ci: compose native application proof deadline from its selected phases #2382

Out of scope

Do not raise individual application/SDK limits, skip any default or selected phase, suppress native assertions, widen private filesystem modes, change product behavior, or treat forced container removal as successful in-fixture cleanup. The already scoped SDK profile correction remains #2315; this report concerns its later independent application qualification.

Context and reproduced failure

While qualifying #2315 on candidate effb25a15b8e3feb38596370726ca66e9a6a9338, base 82a64a13a08c44f2daef425d1a9df2c10840ea8e, tree 95eafe0ef84964e967d357cf6a8dd6dfb8bb217a, the complete offline worker-identity driver fails after both corrected full SDK profiles pass. The five-file candidate changes only SDK fixture deadline composition/observations and two citations; the application proof owners below are unchanged from main.

Command: bun scripts/prove-worker-identity.ts --image=sha256:7fbb483622c14a2feee72ca90dc7be86ffc64964a3d699f4f827a9503f57d7e5. Linux, Bun 1.4.3, existing pinned native image, external network disabled.

The generated Python owner gives the entire ordinary-identity-root.ts program 180 seconds (writeFileSync(nativeFixturePath, scripts/prove-worker-identity.ts:162-164). The default program now executes controls, fresh, warm, strict (DEFAULT_IDENTITY_PHASES, packages/ui-sdk/tests/fixtures/default-identity-phases.ts:2) sequentially, each with its existing 90-second child limit (const phases, packages/ui-sdk/tests/fixtures/ordinary-identity-root.ts:192-201) and a five-second owned-cleanup bound at the end.

Retained phase receipts:

The Python parent raises subprocess.TimeoutExpired at 180 seconds. No completed phase exhausts its own 90-second limit. Both preceding SDK profiles pass in 30,787 / 29,976 ms; 27 identity controls, 13 egress controls, 20 checkpoint-reader controls and the Btrfs identity-manager scenario also pass. The overall native run exits 1 after 299.28 seconds and remains failed.

In-fixture teardown reports a busy mount and one retained identity record/source. The outer driver subsequently removes its owned container, and a host read confirms its loop device has no backing file. Preserve the failed cleanup receipt separately from this final containment cleanup. The complete container also has an existing 240-second outer timer (const timeout, scripts/prove-worker-identity.ts:318); its allowance must account for newly composed sequential work rather than cut a valid child sequence short.

Scope and selected correction

Use the existing concrete phase inventory and unchanged 90-second per-phase / five-second cleanup limits to compose the application-parent allowance. Keep selection in one shared test helper so default, shared/private and explicitly selected application scenarios cannot drift from the budget calculation. Preserve the existing outer allowance for unchanged work and add only the additional composed application/profile allowances. No product runtime, new optional platform interface or arbitrary sleep is needed.

Acceptance criteria

• Preserve the actual failed source/runtime identity, completed phase timings, interrupted strict phase and failed in-fixture cleanup.
• The parent allows every selected existing phase its current limit plus existing cleanup; all phase selections and refusal assertions remain unchanged.
• The complete container allowance accounts for the expanded sequential work and remains finite. Individual SDK and application limits are unchanged.
• The actual formerly failing complete offline native command passes after the correction, including all selected phases and zero owned resources. Retain the failing-first receipt; restore a meaningful budget mutation where needed for additional paths.
• Run the citation audit, required preflight and selected hosted proof with actual identities. No passing retry is represented as repair without a source correction.

Verification and contract impact

Test-fixture orchestration only; no consumer changeset or public machine contract. Supporting verification discovered during #1782's dependent/blocker chain and #2315's independent qualification. No new Storage product requirement is introduced.

Local correction and verification before hosted confirmation

Implementation: PR #2384.

2026-10-18: candidate 20028ce746ae7f0ac300a94d9731169498e1f79e, tree d5c8e524e7547762fb219673580dd4c87761700f, on branch test/2315-relay-profile-budget-n7v4, implements the scoped SDK and application-parent corrections together. Branch base is main 82a64a13a08c44f2daef425d1a9df2c10840ea8e; later main 63fde3c8fe76e754aa4524f95b23f9786f4447fe changes only browser shard measurements and is not represented as a tested combined tree.

