Skip to content

fix(pi): a 5s test deadline cannot cover a cold Python launch on Windows #496

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SUaDtL merged 2 commits into from
Jul 26, 2026
Merged

fix(pi): a 5s test deadline cannot cover a cold Python launch on Windows #496

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
59adbb0
fix(pi): a 5s test deadline cannot cover a cold Python launch on Windows
SUaDtL Jul 26, 2026
b1bff5e
Merge origin/main into fix/495-windows-spawn-deadline
SUaDtL Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .codearbiter/gate-events.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -983,3 +983,4 @@ Claude-Session: https://claude.ai/code/session_015ZDVU1BzUqnnPVHbZ397bX') stages
[2026-07-26T13:49:34Z] REMIND [H-12] hook=post-write-edit.py | core/pysrc/_sloplib.py is governed by ADR-0011 (Multi-host support — third sibling plugin ca-codex via shared core + thin host adapters). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently.
[2026-07-26T13:49:39Z] REMIND [H-12] hook=post-write-edit.py | core/pysrc/_sloplib.py is governed by ADR-0011 (Multi-host support — third sibling plugin ca-codex via shared core + thin host adapters). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently.
[2026-07-26T13:49:48Z] REMIND [H-12] hook=post-write-edit.py | core/pysrc/_sloplib.py is governed by ADR-0011 (Multi-host support — third sibling plugin ca-codex via shared core + thin host adapters). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently.
[2026-07-26T14:10:47Z] REMIND [H-12] hook=post-write-edit.py | plugins/ca-pi/tools/test/security.test.ts is governed by ADR-0013 (Add ca-pi as a sibling governance plugin using the shared core and a thin Pi adapter). If this change contradicts it, route to /ca:reconcile or /ca:adr — do not drift silently.
20 changes: 18 additions & 2 deletions plugins/ca-pi/tools/test/security.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,22 @@ describe("ADR-0014 adversarial promotion contract", () => {
expect(workflow).toContain("test_pi_security.py --sarif");
});

// #495: the two tests below each launch a cold CPython process SYNCHRONOUSLY,
// so the wait is billed against the test's own deadline. The script is not the
// slow part - `test_pi_security.py --contract-only` runs in about 70ms. What
// does not fit in vitest's default 5s is process creation plus interpreter
// startup on a loaded windows-latest runner, where both are an order of
// magnitude more expensive than on Linux; ubuntu and macos passed every run
// that windows failed. The deadline therefore has to cover a process LAUNCH,
// not a computation, and it is platform-aware rather than uniformly larger so
// a genuine hang on the fast platforms still surfaces as a hang.
//
// This is not cosmetic. `[GATE ] | [REPO] | Merge readiness` aggregates this
// suite, and the release preflight requires that gate green for the EXACT
// commit being tagged (#385) - so a flake here blocks the release lane for that
// SHA, and trains readers to re-run a red gate without reading it.
const PYTHON_SPAWN_TIMEOUT_MS = process.platform === "win32" ? 30_000 : 5_000;

test("security evidence output is result-code-only even with secret-bearing ambient values", () => {
const python = process.platform === "win32" ? "python" : "python3";
const script = resolve(import.meta.dirname, "../../../../.github/scripts/test_pi_security.py");
Expand All @@ -429,7 +445,7 @@ describe("ADR-0014 adversarial promotion contract", () => {
expect(JSON.stringify(report)).not.toContain("prompt");
expect(JSON.stringify(report)).not.toContain("provider");
expect(JSON.stringify(report)).not.toContain("stderr");
});
}, PYTHON_SPAWN_TIMEOUT_MS);

test("SARIF high gate reports only a fixed code and count", async () => {
const root = await mkdtemp(resolve(tmpdir(), "ca-pi-security-sarif-"));
Expand Down Expand Up @@ -463,7 +479,7 @@ describe("ADR-0014 adversarial promotion contract", () => {
} finally {
await rm(root, { recursive: true, force: true });
}
});
}, PYTHON_SPAWN_TIMEOUT_MS);
});

// Issue #464 AC-2. `security-controls.md` states that tests use disposable Pi
Expand Down
Loading