Make --timeout reach Python, http and nested blocks; run unit tests in CI

[b-macker]

Summary

--timeout is a flag the interpreter checks between steps. Work that runs inside the process without checking it only noticed the timeout after it finished on its own. This PR fixes three ways a script could run past --timeout. All three were measured with --timeout 3.

Case	Before	After
<<python>> busy loop (20 s)	20.1 s	3.06 s, both engines
Same loop wrapped in try: ... except Exception: pass	ran until killed	3 s
while true after one <<javascript>> expression	never stopped (killed from outside), both engines	3 s
while true after codegen.run(...)	never stopped	3 s
http.get(url, {}, 0) to a host that never answers	still connecting at 20 s	3 s

The JavaScript/codegen case was found while fixing the Python one. It is the most serious of the three: any script that ran a single JavaScript block had no time limit for the rest of the run.

This PR also runs the GoogleTest unit tests in CI, which was the rest of item 8.

Changes

• Timeouts nest (resource_limits.h/.cpp):
  • The problem:
    • Each thread has one timer. The CLI and REST server wrap the whole run in a ScopedTimeout, and the JS, shell, subprocess and C++ executors wrap each block in another one.
    • Each inner scope replaced the timer with its own budget, and its destructor cleared the timer on exit.
    • The counter used to cancel timers was shared by the whole process. So a scope on another thread cancelled the main thread's timer: the tree-walker runs this JavaScript off the main thread, and on the REST server one request could cancel another request's timeout.
  • The fix:
    • ScopedTimeout now records the deadline already in force. It can only shorten it, never extend it, and restores it on exit.
    • The cancel counter is now per thread.
  • 0 now means "no limit of its own". Before, it set a zero-second timer that killed every subprocess as soon as it started under the UNRESTRICTED sandbox preset (defect Add tab completion to REPL #4 in docs/unit-test-findings.md).
  • codegen.run set and cleared the timeout by hand; it now uses ScopedTimeout.
• Embedded Python (python_c_wrapper.c, python_interpreter_manager.cpp):
  • When the timeout fires, the timer thread schedules a callback inside CPython (Py_AddPendingCall) that raises TimeoutError in the running code.
  • The callback re-schedules itself while the timeout stands, so catching the exception doesn't keep the loop alive.
  • Before raising, it checks that the timeout is still in force, so a late callback can't hit a later, unrelated block.
  • On CPython 3.11, scheduling the callback alone did nothing (measured): Python doesn't notice a callback scheduled from another thread. The timer thread now briefly takes the Python lock (GIL), which makes the running thread check for it.
  • That lock step is skipped on Android, where taking the GIL from an outside thread is the crash this file already avoids.
• http (http_impl.cpp):
  • A curl progress callback stops the transfer once the timeout fires. curl calls it at least once a second, including while connecting.
  • A timeout_ms of 0 or less (libcurl's "never time out") now uses the 30 s default.
• Unit tests in CI (ci.yml, tests/unit/run_unit_tests.sh, tests/unit/known_failures.txt):
  • 559 tests pass.
  • The 30 known failures are listed, each with its reason from docs/unit-test-findings.md.
  • The runner fails if an unlisted test fails, if a listed test doesn't exist, or if a listed test starts passing, so the list has to shrink as fixes land.
  • Three tests that hang or crash (the AsyncCallbackPool deadlocks and use-after-free) are not run at all.
  • Two shell unit tests now print the error message when they fail.
• Docs: docs/unit-test-findings.md (items 2a, 2c, 2d, and the CI section) and a CLAUDE.md note on nesting timeouts.

Known limits, recorded but not fixed:

• Python code blocked inside a C call such as time.sleep isn't interrupted, because CPython only runs the callback between bytecodes. time.sleep(15) took 15 s on both the old and new code.
• Python running on a worker thread isn't interrupted, because CPython only runs these callbacks on its main thread.

Test Plan

• tests/security/test_timeout_reach.sh, 9 checks, all passing, measured on elapsed time rather than error text:
  • P-01/P-03: Python loops. P-04 is the control that Python blocks still finish normally under a timeout.
  • H-01: http. Skipped as unmeasurable if nothing on the network makes a connection hang.
  • N-js/N-cg: the loop after a JavaScript block or a codegen.run call must still be stopped.
  • On the old code, the control passes and the other 8 fail.
• run_unit_tests.sh reports PASS locally in about 4 s. I checked all three ways it can fail by editing the list: dropping an entry, adding a test that passes, and adding a typo. Each made it fail.
• The full suite, the error-message leak check and the VM/tree-walker differential run are still going locally; I'll post the results in a comment.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ELUfjXZvx8kzXo1UJjrAhC

---

Generated by Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}

[b-macker]

Local results on the head commit 9ce76ce (Linux, Debug):

• Full suite: 381 of 447 pass. The 2 unexpected failures are known issues in this container, caused by a stray /govern.json at its filesystem root: test_require_governance_gov007.sh and test_platform_fixes.sh. Both pass on CI.
• Error-message leak check: 874/874 pass.
• Engine comparison (VM vs tree-walker): 56/56 match.
• Unit tests (run_unit_tests.sh): 559 pass, and all 27 known failures still fail for their recorded reasons.

Since the PR was opened, two commits were added from the repo-sentinel dogfooding findings:

• Commit 306bd18:
  • Noisy dict.get hints are now capped per run.
  • The ternary hint now appears in every position, including inside dict literals, parentheses and call arguments.
  • Child processes are now limited on the memory they actually allocate instead of on reserved address space, with a 4× address-space backstop (minimum 2 GB). Before this, process.run("node", ...) could not start under elevated.
• Commit 9ce76ce: registers the two new test suites so CI runs them.

On an earlier local run, test_validation_signal.sh G-03 failed once. That run shared the machine with a parallel compile. The suite then passed 29/29 twice in isolation, and it passed in this run and on CI, so I'm treating it as load-sensitive rather than broken.

---

Generated by Claude Code