The complete unchanged offline command now passes in 324.81 seconds on the pinned image. All 27 identity controls, 13 egress controls, 20 checkpoint-reader controls, both complete separate-UID SDK profiles, actual Btrfs manager proof, all four application phases and both prepared-consumer modes pass. Application phase receipts are controls 56,016.80 ms, fresh 38,738.48 ms, warm 46,166.67 ms and strict 34,654.66 ms. The parent allows 365,000 ms derived from four 90,000 ms phases and 5,000 ms cleanup; the containing command preserves its existing allowance plus the added sequential application/SDK allowances. Individual limits and assertions are unchanged.

Cleanup is successful in the fixture and outer driver: no owned records, source directories or workers, no mounted filesystem/backing attachment/backing file, no retained loop device, and the owned container is removed. The earlier failed application's in-fixture cleanup remains failed. Its forced container removal detached the backing but retained an empty kernel loop device; the first corrected attempt correctly refused that prerequisite. After checking the original ownership receipt, no other containers and no attachment, an exact-inode-bound removal cleaned up only that owned empty device. The recorded passing command starts from the restored prerequisite; the refusal guard is unchanged.

The original SDK 25-second mutation still fails the real nonzero-child-exit assertion after three complete turns and entry to turn 3, and is restored byte-for-byte. The original 180-second application failure remains its failing-first receipt. A phase-inventory mutation drops strict and fails the named assertion; restored selector/variant tests pass 6 tests / 115 assertions. The focused selector/collector/citation batch passes 49 tests / 151 assertions; the final citation audit passes 44 tests / 113 assertions. Strict types pass in 100.88 seconds with the repository's 4 GB Node setting. Required bun run check:pr --base origin/main passes in 228.46 seconds: all lint/metadata gates, 956 fast tests / 6,328 assertions, and 11 affected tests / 158 assertions, with no failures or skips. The comparison records origin/main 63fde3c8fe76e754aa4524f95b23f9786f4447fe and merge base 82a64a13a08c44f2daef425d1a9df2c10840ea8e. PR #2384 carries the independent correction and is being marked ready for complete selected hosted proof. No merge or #2334 resolution is claimed.

Delivered outcome

2026-10-18: delivered in #2384, squash 775eb17aab740fa759c2182f306c38fc17acbcbe on main. Ready CI run 39079730529, attempt 1, passes all 16 selected jobs. All actual checkout logs and the aggregate agree on 8f58e17b9918759c222a2761588000e3fe22c526, parents 63fde3c8fe76e754aa4524f95b23f9786f4447fe / 20028ce746ae7f0ac300a94d9731169498e1f79e, tree 9bafce7fd33a5ee8b367f25f28136845cec40112. Contract passes after the final body update. The local failing-first/mutation and corrected complete native receipts remain in the PR.

Main advanced by the independent diagram-test/capture-metadata change #2368. Its diff was inspected before merging; the older run is not claimed to cover that newer combination. The actual squash has parent b7a0885181445125d576e02f61c562d704c81099 and tree 1c76c2edc20ead25ffdec16dffa644459069e5b4, matching the precomputed combination, and is confirmed on remote main. Automatic main-push confirmation is complete; the independently verified result follows below.

Both #2315 and #2382 are closed, and their 0.44.0 milestones and the PR milestone were read back. This closes the native deadline-composition corrections, not the separate Storage product or #2334 investigation.

Automatic main-push confirmation

2026-10-18: automatic main-push CI run 39081370533, attempt 1 passes all 16 selected jobs on squash 775eb17aab740fa759c2182f306c38fc17acbcbe. Every actual job checkout, including verify, pack and the aggregate job, matches that SHA. The immutable API and local git object agree on parent b7a0885181445125d576e02f61c562d704c81099 and tree 1c76c2edc20ead25ffdec16dffa644459069e5b4. The aggregate selects all nine proof categories, reports success for each, and retains no earlier execution. This establishes the actual combined main tree separately from the earlier PR run.

The test skips are verified against that checkout: 24 deliberately disabled paid image-provider cases; four inverse empty vector placeholders while their substantive controls pass; and ten soft-keyboard cases excluded only from the fine-pointer project, with all of those cases executing in the coarse and mixed projects. No selected job is missing, cancelled or skipped. The PR and both delivered issues retain milestone 0.44.0; #2315 and #2382 remain closed. The distinct Storage investigations remain open.