owners.find((owner) => owner?.kind === 'Job' && typeof owner.name === 'string')?.name ?? null,
+          childRunId: typeof labels['elanous.child-run'] === 'string' ? labels['elanous.child-run'] : null,
+          nodeName: typeof spec.nodeName === 'string' ? spec.nodeName : null,
+          images: containers.map((container) => container && typeof container === 'object' ? ({
+            name: typeof container.name === 'string' ? container.name : null,
+            image: typeof container.image === 'string' ? container.image : null,
+            imagePullPolicy: typeof container.imagePullPolicy === 'string' ? container.imagePullPolicy : null,
+          }) : { status: 'invalid-container-record' }),
+          phase: typeof status.phase === 'string' ? status.phase : null,
+          reason: typeof status.reason === 'string' ? status.reason : null,
+          message: typeof status.message === 'string' ? incidentLastLines(status.message).at(-1) ?? null : null,
+          startTime: startedAt, activeDeadlineSeconds: deadlineSeconds, deadlineAt,
+          conditions: conditions.map((condition) => condition && typeof condition === 'object' ? ({
+            type: typeof condition.type === 'string' ? condition.type : null,
+            status: typeof condition.status === 'string' ? condition.status : null,
+            reason: typeof condition.reason === 'string' ? condition.reason : null,
+            message: typeof condition.message === 'string' ? incidentLastLines(condition.message).at(-1) ?? null : null,
+            lastTransitionTime: typeof condition.lastTransitionTime === 'string' ? condition.lastTransitionTime : null,
+          }) : { status: 'invalid-condition-record' }),
+          containers: containerStatuses.map((container) => {
+            if (!container || typeof container !== 'object') return { status: 'invalid-container-status-record' };
+            const state = container.state && typeof container.state === 'object' ? container.state as Record<string, unknown> : {};
+            const waiting = state.waiting && typeof state.waiting === 'object' ? state.waiting as { reason?: unknown; message?: unknown } : null;
+            const terminated = state.terminated && typeof state.terminated === 'object' ? state.terminated as { reason?: unknown; exitCode?: unknown; signal?: unknown; finishedAt?: unknown } : null;
+            return {
+              name: typeof container.name === 'string' ? container.name : null,
+              imageID: typeof container.imageID === 'string' ? container.imageID : null,
+              waiting: waiting ? { reason: typeof waiting.reason === 'string' ? waiting.reason : null, message: typeof waiting.message === 'string' ? incidentLastLines(waiting.message).at(-1) ?? null : null } : null,
+              terminated: terminated ? {
+                reason: typeof terminated.reason === 'string' ? terminated.reason : null,
+                exitCode: typeof terminated.exitCode === 'number' && Number.isFinite(terminated.exitCode) ? terminated.exitCode : null,
+                signal: typeof terminated.signal === 'number' && Number.isFinite(terminated.signal) ? terminated.signal : null,
+                finishedAt: typeof terminated.finishedAt === 'string' ? terminated.finishedAt : null,
+              } : null,
+            };
+          }),
+          tailSource: 'kubectl-logs-merged-streams', tailStatus, tail,
+        };
+      });
+      emit({ status: listStatus, pods: evidence, omittedPods: Math.max(0, pods.length - selectedPods.length), observationBudgetMs: budget.budgetMs,
+        ...(listStatus === 'unavailable' ? { reason: incidentLastLines(listed.stderr).at(-1) ?? 'kubectl failed' } : {}) });
+    } catch (error) {
+      emit({ status: 'invalid', pods: [], omittedPods: null, observationBudgetMs: budget.budgetMs,
+        reason: incidentLastLines(error instanceof Error ? error.message : String(error)).at(-1) ?? 'observation failed' });
+    }
+  };
   return {
     // This universe first; then the host-wide launch binding, so a run launched from another worktree is still found.
     readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId) ?? pidRecordFromLaunchBinding(runId, registry),
@@ -243,12 +365,13 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {},
     kill: (pid, signal) => { process.kill(pid, signal); },
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     kubeContexts: () => {
-      const r = kubectl(['config', 'get-contexts', '-o', 'name']);
+      const r = runKubectl(['config', 'get-contexts', '-o', 'name']);
       return r.status === 0 ? r.stdout.split('\n').map((l) => l.trim()).filter(Boolean) : [];
     },
-    kubectl,
-    namespace: 'elanous-test',
-    graceMs: 10_000,
+    kubectl: runKubectl,
+    observePodsBeforeDelete,
+    namespace,
+    graceMs,
     ...overrides,
   };
 }
@@ -271,7 +394,7 @@ function countDeletedJobLines(stdout: string): number {
 }
 
 /** 문맥 하나의 Pod Job 삭제 — 결과를 넷(deleted·none·unreachable·pods-only)으로 가르고 문맥마다 관측 `harness.stop` `job-delete` 를 남긴다. */
-function deleteRunPodJobs(deps: HarnessStopDeps, runId: string, context: string): HarnessStopJobDelete {
+function deleteRunPodJobs(deps: HarnessStopDeps, runId: string, context: string, budget: HarnessStopObservationBudget): HarnessStopJobDelete {
   const unreachable = (stderr: string): HarnessStopJobDelete => {
     const error = stderr.slice(0, 200);
     debug.log('harness.stop', 'job-delete', { runId, context, outcome: 'unreachable', matchedBy: null, error }, { level: 'warn' });
@@ -281,6 +404,14 @@ function deleteRunPodJobs(deps: HarnessStopDeps, runId: string, context: string)
   for (const label of POD_JOB_LABELS) {
     // `-o name` → «job.batch/<name>» 한 줄씩. 맨 출력은 «job.batch "<name>" deleted» 라 «job.batch/» 로만 세면
     //   지워도 늘 0 이었다(10-11 · 여섯 번 «0개 지움» 뒤 Pod Terminating). 두 꼴을 다 센다(#26194).
+    try { deps.observePodsBeforeDelete?.(runId, context, label, budget); }
+    catch (error) {
+      debug.log('harness.stop', 'job-termination-predelete', {
+        runId, context, matchedBy: label, reporter: 'harness-stop', reporterSeat: process.env.ELANOUS_HARNESS_SEAT ?? null,
+        reporterCommand: 'harness stop', status: 'invalid', pods: [], omittedPods: null,
+        reason: incidentLastLines(error instanceof Error ? error.message : String(error)).at(-1) ?? 'observation failed',
+      }, { level: 'warn' });
+    }
     const r = deps.kubectl(['--context', context, '-n', deps.namespace, 'delete', 'job', '-l', `${label}=${runId}`, '--wait=false', '-o', 'name']);
     if (r.status !== 0) return unreachable(r.stderr);
     const deleted = countDeletedJobLines(r.stdout);
@@ -326,6 +457,18 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
   const add = (candidate: StopProcessCandidate) => {
     if (!seen.has(candidate.pid)) { seen.add(candidate.pid); candidates.push(candidate); }
   };
+  const requestSignal = (candidate: StopProcessCandidate, signal: NodeJS.Signals) => {
+    const requestAt = new Date().toISOString();
+    let delivery: 'accepted' | 'failed' = 'accepted';
+    try { deps.kill(candidate.pid, signal); }
+    catch { delivery = 'failed'; }
+    debug.log('harness.stop', 'process-signal-request', {
+      runId, signal, requestAt, targetPid: candidate.pid, targetStartedAt: new Date(candidate.startedAt).toISOString(),
+      targetDiscovery: candidate.via, delivery, reporter: 'harness-stop',
+      reporterSeat: process.env.ELANOUS_HARNESS_SEAT ?? null, reporterCommand: 'harness stop',
+    });
+    return delivery === 'accepted';
