fix(headless): align Harbor execution lifecycles

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.

[Astro-Han]

Summary

• Align the pinned Kimi Code request timeout with each Harbor cell's native task timeout plus a bounded settlement grace; missing or malformed timeout metadata now follows the shared 900-second fallback instead of failing adapter startup.
• Scope Kimi and Maka child processes so deadline, cancellation, and bridge-command timeout paths reclaim the affected process groups before verification.
• Give each bridged command its own process identity so timeout cleanup also reclaims marker-retaining detached children that leave the wrapper PGID, without killing services owned by other successful commands in the same cell.
• Make /proc/*/environ marker scans safe under Harbor's pipefail, including large environments where an early-exit grep would otherwise SIGPIPE the producer and skip cleanup.
• Freeze all cell-scoped processes after a settled Maka deadline while preserving Kimi-started background services after a normal print-mode exit.
• Run Terminal-Bench verifier commands under Bash, retry the observed transient TLS bootstrap failure, and preserve official timeout verifier artifacts even when Harbor exits non-zero.
• Rotate the default Kimi experiment run identity and content-address its prepared toolchain directory so the patched toolchain cannot collide with prior runs or version-only caches.

The process cleanup is a lifecycle hygiene boundary, not an adversarial process-containment boundary. A child that deliberately clears both scope markers and leaves the recorded process group requires an execution-owner primitive from Harbor, such as a per-exec cgroup or kill handle; this adapter does not add process-tree heuristics that cannot make that invariant reliable.

Verification

TDD regressions failed before their corresponding fixes for the stale experiment/cache identity, missing Kimi cell timeout, marker-retaining detached timed-out command, and pipefail-sensitive marker scan. The focused Harbor adapter contract passes locally, and an additional Linux /proc integration proved that command cleanup kills both the wrapper and a marker-retaining detached child while preserving another command's service.

• node ../../worktree-bootstrap.mjs — complete repository build and stale-dist check passed.
• npm --workspace @maka/headless test — 1,105 passed, 0 skipped, 0 failed.
• Linux python:3.13-slim-bookworm command-scope cleanup integration — passed.
• Large-environment marker scan with pipefail enabled — passed.
• git diff --check origin/main...HEAD — passed.

Review focus

The branch is split into eight Conventional Commits by independently reviewable intent: timeout evidence recovery, Kimi execution lifetime, cell process-scope reclamation, verifier bootstrap retry, missing-timeout fallback, experiment identity rotation, marker-retaining detached timed-out command reclamation, and pipe-safe process-marker scans.

This PR owns Harbor execution lifecycles only. Runtime model output limits are in #1213. Pass@1 recovery, provider telemetry, trace retention, benchmark reporting, and final-usage drain remain separate changes.