Development record
Adversarial cost guards in the scanner's adjacency tests assert wall-clock seconds, which is a property of the machine rather than of the code, so they pass locally and fail on slower CI hardware under the race detector. One failed on both CI runners at 22.5 seconds against a 15 second bar while passing locally at 11.0 seconds on the same commit; the branch that introduced the probe and the merged tree measured identically, so it was not a regression. It was fixed for the costliest shape by shrinking that case's input, which is the lever the test file's own helper documents, but three sibling bars carry the same fragility and the same thin headroom. The machine-independent cost-CLASS guard beside them is the better model: it doubles the input and asserts the growth ratio, which no hardware difference can flip. Worth converting the remaining wall-clock ceilings to ratio assertions, or at least measuring a per-machine baseline and asserting a multiple of it.
Adversarial cost guards in the scanner's adjacency tests assert wall-clock seconds, which is a property of the machine rather than of the code, so they pass locally and fail on slower CI hardware under the race detector. One failed on both CI runners at 22.5 seconds against a 15 second bar while passing locally at 11.0 seconds on the same commit; the branch that introduced the probe and the merged tree measured identically, so it was not a regression. It was fixed for the costliest shape by shrinking that case's input, which is the lever the test file's own helper documents, but three sibling bars carry the same fragility and the same thin headroom. The machine-independent cost-CLASS guard beside them is the better model: it doubles the input and asserts the growth ratio, which no hardware difference can flip. Worth converting the remaining wall-clock ceilings to ratio assertions, or at least measuring a per-machine baseline and asserting a multiple of it.
Grounds
- pursued: the guards pass or fail identically on an idle and a loaded machine, and each still refuses the regression it names. A guard that fails on the real code under load, or passes with its bound removed, would show this wrong.
Frontmatter
| id | iss-2608290810037763 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608290810037763-adversarial-cost-guards-in-the-scanner-s.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2609012020476120Four test sites now assert elapsed wall-clock time where they mean to assert behaviour: iss-2608292246210181 and iss-2608290810037763 in the scanner's adjacency tests, iss-2608301301041887 in the grounds lock test, and the bootstrap fresh-install self-check in internal/surface/cli. Each was found by a CI flake and each is being fixed site by site. Worth deciding whether the rule 'a test asserts behaviour or an operation count, never a duration' graduates to a principle under .abcd/development/principles/ or to a lint rule that refuses a time.Since comparison in a _test.go file, so the fifth site is refused at draft time rather than found by the next flake. This is a design decision and was not taken during autonomous-run-2026-09-01, where it was carried from the session handover; the fourth site was fixed on its own merits.
- iss-2609012020479351TestBootstrapFreshInstallSelfCheck in internal/surface/cli asserts wall-clock time: it wraps one exec of the provisioned binary answering version in a timer and fails when elapsed exceeds five seconds. It failed on the macOS CI leg after v0.7.0 merged (run 33496438371: 5.77s, 'want about a second') on a tree the merge-queue leg had just passed; locally the same test passes in about one second. The timer measures a single process spawn of an ~18MB freshly written executable, which on macOS carries first-run code-signature validation against a cold page cache, so the number is a property of the runner, not of the code. The test's own comment names the budget as loosened 'so a loaded CI box cannot fail a check about provisioning on a timing wobble', and it then did exactly that. Fourth site of the class recorded by iss-2608292246210181, iss-2608301301041887 and iss-2608290810037763; carried from the session handover into autonomous-run-2026-09-01. The fix must assert the behaviour the gate is about -- the provisioned binary answers version correctly, as the version report, with no Go on PATH -- and carry no duration at all.