+  };
   let recordMismatch = false;
   if (record) {
     const recordedStart = deps.processStartMs(record.pid);
@@ -350,7 +493,7 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
       verified.push(candidate);
     }
     for (const candidate of verified) {
-      try { deps.kill(candidate.pid, 'SIGTERM'); } catch { /* 방금 끝났다 */ }
+      requestSignal(candidate, 'SIGTERM');
     }
     for (const candidate of verified) {
       processState = 'stopped';
@@ -362,14 +505,15 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
       const still = deps.processStartMs(candidate.pid);
       const expectedStart = candidate.via === 'pid.json' ? record!.startedAt : candidate.startedAt;
       if (still !== null && Math.abs(still - expectedStart) <= START_TOLERANCE_MS) {
-        try { deps.kill(candidate.pid, 'SIGKILL'); processState = 'killed'; } catch { /* 끝났다 */ }
+        if (requestSignal(candidate, 'SIGKILL')) processState = 'killed';
       }
     }
     if (processState === 'absent' && (scan.status === 'failed' || candidates.length > 0)) processState = 'unmeasured';
   }
   // ── ⓑ Pod Job (라벨로만) ───────────────────────────────────
   const targets = dryRun ? [] : contexts && contexts.length > 0 ? [...contexts] : deps.kubeContexts();
-  const jobDeletes = targets.map((context) => deleteRunPodJobs(deps, runId, context));
+  const observationBudget: HarnessStopObservationBudget = { startedAt: null, budgetMs: STOP_POD_OBSERVATION_BUDGET_MS, observedPods: 0 };
+  const jobDeletes = targets.map((context) => deleteRunPodJobs(deps, runId, context, observationBudget));
   const jobsDeleted = jobDeletes.reduce((sum, job) => sum + job.deleted, 0);
   const result: HarnessStopResult = { runId, ...(given !== runId ? { givenRunId: given } : {}), process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, jobDeletes, contexts: targets };
   debug.log('harness.stop', 'stopped', { runId, process: processState, jobsDeleted, contexts: targets.length });

package/src/harness/skill-exec.ts

@@ -4,26 +4,31 @@
 // allowlist skill 을 강하게 가리키면 그 skill 을 격리 실행(invokeResearch·Write/Edit deny)해 실제 출력을
 // Planner grounding 에 얹는다("총동원" 북극성 인프라).
 //
-// ★★ 안전 경계 (조사 실측: executeSkill 은 무겁다 — 에이전트 배치 spawn·비용):
-//   ① **allowlist** — 자동 실행은 read-only·경량·에이전트 배치 안 하는 skill 만(stochastic-*·*-panel·
-//      consensus 류 제외). 나머지는 실행 안 함(skill-hint 가 힌트만 준다).
+// ★★ 안전 경계 (allowlist 로만 자동 skill 실행을 열고, 강한 트리거·격리·fail-soft 유지):
+//   ① **allowlist** — 명시적으로 승인한 research·market·scoring skills 만 자동 경로에 편입한다.
+//      stochastic consensus 배치는 제외하고, 아래 기본 목록의 attractiveness-panel 은 OP 승인 예외다.
 //   ② **격리** — invokeResearch 경유 = withResearchIsolation(Write/Edit/NotebookEdit deny). 부작용 봉쇄.
 //   ③ **강한 게이트** — unambiguous + score>=2.0 + 명시 트리거 히트(설명 보너스만으론 안 뜸).
 //   ④ **fail-soft** — 실패/빈 출력 = null(상위가 skill-hint 로 폴백·plan 안 막음).
-//   ⚠️ omni-crawl 은 research seam 이 이미 커버 → allowlist 제외(중복 회피).
-//   ⚠️ 코딩 objective 에선 트리거 빈도 낮음(대개 코드 변경) — 이는 북극성 "총동원" 인프라이지 상시 경로 아님.
 
 import { detectSkillTrigger } from '../skills/router.js';
 import type { SkillIndexEntry } from '../skills/index.js';
 import { invokeResearch } from '../research-bridge/invoke.js';
 import { SKILL_HINT_MIN_SCORE } from './skill-hint.js';
 
-/** 하니스 plan 단계에서 **자동 실행** 허용된 skill 기본값 — read-only·경량·에이전트 배치 spawn 안 함.
- *  ⚠️ 확장 시 신중: Agent 배치/mutating/고비용 skill 금지. omni-crawl 은 research seam 이 커버(제외). */
+/** 하니스 plan 단계에서 **자동 실행** 허용된 skill 기본값.
