Stress sustained native tasks, memory, cancellation and process cleanup

Author: ShadowfetchStudio

.github/workflows/native.yml

@@ -30,6 +30,13 @@ jobs:
       - run: cargo +1.95.0 build -p shadowcode-desktop --locked
       - name: Exercise the native CLI without a display
         run: node scripts/test-native-cli.mjs
+      - name: Stress repeated native tasks, cancellation, output and cleanup
+        run: node scripts/test-native-stress.mjs
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        if: always()
+        with:
+          name: native-stress-diagnostics
+          path: artifacts/native-stress
       - name: Exercise the native terminal through a real PTY
         run: node scripts/test-native-tui.mjs
       - name: Exercise the native MCP server without a display

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## 0.20.0 — native development (unreleased)
 
+- CI now exercises 200 native tasks, stalled-provider cancellations and output
+  floods while checking memory, descriptors, child cleanup and history integrity.
+
 - Native development: reviewed CLI and desktop rescue for missing worktrees restores retained
   commits into a new checkout while preserving the original branch, index and
   registration; missing uncommitted files are not reconstructed.

docs/NATIVE_MIGRATION.md

@@ -123,6 +123,11 @@ Implemented foundation:
   use scoped shell/start and stop approvals, command hooks, bounded status/log
   reads and durable task attribution. These project processes intentionally
   survive coding-task completion or cancellation until explicitly stopped.
+- Sustained native-engine verification covers 200 tasks across four projects,
+  stalled-provider cancellation, repeated subprocess output floods, sampled
+  memory/descriptors, process cleanup and persisted history after restart.
+  Desktop memory, long individual conversations and larger repository stress
+  remain separate checks.
 - A persisted native task loop, per-workspace FIFO follow-ups, four concurrent
   workspaces, scoped approvals, cancellation that waits for cleanup, restart
   recovery, and atomic completion/usage/event commits. Continuation and branching

docs/NATIVE_VERIFICATION.md

@@ -251,6 +251,32 @@ The [plugin guide](NATIVE_PLUGINS.md) documents the supported schema, example
 bundle, limits, separate executable activation and partial-install recovery.
 Legacy Python bundles remain on disk and are explicitly reported for conversion.
 
+## Sustained native-engine stress
+
+`node scripts/test-native-stress.mjs` runs the native executable without a display
+against a disposable profile and scripted compatible provider. Fifty batches
+submit one task to each of four projects: **200 completed tasks / 405 provider
+requests**, including actual bounded reads of 105 KB files and roughly 32 KB
+assistant answers. Five deliberately stalled provider requests are cancelled.
+Ten manual subprocesses each produce 1 MiB of output; each must exit successfully
+and report truncated, nonempty bounded output.
+
+The final local run sampled engine RSS at 83,464–85,352 KiB, with 84,908 KiB after
+the subprocess phase: 828 KiB above the 40-task warm-up sample. All samples had
+14 descriptors and 21 threads; no engine-owned child processes remained at the
+sample points. SQLite integrity passes, exactly 200 completed and five cancelled
+jobs persist with no active jobs, and an early job remains readable after clean
+shutdown and reopening the profile. CI runs the same probe and uploads its JSON
+measurements or failure diagnostics under `native-stress-diagnostics`.
+
+The regression allows less than 64 MiB RSS growth after warm-up, sampled RSS below
+384 MiB, and at most twelve additional descriptors. These are regression bounds,
+not a general memory guarantee. Samples measure the engine process, not WebKit,
+model-server memory, or transient peaks between samples. Large repository maps,
+long individual conversations, desktop memory and longer-duration soaks remain
+separate release checks. `SHADOW_STRESS_BINARY` must point directly to the native
+ELF executable; an AppImage launcher is deliberately rejected for RSS attribution.
+
 ## Native terminal interface
 
 The initial `shadowcode tui` frontend passes a real-PTY probe with **8 scripted