+ *  Research·market·scoring skill 은 OP 승인 목록이며, 실제 자동 실행은 아래 strong-trigger 및 isolation 게이트를 통과해야 한다. */
 export const HARNESS_EXEC_ALLOWLIST: ReadonlySet<string> = new Set<string>([
+  // Parent planning is grounding, not a child tool call. A child does not repeat
+  // it automatically; an explicit child crawl is a separately scoped follow-up.
+  'omni-crawl',    // OP 2026-10-30: research child skill access
   'omni-digest',   // URL/문서 요약(참조 자료 확보)
   'omni-market',   // 금융 데이터 조회(read-only)
   'kr-flow',       // 한국 시장 수급(read-only)
+  'asset-attractiveness', // OP 2026-10-30: scoring research
+  'social-pulse',  // OP 2026-10-30: social evidence research
+  'attractiveness-panel', // OP-approved exception to the generic -panel config block
+  'factor-backtest', // OP 2026-10-30: market research/backtesting
   // 📧 Gmail·Calendar·Drive·Sheets. ⚠️ ***읽기 전용이 «아니다»*** — 이 목록의 앞 셋과 다른 성질이다.
   //    ⛔ 그래서 SKILL.md 가 규율을 못 박았다: 사용자가 「보내라·잡아라·지워라」를 «명시»하지 않으면
   //       ***초안까지만*** 한다(메일 전송·일정 생성·삭제는 되돌릴 수 없다).
@@ -40,6 +45,11 @@ const HARNESS_EXEC_BLOCK_PATTERNS: readonly RegExp[] = [
   /consensus/i,         // *-consensus — 다수 에이전트 투표
 ];
 
+/** Explicitly OP-approved defaults may bypass a broad config pattern block. */
+const HARNESS_EXEC_BLOCK_EXCEPTIONS: ReadonlySet<string> = new Set([
+  'attractiveness-panel',
+]);
+
 /** 선언된 속성만으로 자동실행 안전한가(순수). 미선언은 false(보수 기본·fail-safe).
  * `SkillIndexEntry`의 선언값은 실행기와 같은 `parseSkillMd`가 같은 아티팩트에서 읽는다.
  * 선언은 skill 저자의 authorization 신호다. 읽기만 + 경량일 때만 true. */
@@ -63,7 +73,9 @@ export function resolveHarnessExecAllowlist(
   const addIfAllowed = (raw: string): void => {
     const name = raw.trim();
     if (!name) return;
-    const blocked = HARNESS_EXEC_BLOCK_PATTERNS.find((p) => p.test(name));
+    const blocked = HARNESS_EXEC_BLOCK_EXCEPTIONS.has(name)
+      ? undefined
+      : HARNESS_EXEC_BLOCK_PATTERNS.find((p) => p.test(name));
     if (blocked) {
       onReject?.(name, `자동 실행 대상 아님: 블록패턴 ${blocked} (Agent 배치·고비용 자동실행 금지). 대신 skill-hint 경로를 사용하세요. 이 판정을 넓히려면 skillRouter.harnessExecAllowlist와 HARNESS_EXEC_BLOCK_PATTERNS를 검토하세요.`);
       return;
@@ -92,7 +104,7 @@ export async function execHarnessSkill(
   index: readonly SkillIndexEntry[],
   invoke: (objective: string, skill: string) => Promise<{ ok: boolean; output: string }> =
     (obj, skill) => invokeResearch(obj, { skill }).then((r) => ({ ok: r.ok, output: r.output })),
-  allowlist: ReadonlySet<string> = HARNESS_EXEC_ALLOWLIST,   // S2 — config 확장 주입(기본=하드코딩 3개·무회귀)
+  allowlist: ReadonlySet<string> = HARNESS_EXEC_ALLOWLIST,   // S2 — config 확장 주입(기본 목록·무회귀)
 ): Promise<SkillExecResult | null> {
   if (!objective.trim() || index.length === 0) return null;
   const detect = detectSkillTrigger(objective, index as SkillIndexEntry[]);